This language may be useful in the sections of your IRB proposal that discuss possible risks to participants.
There is no discomfort associated with recording coughs. There are possible minimal risks in the following areas:
a. Inadvertent release of PHI: risk minimized by <details, e.g., use of REDCap for management of clinical data and other PHI >
c. Recording of sounds poses specific ethical concerns regarding privacy of data. Following legal and technical expert consultation, these are addressable at several independent levels.
- Device level: While prolonged sound recordings can be used to identify participants (e.g. Amazon’s Alexa device [Alexa User Guide 2020]), the short snippets (< 0.5 seconds) recorded by the Hyfe Research app cannot. Conversations or acoustic environments are not recorded.
- Study level: At all points, participants can opt out of the study and monitors/phone apps will be removed. Our consent process will explicitly describe exactly what is and is not recorded. We will employ standard data encryption and safety tools at rest and in transit. Specifically, this project will use the Hyfe Research app, which uses the Google Cloud platform for data management and storage. Firebase uses industry-standard encryption and security protocols. Firestore, the Google Cloud storage architecture (where audio files and associated meta-data are stored) is HIPAA-compliant. Both audio files and associated meta-data are encrypted in transit using HTTPS. When the server receives a file, it is processed through the Hyfe algorithms, and sounds likely to be cough are stored in <=0.5 second files on encrypted disks. Servers are physically located in the United States.
- Data sharing level: Data will be transferred from Hyfe to the research team via a data dump occurring at regular intervals (usually one week). Each research participant/site will be associated with a "Hyfe ID" number; all audio files and meta-data transferred from Hyfe to the research team will be linkable to the study participant/site via this "Hyfe ID" number. Hyfe will not have access to the study participants' identity. Data will be transferred in encrypted form over a secure line (HTTPS); only the PI or authorized delegate on the research team will have the decryption key. The software used for handling transfers will be a custom-made web application, hosted on the Google Cloud platform on servers physically located in the United States.
All data will be stored on secured servers. We adhere strictly to principles of data sharing for public good and will deposit appropriate anonymized acoustic data in the Sage Bionetworks Synapse system (https://sagebionetworks.org/tools_resources/synapse-platform/ ) specifically to ensure that all such shared data is done so in compliance with ethical and legal standards and in service of improving health.