4 ms·
The rules (laws, really) on this are actually pretty clear. You can collect a lot of data for internal “operational”. A hospital could track surgical infection
by mattkrause 4y ago
The rules (laws, really) on this are actually pretty clear.
You can collect a lot of data for internal “operational”. A hospital could track surgical infections to see if an Operating Room needs decontamination or someone needs retraining. Likewise, the AD logs are fair game for sysadmin or admin purposes.
However, you need IRB approval for “research activities” that are meant to draw generalizable conclusions that extend beyond the immediate situation. How do cleaning schedules, in general, affect surgical outcomes? Do more logins lead to better student outcomes? The IRB can retroactively authorize you to look at operational data for that, or to collect new data, or even add in (some) perturbations.
- jrootabega 4y agoHmm... I'm still confused but that could be me. I would put the desk monitoring under the former category. Is this a decent example? Operational: We analyzed the performance logs on Tony's computer to show that he didn't use his CPU that much and thus could be given a cheaper model. Research: we used those same logs, and everybody else's, to show that most people use about 25% of their CPU capacity.
- mattkrause 4y agoIt’s definitely not a bright line, which is why you’re supposed to talk to the IRB. In your example, I think it depends on the audience and goal. If you’re using these data to plan a computer lab upgrade, it seems very clearly operational. If you wanted to publish a study entitled “Factors affecting IT utilization at an R1 university”, you probably need to run it by the IRB. In that case, they will almost certainly give you the go-ahead after reminding you not to include any identifiable information.