Harvard Human Subjects Payments Policy

1. Harvard Human Subjects Payments Policy Effective 1/1/11

2. Introduction Harvard must satisfy certain IRS reporting obligations when making compensation payments to human subjects. This presentation outlines the basic concepts of the revised Human Subject Payment policy, provides a walk-through of the more common payment scenarios, and provides an overview of how to properly handle high risk confidential information (HRCI). Presentation Disclosure: The purpose of this presentation is to illustrate some of the general concepts of the Human Subjects Payment Policy. Individuals involved in the payments of human subjects should refer the policy rather than this presentation when making decisions on their local/internal payment practices. 1 2 Policy Requirements Maintaining Confidentiality

3. 1 Policy Requirements Policy Highlights • Individual payments of $100 or less can be made by cash or cash equivalent. • No need to collect Social Security Numbers/ Individual Taxpayer Identification Numbers or track payments (No HRCI needed) • Also for individual payments of $100 or less, policy allows for same treatment for all participants • Payments over $100 must be made by check • Requires additional questions about tax status of subject and location of study • Requires collection of HRCI

4. Caveats 1 Policy Requirements Note: A PI/Researcher should be aware that carrying/distributing large sums of cash carries potential risks. • If you reasonably expect a subject to receive $600 or more during a calendar year, the subject must be paid by check • In the rare circumstance where a study’s research integrity hinges on making an individual payment over $100 by cash or cash equivalent, an exception process is available with prior Financial Dean approval (see full policy for guidelines) • Departments must then collect subject’s name, address, SSN and track payments, and forward the information of those who receive over $600 in a calendar year to University Financial Services at the end of that calendar year.

5. 1

6. 1 Policy Requirements Scenario A - Data Collection $100 or Less Paid to Individual Required Data How do you want to pay your subject? Required High Risk Confidential Data Pay by check Pay by: * Cash * Bank Gift Card * Other Gift Card/certificate * In-kind items (books, DVDs, etc) Collect: * Full legal name * SSN/TIN (or HUID) * Permanent address * Mailing address (if different) * FNIF (if Foreign National) Complete Subject Payment Form -- Section II only Collect: Full legal name only Complete Subject Payment Form -- Section I only

7. 1 Policy Requirements Scenario B – Data Collection Over $100 Paid to U.S. Citizen, Permanent Resident, or Resident Alien Required Data For US citizens, permanent residents or resident aliens: Required High Risk Confidential Data Must pay by check Collect: * Full legal name * SSN/TIN (or HUID) * Permanent address * Mailing address (if different) Complete Subject Payment Form -- Section II only

8. 1 Policy Requirements Scenario C – Data Collection Foreign National Paid Over $100 in Study Conducted in U.S. Study inside US: Required Data High Risk Confidential Data Must pay by check Collect: * Full legal name * SSN/TIN (or HUID) * Permanent address * Mailing address (if different) *FNIF Complete Subject Payment Form -- Section II only

9. 1 Policy Requirements Scenario D - Data Collection Foreign National Paid Over $100 Outside the U.S. Required Data How do you want to pay your subject? Required High Risk Confidential Data Pay by check Pay by: * Cash * Bank Gift Card * Other Gift Card/certificate * In-kind items (books, DVDs, etc) Collect: * Full legal name * SSN/TIN (or HUID) * Permanent address * Mailing address (if different) *FNIF Complete Subject Payment Form -- Section II only Collect: * Full legal name * Location statement Complete Subject Payment Form -- Section III only

10. 1 Policy Requirements Note on Studies Conducted Outside the U.S. Foreign Tax Obligations A PI/Researcher conducting a study abroad must be aware of, and fulfill any tax obligations of the country in which the study is being conducted. Please contact Tax Reporting in the Office of the Controller with questions. Location Statement is Required when Paying Foreign Nationals Outside the U.S. The PI/Researcher should collect a Location Statement for each foreign national who participated in the study. Sample Location Statement "I participated in the ______ study during the period __________ to _______ while located in the following country __________________." Subject must sign and print name, and include date.

