How to conduct user research in a highly constrained environment with private/protected data?

Question

I work in health care and am trying to establish some practices and protocols for conducting user research on physicians. However, the health care industry has some constraints that make user research a little more of a challenge:

• The protected nature of health information makes direct observation of physicians at work difficult or impossible.
• The physician workload means its very difficult for them to commit to a task analysis session with us (these would have to be held away from the physician office, which increases their time commitment).

The standard techniques practiced by my colleagues are interviews and surveys, but I am loathe to rely exclusively on these due to the well known gap between the ways people think and the ways they act.

What are some additional techniques I can employ that (a) require low effort on the part of the participant and (b) do not compromise sensitive information?

Answer 1

I did my PhD on how sensitive information is managed in healthcare and in childcares, so this is a very important question.

1. If you are at a University, you must get this passed by your IRB. If anything goes wrong or if information somehow is leaked, then your university is the one who is held liable. If you work for an organization, I also suggest getting your protocol, forms, and a document where you write up your research methods and information storage practices reviewed and approved. This should not be taken likely.

2. Anonymize all data, to the best of your abilities. Never write down a user's name. I kept a running log of participant IDs on any and all stored data.

3. Shred any paper documents after anonymizing them.

4. Store all electronic data on an external hard drive that can be locked in a filing cabinet when it is not in use.

5. I did observations, for many of the reasons that you and other list - it is just more ecologically valid. But this meant I sat there and wrote notes, which made people feel anxious. I suggest encouraging your participants to examine your notes if they feel comfortable doing so. Having your boss/manager/advisor provide her/his contact information so that they also can feel that if you behave poorly (not that you would) that there is a level of recourse.

6. Try to limit the number of things they sign. I highly recommend a privacy statement, but also writing up how you are managing the data so that they sign that they know how it will be used. How you are planning on using the findings should also be in there along with compensation (if any). Only have one document. Review it verbally before showing them any paper.

I'm sure there are more, but in the end, take on the message of the healthcare industry to "do no harm."

Answer 2

(a) require low effort on the part of the participant

I would use observation, since its a very reliable method and has very low impact on the users. You don't have to interfer in their work, just observe and take notes. If you feel you need to ask a user being observed what she did - go ahead if the timing feels right, if not - wait until a less intensive moment. I would also advice you not to use video recording or tape recording because of the sensitive nature of the observed users work.

(b) do not compromise sensitive information

Probably you would have to sign a Non-disclosure agreement (NDA) to be able to observe the users. "It is also possible for an employee to sign an NDA or NDA-like agreement with an employer. In fact, some employment agreements will include a clause restricting employees' use and dissemination of company-owned "confidential information.""