NB-IRDT takes privacy and security seriously. As a research data centre, NB-IRDT must comply with the New Brunswick Right to Information and Protection of Privacy Act (RTIPPA), the Personal Health Information Privacy and Access Act (PHIPAA), and other appropriate legislation that governs the access and use of personal information and personal health information. NB-IRDT’s governance structure, management, oversight, and operations are based in part on the very successful Manitoba Centre for Health Policy but have been refined and modified in close collaboration with provincial government privacy officers and security officers to reflect New Brunswick legislation, regulation and data characteristics.
NB-IRDT is a secure facility housing a stand-alone closed network of servers and workstations with multiple physical and virtual firewalls. Researchers seeking access to NB-IRDT resources are required to follow a formal application process (see NB-IRDT Approval Access Diagram), which includes the review and approval of a research ethics board, a peer review process, the review and approval of the NB-IRDT Data and Research Committee, and the privacy compliance review by the NB-IRDT Privacy Officer. All data access research work must be completed onsite within the secure environment of NB-IRDT.
Prior to the migration to NB-IRDT, all data sets are prepared by having directly identifying information removed or scrambled. Data are stored in unlinked form and project specific custom data sets are generated only once research has been granted approval. Approved users are granted to the assembled data set containing only the data elements approved for access.
For more information on the data protection and the preparation of data for research projects, contact the NB-IRDT Privacy Officer or read our policies and procedures.
Why is NB-IRDT able to access personal information?
NB-IRDT is a designated research data centre that has entered into a signed agreement with the province of New Brunswick under the New Brunswick Personal Health Information Protection and Access Act (PHIPAA). As a research data centre, NB-IRDT’s purpose is to compile or analyze statistical information that will assist in the management, evaluation or monitoring of resource allocations, government service planning or delivery of government services.
How does NB-IRDT protect my privacy?
NB-IRDT uses a variety of physical, technical and administrative safeguards to protect the information held in its custody. The information is held in a highly secure facility, and the information cannot be accessed from outside the NB-IRDT lab. Researchers who wish to access these data must go through a rigorous application process to ensure every New Brunswicker’s privacy is protected. Most important, NB-IRDT does not hold data with direct personal identifiers such as names, addresses or Medicare numbers.
What is prepared data?
NB-IRDT receives and holds only prepared data. Data are considered prepared when the personal identifiers, such as name and addresses of the individuals who are the subject of the data, have been removed from the data records, and any unique identifying numbers (including Medicare number) of the individuals who are the subject of the data have been removed or encrypted.
Can I be identified?
No, prior to NB-IRDT receiving any personal information all data are prepared by removing direct personal identifiers, such as your names, addresses and Medicare numbers. At the completion of a research project, mechanisms are in place for vetting the research results to ensure there is no residual or inadvertent disclosure of personally identifiable information.
Will I ever be contacted?
No, NB-IRDT will not contact individuals. NB-IRDT does not hold information that could directly identify individuals, thus individuals cannot be contacted.
How does NB-IRDT use my information?
NB-IRDT was created to serve an important role in facilitating policy relevant research to support informed and effective government decision-making. As a data research centre, NB-IRDT provides researchers with access to prepared personal level administrative data in a secure, controlled environment, while ensuring the protection of personal privacy of New Brunswickers. These researchers use these data to support improvements in healthcare and health outcomes.
How do researchers access information held by NB-IRDT?
NB-IRDT only permits access to researchers who have obtained approval through an exhaustive research project application and access approval process. This is a thorough process that requires researchers to submit detailed research proposals that are reviewed by the Data and Research Committee, the UNB Fredericton research ethics board, a scientific peer, and a privacy officer. All applicants must also complete criminal record checks and enter into confidentiality agreements.
How does using these data for research purposes support improvements in health care and health outcomes?
NB-IRDT provides a central location for researchers to access many provincial administrative health data sets. By accessing this data researchers are able to support improvements to health care by conducting evidence-based research that informs policy decisions that affect New Brunswickers. Operating at arms’ length from government, NB-IRDT provides unbiased, scientific results on questions related to health and social issues/prosperity for the current generation and those to come.
Where does NB-IRDT get information from?
Data held in the NB-IRDT repository are received from various provincial government departments and public bodies. Following the information protection practices found in legislation only prepared data may be received by NB-IRDT.
