SAMPLE LANGUAGE FOR IRB SUBMISSIONS

The suggested language below can be adapted for an Institutional Review Board (IRB) submission to describe how your study team will use EnrollNow and how EnrollNow protects participant information.

Before submitting, review the content to ensure it aligns with your organization’s requirements, approved study procedures, and IRB guidelines.

Sample Language for Your IRB Submission

Participant personal information will be stored in EnrollNow, a HIPAA-compliant, SOC 2-certified web-based research operations platform used by study teams to manage participant workflows. The platform supports study-related activities such as participant pre-screening, scheduling, communications, and status tracking throughout the study lifecycle. Originally developed at the University of Michigan to centralize study coordination activities, EnrollNow maintains structured records of participant interactions and study coordination activities and is used by research teams internationally. EnrollNow is not an electronic data capture (EDC) system and will be used solely for participant and study management purposes. Personally identifiable information will be maintained separately from research data collected for study analysis, with EnrollNow serving only to support the operations and administrative aspects of participant participation.

Participant data managed and maintained in EnrollNow is private and secure. Information is retained in a fully encrypted format within dedicated databases segregated from other EnrollNow accounts, ensuring that only authorized staff can access participant and study data. EnrollNow’s infrastructure is designed to align with applicable HIPAA privacy and security requirements. Security and reliability measures include 2048-bit data encryption in transit and at rest, automatic user logoff, audit logging, cross-region replicated daily backups, tightly controlled firewalls, role-based access controls, and other enterprise-grade administrative safeguards. Together, these measures provide multiple layers of protection to help preserve confidentiality, integrity, and availability of participant information throughout the study lifecycle.)

Protecting Participant Information in EnrollNow

EnrollNow is a secure, web-based application designed to help research teams centralize and manage participants’ personally identifiable information. Originally developed at the University of Michigan as Ripple™, the platform provides research teams with a user-friendly interface for managing information such as:

• Participant names and contact information
• Participant or study identification numbers
• Demographic information
• Recruitment and enrollment activity
• Study events, appointments, and workflow information

Data Privacy and Security

Participant information stored in EnrollNow is protected using administrative, technical, and organizational safeguards. Study data is stored in encrypted, dedicated databases that are segregated from other customer accounts. Access is limited to authorized users based on their assigned roles and permissions.

EnrollNow includes security features such as:

• Encryption of data in transit and at rest
• Role-based access permissions
• Automatic session timeouts
• User activity and audit logs
• Regular data backups
• Network and firewall protections
• Password-strength requirements
• Administrative safeguards designed to prevent unauthorized access

EnrollNow’s infrastructure and security controls are designed to support customers’ obligations under the Health Insurance Portability and Accountability Act (HIPAA).

Separating Participant Information from Research Data

EnrollNow is primarily used to manage participant identity, contact, recruitment, and study workflow information. Research teams should follow their organization’s policies and approved study procedures when determining what information may be stored in EnrollNow.

When appropriate, directly identifying participant information should be stored separately from research data, such as clinical records, study outcomes, or questionnaire responses. Maintaining this separation can help reduce the risk of connecting a participant’s identity with their research data.