Sequestration and Retention of Records – Standard Operating Procedures

ERIK, Office of Research Compliance, Revised 12/07/2020

I. Regulatory and Policy Authority and Requirement

The PHS Policies on Research Misconduct (42 C.F.R. Part 93) require an institution to identify, sequester, and protect evidence pertinent to the review of an allegation of Research Misconduct in a timely manner. The federal regulation 42 C.F.R. §93.305 states:

Responsibility for maintenance and custody of research records and evidence.
An institution, as the responsible legal entity for the PHS supported research, has a continuing obligation under this part to ensure that it maintains adequate records for a research misconduct proceeding. The institution must—

1. Either before or when the institution notifies the Respondent of the allegation, inquiry or investigation, promptly take all reasonable and practical steps to obtain custody of all the research records and evidence needed to conduct the research misconduct proceeding, inventory the records and evidence, and sequester them in a secure manner, except that where the research records or evidence encompass scientific instruments shared by a number of users, custody may be limited to copies of the data or evidence on such instruments, so long as those copies are substantially equivalent to the evidentiary value of the instruments;
2. Where appropriate, give the Respondent copies of, or reasonable, supervised access to the research records;
3. Undertake all reasonable and practical efforts to take custody of additional research records or evidence that is discovered during the course of a research misconduct proceeding, except that where the research records or evidence encompass scientific instruments shared by a number of users, custody may be limited to copies of the data or evidence on such instruments, so long as those copies are substantially equivalent to the evidentiary value of the instruments; and
4. Maintain the research records and evidence as required by §93.317.

The federal regulation states that for an institutional inquiry, 42 C.F.R. §93.307(3)(b), that on or before the date on which the Respondent is notified or the inquiry begins, whichever is earlier, the institution must promptly take all reasonable and practical steps to obtain custody of all the research records; and for an institutional investigation, 42 C.F.R. §93.310(d), to the extent the institution has not already done so at the allegation or inquiry stages, take all reasonable and practical steps to obtain custody of all the research records including whenever additional items become known or relevant to the investigation.

Under Research Misconduct policy (the "Policy"), Policy Details III.C.1, and Procedures I.B., II.E, and III.B, the Research Integrity Officer (RIO) has the responsibility and authority to sequester any relevant evidence at the earliest opportunity in a research misconduct proceeding; the RIO shall take immediate action to sequester all data or other materials relevant to the complaint, on or before the date on which the Respondent(s) is notified of the allegation(s), and shall obtain custody of, and sequester in a secure manner, all research records that have become known and are relevant to the investigation.

Under the Policy, Research Record is defined as:

Any data or results, in any media or format, which embodies the information resulting from research. A research record includes, but is not limited to, grant or contract applications, whether funded or unfunded; grant or contract progress and other reports; laboratory notebooks; notes; correspondence; videos; photographs; X-ray film; slides; biological materials; computer files and printouts; manuscripts and publications; equipment use logs; laboratory procurement records; animal facility records; human and animal subject protocols; medical charts; patient research files; computer code; musical scores; musical composition; choreography; etc.

Basic assumptions and core principles when preparing for sequestration of research records are:

• In the absence of information identifying the specific Respondent(s), the corresponding author of any questioned manuscript or publication is considered the putative Respondent. The first author is also typically considered a putative Respondent.
• For grant proposals, the PI, as defined on the ePA-005 and/or designated in the grant proposal is considered the putative Respondent.
• A primary goal in the meeting to notify a putative Respondent(s) about the allegation(s) is to determine the responsibility of the Respondent(s) for each specific allegation.
• Sequestration should encompass all email, electronic and physical records relevant to allegation(s).
• The practice of the Office of Research Compliance (ORC) is that when there is doubt, sequester broadly. Any sequestered data that is subsequently determined to be unrelated to the allegation(s) may be returned to the Respondent(s).
• Should new allegations or identification of Respondents necessitate the sequestration of additional materials, email accounts, etc., steps will be taken to do so as soon as possible according the procedures in this SOP.

II. Sequestration

Email sequestration

Sequestration of email is handled separately from sequestration of other types of electronic research records. University E-Mail Services and/or Medical Center Information Technology (IT) control email services and the contents of the sequestered email account(s) are transferred to ORC, under specific conditions listed below.