Are there similar Data Research Centres elsewhere in Canada?
Yes, there are data research centres in most Canadian provinces, such as the Health Data Nova Scotia, Institute for Clinical Evaluative Sciences in Ontario, and Population Data BC. In fact, NB-IRDT’s governance structure, management, oversight, and operations are based in part on the very successful Manitoba Centre for Health Policy with modifications to reflect New Brunswick legislation, regulation and data characteristics. A similar national resource would be the Canadian Research Data Centre Network (CRDCN) that provides access to Statistics Canada’s administrative data.
How can I find out what information NB-IRDT has about me?
By knowing your own personal history and reviewing our data set holdings and reference guides on our website you can gain a better understanding of what type of de-identified information NB-IRDT may hold about you. De-identified data means that the data does not hold information with any with direct personal identifiers, such as an individual’s name, address or Medicare number.
To whom can I raise a concern or make a complaint?
In keeping with New Brunswick legislation, everyone has the right to raise questions or concerns about the use and protection of personal information. Concerns regarding collection or the use at NB-IRDT may be raised with the NB-IRDT Privacy Officer or with the University Secretary of University of New Brunswick. An individual may also contact the Office of the Access to Information and Privacy Commissioner of New Brunswick.
For information concerning our policies and procedures, please consult the following NB-IRDT documents.
- NB-IRDT Access to Information Policy
The purpose of this policy is to outline NB-IRDT’s treatment of requests for access to business records, and personal and personal health information as provided under the New Brunswick Right to Information and Protection of Privacy Act, SNB 2009, c R-10.6 (RTIPPA) and the Personal Health Information Privacy and Access Act, SNB 2009, c P-7.05(PHIPAA).
NB-IRDT Conflict of Interest Policy
From time to time, the NB-IRDT Director, individuals who are employed at NB-IRDT or act as a member of the Data and Research Committee will be engaged in research activity using data contained in NB-IRDT: as principal investigators; part of a research team; or in conjunction with government officers responding to administrative requests. In these situations of overlapping roles, there is the possibility of a conflict of interest arising. The purpose of this policy is to delineate the roles, responsibilities and process for the identification, elimination, minimization and/or management of perceived, potential, or real conflicts of interests.
- NB-IRDT Data Confidentiality and Security Policy
The intent of this policy is to describe how confidential data held at NB-IRDT in its Data Repository are protected from unapproved or inappropriate access. This policy outlines confidentiality requirements and security measures that are in place to protect the data upon its receipt from government departments and agencies and during its use at NB-IRDT.
- NB-IRDT Data Retention, Destruction and Restoration Policy
The intent of this policy is to outline the how data are held, archived and destroyed. This includes the timeline for retaining and destroying the data.
- NB-IRDT Dissemination of Research Findings Policy
This policy documents the notification process for the dissemination of all research material that utilized NB-IRDT data, and the wording required to describe the use of NB-IRDT data in the distributed material.
- NB-IRDT Facility Security Policy
The purpose of this policy is to describe the security protocol regarding entry into the NB-IRDT Secure Facility.
- NB-IRDT Mobile Device Policy
The purpose of this policy is to clearly explain the security practices of NB-IRDT regarding the use of mobile devices. This policy is in keeping with best practices with respect to the protection and appropriate use of Personal Health Information and Personal Information.
- NB-IRDT Passwords Policy
This policy outlines the expectations for the creation and usage and frequencies of change of passwords for the Information Technology (IT) resources of NB-IRDT and should be read in conjunction with the NB-IRDT User Access Account Policy.
- NB-IRDT Privacy Breach Policy
The purpose of this policy is to guide NB-IRDT researchers and staff on how to proceed in the event of a privacy breach, and to demonstrate to stakeholders that a systematic procedure is in place to respond to and deal with a privacy breach.
- NB-IRDT User Access Account Policy
This policy describes the different levels of permitted access to data, and the processes for setting up appropriate user access accounts for NB-IRDT employees and approved users.
NB-IRDT Procedures and Guidelines
- NB-IRDT Authorship and Acknowledgement Guidelines
THe purpose of these guidelines is to provide guidance regarding authorship and appropriate acknowledgements to be included in publications resulting from NB-IRDT research projects.