I. Requirements for Receiving Restricted Data from HRS

1. Introduction

Although some HRS datasets are unrestricted (i.e., freely available through the Internet or from HRS staff on condition that the researcher not attempt to identify individual respondents), other HRS datasets are restricted, and are available only under specific contractual conditions. The remainder of this document describes those conditions.

The restrictions exist for two reasons. First, HRS staff members take the promise of respondent anonymity very seriously. Our respondents provide us with large amounts of information about their lives, and respond at several points in time (HRS is a longitudinal or panel study). This enormous amount of information at several time-points greatly increases the likelihood that an individual (or family, household, employer, or pension benefit provider) can be identified, which is not the case with a one-time, small sample survey. We have tried to minimize the danger of breaches of respondent anonymity in both unrestricted and restricted datasets by aggregating critical variables such as geographic location and occupation/industry up to less specific levels than those provided by the respondent. We have also devised the contractual procedure described below to ensure that restricted datasets are released only to persons who meet stringent conditions designed to protect the anonymity of respondents.

The second major reason for restrictions on the release of certain HRS restricted data sets is that we have obtained certain items of data from third parties (with the permission of respondents), and those third parties have required us to impose specific conditions on the release of those data. For example, in 1992-1996, the great majority of HRS cohort respondents gave HRS permission to obtain earnings data from the Social Security Administration. The Social Security Administration provided the data to HRS under the terms of a 1993 Memorandum of Understanding, which established conditions for dissemination to the research community based on SSA's understanding of its obligations under federal law and regulations, as well as SSA policy. Additional restrictions were included at the suggestion of the National Institute on Aging (NIA), the major funding source for HRS, in order to ensure that any restricted agreements would be enforceable from a practical standpoint.

Violations of respondent anonymity, or of HRS agreements with SSA and other providers of data about respondents, or of the procedures designed to ensure that such violations do not occur, would be very costly. They would violate the privacy of respondents and the trust they have placed in HRS to protect their anonymity. Such violations would also inflict an enormous loss on the entire research community, since they undermine the willingness of individuals to participate in surveys and of government agencies to provide data about respondents that can be merged with the survey data. Because the potential damage is so great, the procedures outlined below are particularly strict.

The following materials have been developed by the HRS Data Confidentiality Committee, in consultation with the Social Security Administration, in an effort to permit dissemination of HRS datasets to the maximum number of responsible researchers while satisfying its own concerns about respondent anonymity and the requirements of agencies which supplied some of the data. Each application for access to HRS Restricted Datasets will be reviewed by the HRS Data Confidentiality Committee (a group consisting mainly of non-HRS staff of the Institute for Social Research), for conformance with the spirit and letter of the requirements outlined in these materials, and no Restricted Data will be distributed without the approval of the Committee.

The procedures and requirements below are somewhat complex, so we realize that applicants for Restricted Data may have questions during the process.

2. Outline of Requirements

Researchers may be eligible to receive HRS Restricted Datasets only if and when they meet all of the following requirements:

A. Affiliation with an institution with an DHHS-certified Human Subjects Review Process

The institution with which the researcher is affiliated must have obtained an Assurance of Compliance from the Office for Human Research Protections (OHRP) of the Department of Health and Human Services (DHHS). Only persons with permanent, faculty-level appointments at such institutions may receive HRS Restricted Datasets.

Note: Under the DHHS human subjects protection regulations (45 C.F.R. 46.103), every institution engaged in human subjects research that is funded or conducted by DHHS must obtain an Assurance Of Compliance approved by OHRP. This Assurance Of Compliance, when granted, is called a Federal-Wide Assurance.*

Although nearly all research colleges and universities in the United States meet this requirement, we are aware that there are institutions that have not received such certification, and that some legitimate researchers may be excluded from access under this condition. Researchers who fall into this category may wish to use the Michigan Center on the Demography of Aging Data Enclave in order to gain access to HRS restricted data.

B. Current Receipt of Federal Research Funds

The person(s) primarily responsible for the research project using HRS Restricted Data (the "Restricted Data Investigator" in these documents) must be a current recipient, as a Principal Investigator or Co-Principal Investigator, of research funds from an agency of the United States government. As researchers will notice, the primary sanction currently available to HRS for violations of the Agreement by researchers, is notification of the violations (probably through the National Institute on Aging) to the appropriate United States government funding agency, with a possible recommendation of termination of current, and denial of future, research funding to the investigators. This sanction presumably has greatest salience to persons with current federal research funding, and therefore we are initially limiting eligibility to receive Restricted Data to persons with such grants or contracts. If in the future we are able to develop alternative sanctions (security deposits, financial liability of institutions receiving Restricted Data), we will consider providing access to persons who do not have current United States government research funding.

