Technology Use in Research

When planning your research project, it’s important to consider any third-party access to the research data, including de-identified data. Start by reviewing the UofL Privacy Office's Guide for Privacy/Data Security Issues for Research. 

The University of Louisville requires all technologies to be approved through the Information Security Office, University Privacy Office, and the Institutional Review Board before any activities with participants or their information (both identified and deidentifed) take place. Research teams, at this time, may not enter ANY research data into public use platforms (i.e., ChatGPT, Claude, xAI, etc.) without prior institutional review and approval.  

University of Louisville has specific policies in place related to data access, vendor vetting, and contract requirements. It’s important to be familiar with these requirements and ensure research studies adhere to University policy when planning and developing your research protocol. Consult with the University Privacy Office and Information Security Office for information about these specific policies prior to submitting to the IRB.  

When preparing your research protocol, you will need to define the research intent of the technology being used. This will assist in determining if FDA requirements apply to the research project.

It’s also important to consider the minimum data necessary to be able to answer the research question. One of the biggest challenges of using new technologies in research is navigating data privacy risks. The protocol will need to outline:

• The data that will be collected/stored/shared by the technology.
• Whether direct identifiers will be put in the technology.
• The safest way to move the data from the technology to the research database.
• Who will have access to the data (note any third-party access will fall under institutional requirements outlined in the section above).

It’s important to think about the minimum amount of data necessary to be able to answer the research question. Additionally, the more safeguards that can be put into place related to data collection, the better.

Limiting the amount of information that enters the technology can help in navigating data privacy risks. Consider the project and determine whether the technology will have access to a participants identifying information. Is it possible for the data collected to be coded back to the participant with a separate link the study team keeps? Is it possible that the data is not linked to an individual participant at all? 

Additional planning support is available for research involving wearable devices. To connect with UofL resources for this category of research, contact the UofL Custom Wireless and Electronics Laboratory. Researchers should also complete the Wearable Device Research Planning Form. Submitting this form early helps navigate the research process from ideation through IRB approval. By identifying institutional pathways, it minimizes procurement delays and offers design guidance for both commercial-grade and custom-engineered solutions.

Clearly outlining the research intent is key in determining FDA requirements that may apply to a research study. FDA requirements come into consideration when the research tests the safety and/or effectiveness of a technology’s ability to cure, treat, diagnose, prevent or mitigate a disease. 

For studies involving software, under FDA regulations (21 CFR Part 812), software evaluated in clinical research may qualify as a medical device if its intended use includes the diagnosis, cure, mitigation, treatment, or prevention of disease, or is intended to affect the structure/function of the body. Investigators proposing the use of investigator-developed, modified, or unapproved software for clinical purposes in human subjects research must provide the IRB with sufficient documentation to make a device risk determination. Review the FDA Software as a Medical Device website for more information.

The FDA has established an interactive decision tool help in determining whether a product's software functions are potentially the focus of the FDA's oversight.  This tool is designed to walk through each step to determine where a research project falls within the FDA requirements. Additionally the FDA has resources and information available for researches on the FDA Device Advice page. 

Additional resources for investigators navigating FDA device requirements for research can also be found on the Regardd website. This website was developed by several academic institutions to provide researchers with tools and resources needed to navigate investigator initiated projects involving FDA requirements.