Roles and Scope

Roles may vary by relationship. A client, partner, researcher, covered entity, sponsor, archive contributor, or data owner may have different obligations depending on the project.

Processing may include hosting, support, implementation, diagnostics, archival workflows, file handling, data import/export, backups, reports, security review, and operational service records.

Specific subprocessors, transfer mechanisms, audit rights, retention schedules, security exhibits, and deletion/export commitments should be documented in the applicable written agreement.