We recommend that you always use the latest version of your browser.

Implementation and data storage

Data processing

Data processing takes place in accordance with an approved legal basis for processing. The recommendation from the Data Protection Officer will specify how the project should process personal data and how data can be stored securely.
 
Projects often plan and describe data processing in a notification to the Data Protection Officer. The planned data processing is either approved, or a different type of data processing is stipulated as a condition for carrying out the project.
 
In some cases, the Data Protection Officer requests a recommendation from the Information Security Officer.
 
Research projects must be carried out in accordance with the protocol and the participants’ consent. Significant changes to the protocol must be reported to the body that approved the project (usually REK). Changes relating to the storage of personal data must be reported to the Data Protection Officer. The changes must be approved before they can be implemented.
 

Physical storage 

All research data, including questionnaires, data from medical records, consent documents, linkage lists and other data containing personal information, must always be kept in a locked cabinet or drawer in a locked room in one of the hospital’s buildings. The key to the cabinet/drawer must not be kept in the same room unless it is stored in a locked key box. This also applies to data stored on USB flash drives. Data must not be stored at home, including when working from home.

Electronic storage 

On the hospital’s network
  • Secure storage area (“sensitive area”)
    • O:\Sensitivt\Forskning
      • All project registries for research studies must be stored here, regardless of who formally approves the study.
    • O:\Sensitivt\Kvalitet
    • All internal quality registries referred to in Section 26 of the Health Personnel Act and Section 6 of the Patient Records Act must be stored here.
    • MedInsight
      • Can also be used to store code keys and consent forms.

Only de-identified/pseudonymised data may be stored on O:\Sensitivt; that is, datasets/analysis files that have been cleared of personally identifiable data. This data must be replaced with a constructed ID, such as a serial number.

The so-called linkage key, a list linking a constructed ID to directly identifiable personal information, is stored in MedInsight. The Research Section advises against storing linkage key lists in any other way.

If both data and consent forms are stored on O:\Sensitivt, they must be stored in separately ordered folders, for example O:\Sensitivt\Forskning\Prosjekt123456_data and O:\Sensitivt\Forskning\Prosjekt123456_samtykker.

These areas are accessible via the hospital’s network. A VPN must be used to access them from other networks. Access is also possible via a remote desktop, which does not require a VPN. VPN and remote desktop are services that must be ordered fromThe BAT Access Portal(internal link). The remote desktop service is called “Ekstern portal SSHF”.

To order a storage area on O:\Sensitivt, useThe BAT Access Portal(internal link). Search for “RSM ny forskningsmappe”. When ordering, a case number from the recommendation issued by the Data Protection Officer is required.

Access to MedInsight is ordered from the system managerEmile van Gelderen. 

Discontinuing the use of USB flash drives or other types of data storage devices 

The Research Section advises against using USB flash drives/external hard drives. If external drives are used, the data must be encrypted. Please note that these external drives are not backed up. When storing data on the hospital’s network, for example in the sensitive area, robust backup procedures are in place. This also makes it possible to restore earlier versions in the event of data loss.

 Outside the hospital’s network 
  • The Research Portal
  • TSD (Services for Sensitive Data)

Both systems are approved for storing health data. The Research Portal is a solution that gives researchers in our health region access to the IT services they need for their research projects. These include virtual desktops, virtual servers, data storage areas, collaboration areas for project staff, and a file gateway. The solution does not have an integrated form tool, but data from external form tools can be imported.

TSD is a secure project area with an integrated form tool (Nettskjema) for collecting sensitive data. When using TSD, “Attachment to the data processing agreement for projects where the organisation is affiliated with USIT/TSD under an overarching data processing agreement” must be attached to the application. SeeNotification procedure for the Data Protection Officer/Research Section.

Storing consent forms

Paper consent forms can be scanned and stored on O:\Sensitivt or in MedInsight.
If both data and scanned consent forms are stored on O:\Sensitvt, they must be stored in separately ordered folders, e.g. O:\Sensitivt\Forskning\Prosjekt123456_data and O:\Sensitivt\Forskning\Prosjekt123456_samtykker.
 

Obtaining electronic consent

The Research Section encourages obtaining consent electronically wherever possible. Nettskjema/TSD is a tool that can be used for this purpose.
Through this solution, consent is signed electronically using BankID.
It is also possible to link a consent form to a questionnaire.


A DPIA is mandatory when processing personal data is likely to result in a high risk to the rights and freedoms of natural persons (e.g. students, employees, external contacts, research participants).

If all of the following 7 statements can be confirmed, no further DPIA assessment is required

  1. Data is stored in the organisation’s approved storage areas
  2. Data is stored in indirectly identifiable (coded) form, with the code list stored separately
  3. The project is based on consent or an exemption with information provided to the data subject
  4. The project uses only one type of special (sensitive) category of personal data
  5. The project does NOT use genetic data
  6. The project does NOT disclose data to organisations outside the EU/EEA
  7. The project does NOT disclose data to international organisations

If not all 7 statements can be confirmed, or you are unsure about any of the points, you will probably need to carry out a data protection impact assessment for your project.

ContactData Protection Officerat Sørlandet Hospital for further assessment and guidance on implementation.

​
 
If you plan to use a storage location or solution that is not listed on this page, you are encouraged to contact the Information Security Manager at SSHF as early as possible.

See alsoDigital data collectionandChoosing a registry solution - Research Supportfor an up-to-date overview of available and approved systems.

ContactEmile van GelderenorJorid Skuthe Myklebustin the Research Section with questions about storing research data, linkage keys and consent forms.
Last updated 03.02.2026
TEST VERSION
Machine-translated copy of sshf.no for testing only. Not official information.