1. Harvard Human Subjects Payments Policy Effective 1/1/11 1

2. Introduction Harvard must satisfy certain IRS reporting obligations when making compensation payments to human subjects. This presentation outlines the basic concepts of the revised Human Subject Payment policy, provides a walk-through of the more common payment scenarios, and provides an overview of how to properly handle high risk confidential information (HRCI). Presentation Disclosure: The purpose of this presentation is to illustrate some of the general concepts of the Human Subjects Payment Policy. Individuals involved in the payments of human subjects should refer the policy rather than this presentation when making decisions on their local/internal payment practices. 1 Policy Requirements 2 Maintaining Confidentiality 2

3. Policy Highlights Individual payments of $100 or less can be made by cash or cash equivalent. – No need to collect Social Security Numbers/ Individual Taxpayer Identification Numbers or track payments (No HRCI needed) – Also for individual payments of $100 or less, policy allows for same treatment for all participants Payments over $100 must be made by check – Requires additional questions about tax status of subject and location of study – Requires collection of HRCI 1 Policy Requirements 3

4. Caveats If you reasonably expect a subject to receive $600 or more during a calendar year, the subject must be paid by check In the rare circumstance where a study’s research integrity hinges on making an individual payment over $100 by cash or cash equivalent, an exception process is available with prior Financial Dean approval (see full policy for guidelines) – Departments must then collect subject’s name, address, SSN and track payments, and forward the information of those who receive over $600 in a calendar year to University Financial Services at the end of that calendar year. Note: A PI/Researcher should be aware that carrying/distributing large sums of cash carries potential risks. 1 Policy Requirements 4

5. 1 5

6. Scenario A - Data Collection Pay by: * Cash * Bank Gift Card * Other Gift Card/certificate * In-kind items (books, DVDs, etc) Collect: Full legal name only Complete Subject Payment Form -- Section I only Pay by check Collect: * Full legal name * SSN/TIN (or HUID) * Permanent address * Mailing address (if different) * FNIF (if Foreign National) Complete Subject Payment Form -- Section II only How do you want to pay your subject? Required Data Required High Risk Confidential Data $100 or Less Paid to Individual 1 Policy Requirements 6

7. Required Data Required High Risk Confidential Data Scenario B – Data Collection For US citizens, permanent residents or resident aliens: Must pay by check Collect: * Full legal name * SSN/TIN (or HUID) * Permanent address * Mailing address (if different) Complete Subject Payment Form -- Section II only Over $100 Paid to U.S. Citizen, Permanent Resident, or Resident Alien 1 Policy Requirements 7

8. Scenario C – Data Collection Required Data High Risk Confidential Data Study inside US: Must pay by check Collect: * Full legal name * SSN/TIN (or HUID) * Permanent address * Mailing address (if different) *FNIF Complete Subject Payment Form -- Section II only Foreign National Paid Over $100 in Study Conducted in U.S. 1 Policy Requirements 8

9. Scenario D - Data Collection Foreign National Paid Over $100 Outside the U.S. Pay by: * Cash * Bank Gift Card * Other Gift Card/certificate * In-kind items (books, DVDs, etc) Collect: * Full legal name * Location statement Complete Subject Payment Form -- Section III only Pay by check Collect: * Full legal name * SSN/TIN (or HUID) * Permanent address * Mailing address (if different) *FNIF Complete Subject Payment Form -- Section II only How do you want to pay your subject? Required Data 1 Policy Requirements 9 Required High Risk Confidential Data

10. Note on Studies Conducted Outside the U.S. Foreign Tax Obligations A PI/Researcher conducting a study abroad must be aware of, and fulfill any tax obligations of the country in which the study is being conducted. Please contact Tax Reporting in the Office of the Controller with questions. Location Statement is Required when Paying Foreign Nationals Outside the U.S. The PI/Researcher should collect a Location Statement for each foreign national who participated in the study. 1 Policy Requirements Sample Location Statement "I participated in the ______ study during the period __________ to _______ while located in the following country __________________." Subject must sign and print name, and include date. 10