If you do not have United States government funding at the time you begin the process of applying for access to HRS Restricted Data, but are applying for such research funds for the purpose of using the Restricted Data, all aspects of the application process except contract signing and proof of a federal research award, can be completed pending a decision on your proposal. If you do get the United States government research award, the Agreement signing can then go forward. HRS will be willing to make a written statement to your sponsor that, on the basis of the materials you have provided us to date, you will receive the Restricted Data after completion of the contractual conditions.

C. Research Proposal

Applicants for HRS Restricted Data must provide to HRS staff a short (1-3 page) research proposal, that includes a synopsis (or a full statement, if necessary) of your research goals, and specifies:

• the types of variables from HRS Restricted Datasets you intend to use in your research; and
• why you believe the unrestricted versions of those variables, if any, are not adequate for your research purposes.

D. Restricted Data Protection Plan

Examine Developing a Data Protection Plan (below) and investigate the mechanisms that are available to you to meet its requirements at the site(s) at which the Restricted Data will be managed, analyzed, and stored. This may require some discussion with computing personnel at your institution, and perhaps even obtaining permission to acquire special hardware or software. If you intend to maintain Internet connectivity, you should read The Restricted Data Environment: Issues Relating to Network-Connected Clients. Once you have assured yourself that you can meet the requirements set forth in both documents, draft your Restricted Data Protection Plan and mail a copy to HRS as specified in Section III.D. below. HRS staff will examine the draft plan, and may require some amendments. Do not be surprised if your Plan requires revision before it can be approved.

Take careful note that the Restricted Data Protection Plan must define and treat variables/fields derived from the original Restricted Dataset as Restricted Data.

(It is possible for a variable derived from original restricted data to be later reclassified as unrestricted, and even included in future releases of unrestricted datasets with appropriate credit to the creator. The HRS Data Confidentiality Committee will consider requests from researchers to reclassify derived restricted variables. Such requests for reclassification should explain why you believe that the derived variables do not significantly increase the risk of identification of individual persons, families, households, employers, and benefit providers, compared to other unrestricted data; are accompanied by the computer code used to create the derived variables, and documentation of the rationale and the analytic utility of the derived variables; and include a data file containing HRS ids, the original restricted and unrestricted variable(s) used to create the derived variables, and the derived variables. Variables derived from Social Security Administration restricted data may be reclassified only with the approval of SSA. [By "benefit providers", we mean employee benefit plan providers, such as pension plans and insurance companies; we do not mean sole providers of particular sorts of benefits, such as the Social Security Administration for RSDI or the Health Care Financing Administration for Medicare.])

(Aggregate statistical summaries of data and analyses, such as tables and regression formulae, are not "derived variables" in the sense used in the Agreement, and are not subject to the requirements of the Restricted Data Protection Plan and the Agreement.)

E. Human Subjects Review

The chairperson of your institution's Institutional Review Board/Human Subjects Review Committee must certify that the Board/Committee has reviewed and approved your Restricted Data Protection Plan (and the portions of your Research Plan that deal with respondent anonymity and data security, if any), as approved by ISR, in accordance with the standards and procedures used for live human subjects. No abbreviated review, or lower standards, such as are sometimes used for "secondary data analysis", may be used in this aspect of the human subjects review. HRS respondents are indeed live human subjects, and HRS will be going back to them for more data in the future. The enclosed "Certification of Human Subjects Review" should be used for the certification. Because the IRB/HSRC review at your institution must include the Research Plan and Restricted Data Protection Plan that have been approved by HRS, you should not submit your proposal for IRB/HSRC review until you have received the HRS approvals.

F. Agreement for Use of Restricted Data from the Health and Retirement Study

The Restricted Data Investigator applying for HRS Restricted Data, all other persons who will have access to the Restricted Data, and a representative of the Receiving Institution, must sign the Agreement for Use of Restricted Data from the Health and Retirement Study. You may wish to submit the blank form of the Agreement in advance to your institutional signatory, to determine whether they are willing to sign it.

You should especially note the following in the Agreement:

1. Restricted Data can be used only for research and statistical purposes, and the Research Plan must specify all of the research projects that will make use of the restricted data. It is not permitted, for example, for a faculty member to obtain the data for her own research project and then "lend" it to a graduate student to do related dissertation research, even if the graduate student is a Research Staff signatory, unless this use is specifically stated in the Research Plan.

2. You must either destroy, or return to HRS, all versions of the Restricted Data and data derived from it, regardless of the form in which it exists (tapes, hard disk, diskettes, and other physical media) within 24 months, or such other period as is specified in the approved Research Plan, or upon a demand from HRS. Researchers who need additional time should make a formal written request for an extension at least 30 days prior to the expiration date, and HRS will give prompt consideration to such requests. However, neither the initial time period, nor any extension of it, may exceed the time period of the grant or contract under which the data are being analyzed. One implication of the time limits is that you should assure yourself that you have adequate time available to do the data management and analysis you have planned. In brief, you may not retain any copies of or data derived from the Restricted Data, after the conclusion of the contract period. HRS staff will store the physical media containing such data for you, at your request for up to two years, so that it can be available to you if you obtain a second Agreement for further analysis.