Prior to Respondent's notification of allegations:

• When a Respondent(s) is identified, the RIO will send a notification email to the Senior Associate General Counsel, Office of Legal Affairs, and the Assistant Vice President for Compliance Operations and Investigations, OUCI. The email will state that the university received an allegation of possible research misconduct and will request that a litigation hold be put on one or more email accounts for each Respondent. The request will state that the hold be done without notification to the Respondent.
• In the absence of specific information naming a Respondent, litigation holds will be placed as broadly as needed (e.g., all University authors listed on a questioned manuscript or publication). The litigation holds are done in the background and have no impact on the individuals. When specific Respondents are identified, unnecessary holds can be lifted.

Subsequent to the Respondent's notification of allegations:

• If during an Inquiry or an Investigation a need arises for specific emails, the RIO will make the request through the Office of Legal Affairs/OUCI for the specific email that the Committee requires, usually by time frame, and will provide potential search terms and a justification for what is being requested. Searches will be approved by Legal Affairs/OUCI and will be conducted by University Email Services/Medical Center IT.
• If emails contain protected health information (PHI) or other HIPAA protected information they will be screened for PHI by the Medical Center Privacy officer prior to release to the committee.

Electronic file sequestration (non-email based)

Prior to Respondent's notification of allegation(s):

• Based on the allegation(s), the RIO and ORC staff will assess the specific electronic data to sequester, the likely format of the data, and how it will be stored.
• The RIO and ORC staff will contact the local college or department IT to determine how many and what types of computer systems, file servers, networked laboratory machines, etc., the Respondent(s) uses.
• The RIO and ORC staff, in conjunction with local IT, will:
  • determine what electronic files can be forensically imaged in the background prior to notifying the Respondent(s) of the allegation(s);
  • establish and initiate a plan to capture all available electronic images prior to Respondent's notification – if it can be done silently in the background;
  • determine if any cloud-based services may hold relevant data and whether it is possible to access relevant files (university hosted verses external vendor).
• The Office of Research Information Systems (ORIS) will assist in the process of obtaining electronic data for offices that do not have expertise in forensic imaging.

Coincident with or immediately after Respondent's notification of allegations:

• As appropriate, the RIO will arrange for local IT and ORIS to assist with electronic records capture subsequent to meeting with the Respondent.
• The local IT and ORIS will do the following:
  • Make forensic images of any computer system that could not be remotely imaged before meeting with the Respondent. This may include laptops, stand-alone analytical machines, or other systems not connected to the network;
  • Pull hard drives for imaging – note location, machine #, serial number, equipment tag #, take a photo of system in situ;
  • When necessary, sequester entire system (e.g., laptops, Macs) – note location, machine #, serial number, equipment tag #;
  • Have IT support capture data from lab machines where drives cannot be removed (e.g., those running lab instruments);
  • Determine encryption status on all systems, may need users to provide decryption keys.
• Forensic images should be taken using Encase or equivalent programs. If forensic copies cannot be made by the local IT, the hard drive will be removed and a forensic copy will be made by ORIS.
• For personally owned computer systems containing university data:
  • Those owned by students need a consent form signed for imaging their personal computer (see Consent to Image or Access Research Records).
  • For those owned by Faculty no consent form is needed prior to imaging.
• For sequestration of research records for students, the RIO must obtain a signed a FERPA release form and/or the student must allow the records to be sequestered.
• ORIS will make a cloned image of each hard drive image in addition to Forensic Image for use by RIO/Committee during inquiry/investigation.
  • Evidence/Chain of Custody tags attached to the cloned image drives are signed and dated to document the sequence of custody following the initial generation of cloned images.
  • As needed, a Custody Form is may be completed when the use of the cloned image is required (see Custody /Data Transfer Form).

Physical file/materials sequestration

Prior to Respondent's notification of allegations:

• The RIO(s) will determine what physical evidence needs to be sequestered and any special storage requirements that might be needed (e.g., freezer, refrigerator, protected from light, biohazardous, radioactive, strong odor).
• Identify and acquire appropriate secure storage based on any special needs.
• Determine the different locations where evidence may be found (e.g., office spaces, lab spaces, core facilities). If multiple sites are involved, plan for parallel or sequential sequestration processes and coordinate with the College for assistance.
• If possible, try to arrange sequestration during a time that minimizes the presence of extraneous people.

