17 - Third-Party Vendor Policy Awareness Program

Background:  The IRB often receives submissions involving third-party vendors. Activities performed by vendors often do not engage them in human subjects research because they are commercial services like software development, transcription, lab analyses, and document translation. A program was developed to assist researchers with following non-IRB vendor policies sometimes overlooked.

Program

Description:  The IRB administrative office implemented a program to connect researchers with institutional units that oversee use of third-party services. Researchers proposing use of vendors for information technology (IT) services are directed to contact an IT security liaison. The security liaison assists in ensuring there is an existing contract with the institution and verifies that IT security standards are met. Researchers using non-IT vendors are directed to contact the institution’s procurement services. Procurement services are able to verify whether a contract with the vendor is in place or, if no contract is in place, provide guidance on entering a contract with the vendor. IRB analysts have generated a list of known vendors that have been cleared by either the IT security liaisons or procurement services. Since implementation, the program has significantly reduced the number of instances where study teams used vendors without verifying that non-IRB policies were met, demonstrating its effectiveness.

Program

Assessment:  The program has successfully connected researchers to units that oversee the use of third-party services. There is increased awareness among IRB analysts and study teams regarding the requirements related to third-party vendors. Additionally, there is evidence of improved efficiency in identifying the need for third-party vendor verification early in the review process. Qualitative feedback from researchers indicates an increased understanding and adherence to university requirements. The IRB administrative office developed a shared document where IRB analysts list third-party vendors with existing contracts. Analysts do not direct study teams to an IT security liaison or procurement services if the vendor has been previously verified. This process ensures compliance with requirements while maintaining efficiency. Additionally, if an IRB analyst reviews a study that proposes the use of a vendor without a university contract, the analyst suggests using a vendor with a contract providing a similar service.

Limitations: This program was implemented at a large institution with existing infrastructure. IT security liaisons and procurement services existed prior to the program. Smaller institutions may not have existing support services. Also, since the IRB does not hold approval after directing study teams to security liaisons or procurement services, there is the potential that study teams do not follow through and the IRB may not be aware until a modification or continuing review is submitted.

Discussion:  This program is important because it makes researchers aware of non-IRB policies related to third-party vendors. Some researchers are unaware of these additional requirements, and have told IRB analysts that prior to being made aware of additional requirements, they assumed that they could use any vendor they deemed appropriate. The evaluation of IT vendors that connect to systems within the institution is of specific importance. Adherence to institutional policies minimizes the potential for data breaches that may be reportable as unanticipated problems.