HIPAA Compliant Surveys With Qualtrics

Overview

Qualtrics is a HITRUST certified platform for securely capturing sensitive or restricted information from survey participants; however, surveys must have some options configured to facilitate security.

How do I use this technology?

1. Login to UAA Qualtrics.
2. Open, or create, the desired survey.
3. Click Survey options.
4. Click General.
   1. Leave the Survey description blank unless there is a specific reason it needs to be set.
5. Click Responses, and ensure the following settings:
   • Survey availability (optional)
     Enabling this will set a date beyond which the survey will be inaccessible. There may be practical reasons for leaving a survey up and running; however, if the survey are going to offered on a somewhat frequent basis, it might be a better idea to create a survey template, then use the template to create the specific surveys with a defined start and end date.
6. Click Security, and ensure the following settings:
   • Survey access
     Available to anyone vs. Invitation only - this option determines whether you can generate an anonymous link to send to anyone, or if you must invite specific people to take the survey. Consider your usage when selecting one of these options. With open access, users can take the survey relatively anonymously but anyone can access it. With invitation only, users will not be anonymous, but the survey will not be open to the public. Consider this option if the survey questions themselves have sensitive information in them, or if the questions need to be kept confidential for some other reason.
   • Password protection (optional)
     Protects access to the survey with a password. The password must be sent separately to potential participants.
   • Prevent indexing (on by default)
     This option prevents search engines from discovering your survey page
   • Uploaded files access
     Only users with permission to view responses (default for new surveys) vs. Anyone with the links to the file. This option controls who has access to files uploaded by respondents. Ensure this setting is set to Only users with permission to view responses.
7. Click Post-Survey.
   1. Under Manage email triggers click Edit triggers.
   2. Notice that the Send An Email On Survey Complete is checked, and cannot be unchecked. Towards the bottom of the window there is a checkbox that says Include Response Report.
   3. Edit the Message field with a short message. If the message field is left blank, an email will not be sent.
   4. Uncheck (i.e. disable) Include Response Report. This ensures when Qualtrics sends an email to whoever the survey creator designates, it does so without potentially Sensitive or Restricted survey responses.
   5. Click Save Triggers.
   Tip

   If you don't want, or need, an email at all do the following after saving the trigger.

   1. Click Edit Triggers.
   2. A Triggers dialog will open showing all active email triggers for the survey. Similar to the following.
      
   3. Click the Delete button to the right of the trigger.
   4. Click Save Triggers.
   Important

   Removing email results links or deleting triggers is incredibly important to the security of sensitive or restricted information; however, if the survey does not involve such information the survey creator can use email triggers if desired.

Once the survey has been built, and the above settings configured, the survey can be Published, and distributed as desired.

Is there any additional information I should know about?

Qualtrics Security and Compliance provides information regarding their various security certifications, with further information covering HIPAA and HITECH on their Securing your Data with HITRUST page.

Need additional help or have issues

For support, requests may be submitted anytime using the appropriate Surveys & Online Forms form. Requests generate a Ticket which will be worked in order received and urgency by IT Employees with the knowledge and permissions to assist with the request.

For immediate assistance please review the Contact Us page for the appropriate support group.