Coincident with or immediately following Respondent's notification of allegations:

• The RIO(s) will go with Respondent directly to all locations identified as having physical evidence. There should be at least two people present during all phases of sequestration and copying of evidence (ORC, IT, other administrative personnel)
• The Respondent will be asked to identify all physical evidence (lab notebooks, documents, any kind of physical record, slides, x-ray films, blots, etc.) related to the allegations.
• Good practices for the RIO(s) identifying and collecting physical files are, if possible, to:
  • take a picture of the materials in situ;
  • log what the item is with brief description;
  • log where the item was located (e.g., lab room #, bay #, desk of X, top shelf);
  • try to keep materials for each Respondent or possible witnesses separate from each other.
• If a general sequestration sheet is generated while the RIO(s) is with the Respondent, the Respondent signs the sheet. Once initial sequestration is complete, the RIO creates a detailed data sequestration log (see Data Sequestration Sheet) listing all the materials sequestered; this is usually performed in ORC offices. The RIO sends an email with a copy of the catalogued Data Sequestration log to the Respondent(s) as a receipt of their records.
• Items/Equipment needed to support sequestration activities:
  • Chain of custody forms
  • Hard drives/Thumb drives
  • Boxes
  • Evidence bags
  • Digital camera
  • Audio recorder
  • Anti-static bags for electronics
  • Notebook for logging intake
• ORC will make high quality copies of any materials required by the Respondent to continue their work. Copies are usually provided within 24 hours but large requests require more time.

III. Retention

Physical file/materials retention

• Immediately upon sequestration and for the duration of a case, physical materials will be retained in a double-locked, limited-access fashion at the Research Administration Building, 1960 Kenny Road, Columbus, Ohio.
• Contents of the sequestered material will be documented by ORC staff on the ORC Records Inventory Spreadsheet.
• Any and all entry into the secured storage location will be tracked via the Sequestered Data Access Log located within the storage unit. Specific information to be recorded includes:
  • Date In/Out
  • Time In/Out
  • Name
  • Signature
  • Reason for entry/Case name
  • Whether or not evidence was removed. If yes, identify and complete (see Custody /Data Transfer Form).

Access to sequestered materials

• Access to sequestered materials may be provided to the investigative bodies looking into the complaint and to any other person who has a legitimate reason related to the university process to require access (e.g. Legal Affairs).
  • Removal of materials from local, secured ORC storage will be documented by ORC staff on the Sequestered Data Access Log.
  • Materials may be signed in/out of ORC secured storage (see Custody/Data Transfer Form) and will be returned immediately upon request or at a predetermined date.
  • Materials that have been signed out must remain in a locked secure location when not in use by the person who signed them out.
• Supervised access to any physical, sequestered material shall be provided to the Respondent(s), and to any other person who requires access, as determined by the RIO to have a legitimate reason related to the university process (ex., the Complainant).
  • Requests for data review must be submitted with appropriate notice to ORC. Date and time of data review are to be coordinated between and mutually agreeable to ORC and requesting party.
  • Removal of materials from local, secured ORC storage will be documented by ORC staff on the Sequestered Data Access Log.
  • An ORC staff member must be present with the sequestered materials at all times during the supervised review.
  • As required, ORC will make high quality copies of any materials for the Respondent. Copies are usually provided within 24 hours but large requests require more time.

Long-term storage

• Once a case has closed, physical materials will be transferred to long-term storage (currently located at 2650 Kenny Road) per the Office of Research Records Retention and Disposition Schedule.
• Transfer to long-term storage will be documented by ORC staff on the ORC Records Inventory spreadsheet. A File Storage Index Form will be completed with one physical copy accompanying each box sent to long-term storage and an electronic copy filed with ORC.

Article ID: 115
Created: August 28, 2025
Last Updated: September 10, 2025

Online URL: https://ohiostateresearch.knowledgebase.co/article/sequestration-and-retention-of-records-standard-operating-procedures-115.html