11. 2 Maintaining Confidentiality University's Enterprise Security Policy Departments Must Adhere to Security Guidelines • The Human Subject Payment Policy requires collection of High Risk Confidential Information (HRCI) in certain situations. • It is the responsibility of the department that is conducting the study and its financial office to maintain and secure all HRCI related to subject payments. • The collection and retention of this data must be performed in accordance with the University's Enterprise Security Policy, maintained by University Information Systems . • Any compensation records maintained by a department that contain confidential information must be maintained in a locked location or in a database on a secure server. PIs/Researchers or designees must divulge a subject’s compensation history and/or confidential information only to employees with a valid business need and authorization to view confidential information. • For the most current information, please see the full policy at: http://www.security.harvard.edu/enterprise-security-policy

12. 2 Maintaining Confidentiality Data Collection Requirements High Risk Confidential Information (HRCI) What is High Risk Confidential Information (HRCI)? HRCI data includes information related to the individual that includes their name in conjunction with SSN/TIN. For a full explanation of HRCI data, please see: http://security.harvard.edu/enterprise-security-policy/1-high-risk-info This information is needed when creating a check payment and/or when an individual is expected to receive over $600 in a calendar year (e.g., Harvard must issue a Form 1099 to the participant). Example: Study participants receive a $300.00 check. Full Legal Name SSN / TIN Permanent Address Mailing Address Note: as of 11/23/10

13. 2 Maintaining Confidentiality Data Collection Requirements The information that must be collected from the participants falls into two buckets: Required for cash or cash equivalents =<$100 Required for all check payments Full Legal Name SSN / TIN Permanent Address Mailing Address Full Legal Name of Participant High Risk Confidential Information (HRCI)

14. 2 Maintaining Confidentiality Cash Payments Equal to or Less Than $100 To Recap: Cash =< $100 does not require collection of HRCI Cash or cash equivalents* can only be used when payment amount is equal to or less than $100. If paying => $100 in: You must collect: cash *gift card Full Legal Name *tangible personal property *bank gift card

15. 2 Maintaining Confidentiality Payment by Check To Recap: Any Payment by Check Requires collection of HRCI In order for Harvard to create a check payment, the PI’s/Researcher’s local finance office must setup the participant as a vendor in Oracle, which requires and SSN or TIN. If paying by check... You must collect: • Because the individual payment is >$100; or • Because check is the preferred method of payment Full Legal Name SSN / TIN Permanent Address Mailing Address High Risk Confidential Information (HRCI)

16. 2 Maintaining Confidentiality Methods of Collecting Data • Participants may provide their required information to the PI/Researcher or designee via the following means: • By mail or fax. If confidential information is required, participants must sign mailed or faxed documents. • By e-mail, only if no confidential information is required. • By phone or in person. If confidential information is required, the information given over the phone or in person by a participant must be documented in writing and signed by the PI/Researcher or designee receiving the information. Alternatively, when collecting information in person, the participant must sign the document(s) showing the required information. • Online studies only: By completing an online form that contains the required information. Such online forms can be used only if the online site and server are secure.

17. 2 Maintaining Confidentiality Processing Payments Prompt and Secure Transfer of HRCI When a PI/Researcher collects the required HRCI, they must arrange for prompt, secure transfer of this information to their local finance department. • Non-electronic records containing HRCI must be kept in locked file cabinets or other locked container (e.g., a safe) except when in use. • Electronic storage of HRCI must be encrypted. Local Finance Offices Must Retain HRCI and NOT Forward it to University Financial Services When submitting Web Voucher requests, preparers must include certain information. • For non-confidential studies: include the "who, what, when, where, and why" in the business purpose field. • For confidential studies, the payment request should not include the purpose of the study. Instead, write "Confidential study; the department is securely maintaining confidential study data.” in the business purpose field. All reimbursement requests that are for $75 or more or payment requests of any amount must include a receipt as part of the Web Voucher request. Note: all data collection must be done prior to release of payment

18. Thank You! For more information regarding this policy... • Contact your local tub finance offices • Office of the Controller, Main Line: • 617-495-4532 • University Financial Services Office, Customer Service Line: • 617-495-8500 • University Technology Security Officer, Contact Page: • http://www.security.harvard.edu/contact • Cash Management Office: • http://able.harvard.edu/cash/cash_index.shtml