11. University's Enterprise Security Policy Departments Must Adhere to Security Guidelines The Human Subject Payment Policy requires collection of High Risk Confidential Information (HRCI) in certain situations. It is the responsibility of the department that is conducting the study and its financial office to maintain and secure all HRCI related to subject payments. The collection and retention of this data must be performed in accordance with the University's Enterprise Security Policy, maintained by University Information Systems. Any compensation records maintained by a department that contain confidential information must be maintained in a locked location or in a database on a secure server. PIs/Researchers or designees must divulge a subject’s compensation history and/or confidential information only to employees with a valid business need and authorization to view confidential information. For the most current information, please see the full policy at: http://www.security.harvard.edu/enterprise-security-policy 2 Maintaining Confidentiality 11

12. Data Collection Requirements What is High Risk Confidential Information (HRCI)? Full Legal Name SSN / TIN Permanent Address Mailing Address HRCI data includes information related to the individual that includes their name in conjunction with SSN/TIN. For a full explanation of HRCI data, please see: http://security.harvard.edu/enterprise-security- policy/1-high-risk-infohttp://security.harvard.edu/enterprise-security- policy/1-high-risk-info This information is needed when creating a check payment and/or when an individual is expected to receive over $600 in a calendar year (e.g., Harvard must issue a Form 1099 to the participant). Example: Study participants receive a $300.00 check. Example: Study participants receive a $300.00 check. 2 Maintaining Confidentiality 12 Note: as of 11/23/10

13. Data Collection Requirements The information that must be collected from the participants falls into two buckets: Full Legal Name of Participant Full Legal Name SSN / TIN Permanent Address Mailing Address Required for cash or cash equivalents =<$100Required for all check payments 2 Maintaining Confidentiality 13

14. Cash Payments Equal to or Less Than $100 To Recap: Cash =< $100 does not require collection of HRCI Cash or cash equivalents* can only be used when payment amount is equal to or less than $100. cash *gift card *tangible personal property *bank gift card Full Legal Name 2 Maintaining Confidentiality 14 If paying => $100 in:You must collect:

15. Payment by Check To Recap: Any Payment by Check Requires collection of HRCI In order for Harvard to create a check payment, the PI’s/Researcher’s local finance office must setup the participant as a vendor in Oracle, which requires and SSN or TIN. Full Legal Name SSN / TIN Permanent Address Mailing Address 2 Maintaining Confidentiality 15 If paying by check... Because the individual payment is >$100; or Because check is the preferred method of payment You must collect:

16. Methods of Collecting Data Participants may provide their required information to the PI/Researcher or designee via the following means: By mail or fax. If confidential information is required, participants must sign mailed or faxed documents. By e-mail, only if no confidential information is required. By phone or in person. If confidential information is required, the information given over the phone or in person by a participant must be documented in writing and signed by the PI/Researcher or designee receiving the information. Alternatively, when collecting information in person, the participant must sign the document(s) showing the required information. Online studies only: By completing an online form that contains the required information. Such online forms can be used only if the online site and server are secure. 2 Maintaining Confidentiality 16

17. Processing Payments Prompt and Secure Transfer of HRCI When a PI/Researcher collects the required HRCI, they must arrange for prompt, secure transfer of this information to their local finance department. Non-electronic records containing HRCI must be kept in locked file cabinets or other locked container (e.g., a safe) except when in use. Electronic storage of HRCI must be encrypted. Local Finance Offices Must Retain HRCI and NOT Forward it to University Financial Services When submitting Web Voucher requests, preparers must include certain information. For non-confidential studies: include the "who, what, when, where, and why" in the business purpose field. For confidential studies, the payment request should not include the purpose of the study. Instead, write "Confidential study; the department is securely maintaining confidential study data.” in the business purpose field. All reimbursement requests that are for $75 or more or payment requests of any amount must include a receipt as part of the Web Voucher request. 2 Maintaining Confidentiality Note: all data collection must be done prior to release of payment 17

18. Thank You! For more information regarding this policy... Contact your local tub finance offices Office of the Controller, Main Line: – 617-495-4532 University Financial Services Office, Customer Service Line: – 617-495-8500 University Technology Security Officer, Contact Page: – http://www.security.harvard.edu/contact Cash Management Office: – http://able.harvard.edu/cash/cash_index.shtml 18