3. the Restricted Data Investigator must be a person who is a current Principal Investigator or a Co-Principal Investigator of a current federal agency research grant or contract;
4. the Restricted Data Investigator must be affiliated with the receiving institution with a position or title equivalent to a permanent tenured or tenure-track faculty member;
5. all Co-Investigators and Research Staff must have a formal affiliation with the receiving institution, and must specify that affiliation and job title in the signature blocks of the Agreement and Supplemental Agreement of Research Staff. If new persons become affiliated with the research project, and are to have access to the Restricted Data, an additional Supplemental Agreement of Research Staff must be signed by the new persons and the Restricted Data Investigator, and approved by HRS staff, before the new person is given access to the Restricted Data.

   HRS will permit persons who were not original Principal Investigators or Co-Principal Investigators on current federal research grants or contracts, to be added to such a project as a Co-Principal Investigator and to become Co-Investigators on Agreements for the Use of Restricted Data from HRS, provided the Principal Investigator of the federal grant or contract signs the Agreement as the Restricted Data Investigator, and HRS is provided a copy of the federal agency's written approval of the addition of the new Co-Principal Investigator. (The National Institute on Aging has indicated a willingness to facilitate the addition of persons as Co-Principal Investigators to existing NIA grants and contracts for purposes of facilitating access to HRS Restricted Datasets. Persons who wish to explore this option should contact:

   
   Richard Suzman, Chief, Demography and Population Epidemiology
   Behavioral and Social Research Program, National Institute on Aging
   Gateway Building, Room 533
   7201 Wisconsin Avenue
   Bethesda MD 20892
   phone: 301-496-3136, fax: 301-402-0051

6. Your institution must agree to treat violations of this agreement, and allegations of such violations, as violations and allegations of violations of its policies on scientific integrity and misconduct, as to substance, procedures, and penalties.

7. The representative of your institution who signs the Agreement must have the authority to bind the institution contractually.

3. Recommended Procedures for Applicants

A. Obtain:

1. The Federal-Wide Assurance number and expiration date for your institution. (This is issued by the United States Department of Health and Human Services Office for Human Research Protections; it informs HRS that your institution's IRB is registered with OHRP);
2. a copy of your current federal research grant or contract award letter(s);
3. a copy of your institution's policies and procedures on scientific integrity and misconduct, including the name and address of the person or office responsible for enforcing them; and
4. a copy of your resume or curriculum vitae.

B. Write:

1. your Research Plan; and
2. your Restricted Data Protection Plan.

C. Mail the items in A. and B. to HRS.

D. Obtain and mail to HRS (following HRS approval of your Research Plan and Restricted Data Protection Plan):

1. the Certification of Human Subjects Review (based on your submission of your Research Plan and Restricted Data Protection Plan); and
2. TWO originals of the Agreement for Use of Restricted Data from the Health and Retirement Study (both will be countersigned by HRS and one returned to you).

Application mailings should be directed to:

Cathy Liebowitz
Survey Research Center
Box 1248
Ann Arbor, Michigan 48106-1248
-or-
426 Thompson, Room 3050
Ann Arbor, Michigan 48104-2321

phone: 734-763-4180
fax: 734-647-1186
email: catlieb@isr.umich.edu

---

4. Sanctions for Violation of the Agreement

The Agreement for Use of Restricted Data from the Health and Retirement Study specifies four possible sanctions against researchers who violate the terms of the agreement:

1. denial of all future access to HRS Restricted Data;
2. report of the violation to the Receiving Institution's office responsible for scientific integrity and misconduct, with a request that sanctions be imposed under the institution's scientific integrity and misconduct policy;
3. report of the violation to federal research funding agencies, with a recommendation that all current research funds be terminated, and all future funds be denied, to the Investigator(s) and to all other persons implicated in the violation; and
4. such other remedies as may be available to HRS under law.

When HRS staff determine that there may have been a violation of the Agreement, HRS will communicate the allegations in writing to the Restricted Data Investigator and offer the investigators an opportunity to respond in writing. HRS may also, at the time the allegations are communicated, demand return and/or destruction of all copies of Restricted Data in the possession of the Investigator(s), Research Staff, and any unauthorized persons, and certification of the return/destruction by the Restricted Data Investigator. If HRS Data Confidentiality Committee determines that the allegations of violations were incorrect, HRS will return any copies of the Restricted Data to the Restricted Data Investigator under the conditions of the original Agreement.

If the HRS Data Confidentiality Committee determines that the allegations of violations of the Agreement were in any part correct, it will determine the appropriate sanction. If the sanction includes notification of federal funding agencies with a recommendation to terminate current and deny future federal research funding, the HRS Data Confidentiality will communicate its notification of violations and recommendations to the HRS Program Officer at the National Institute on Aging, who will in turn convey it to appropriate officials at the NIH Office of Scientific Integrity, the National Science Foundation, the Social Security Administration, the Health Care Financing Administration, and other federal agencies.