17 - Third-Party Vendor Policy Awareness Program

Background:  The IRB often receives submissions involving third-party vendors. Activities performed by vendors often do not engage them in human subjects research because they are commercial services like software development, transcription, lab analyses, and document translation. A program was developed to assist researchers with following non-IRB vendor policies sometimes overlooked.

Program

Description:  The IRB administrative office implemented a program to connect researchers with institutional units that oversee use of third-party services. Researchers proposing use of vendors for information technology (IT) services are directed to contact an IT security liaison. The security liaison assists in ensuring there is an existing contract with the institution and verifies that IT security standards are met. Researchers using non-IT vendors are directed to contact the institution’s procurement services. Procurement services are able to verify whether a contract with the vendor is in place or, if no contract is in place, provide guidance on entering a contract with the vendor. IRB analysts have generated a list of known vendors that have been cleared by either the IT security liaisons or procurement services. Since implementation, the program has significantly reduced the number of instances where study teams used vendors without verifying that non-IRB policies were met, demonstrating its effectiveness.

Program

Assessment:  The program was successful in connecting researchers to units that oversee the use of third-party services. Since implementation, several adjustments were made to improve program efficiency. The IRB administrative office developed a shared document where IRB analysts list third-party vendors with existing contracts. Analysts no longer direct study teams to other units if the vendor has already been verified by either the IT security liaison or procurement services. Additionally, if an analyst reviews a study where the study proposes the use of vendors without contracts, the analyst suggests using a vendor with a contract providing a similar service. An additional issue was that directing researchers to other units to adhere to non-IRB policies has the potential to lead to scope creep. To mitigate this, the IRB does not hold approval, but posts correspondence within the electronic system with recommendations to reach out to a security liaison or procurement services.

Limitations: This program was implemented at a large institution with existing infrastructure. IT security liaisons and procurement services existed prior to the program. Smaller institutions may not have existing support services. Also, since the IRB does not hold approval after directing study teams to security liaisons or procurement services, there is the potential that study teams do not follow through and the IRB may not be aware until a modification or continuing review is submitted.

Discussion:  This program is important because it makes researchers aware of non-IRB policies related to third-party vendors. Some researchers are unaware of these additional requirements, especially early career researchers, such as students and post-doctoral fellows. Some researchers have also told IRB analysts that prior to being made aware of additional requirements, they assumed that they could use any vendor they deemed appropriate. The evaluation of IT vendors that connect to systems within the institution is of specific importance. Adherence to institutional policies minimizes the potential for data breaches that may be reportable as unanticipated problems.