Over a period of 6 months the first author contacted stakeholders in 15 clinical trials known to him to determine whether they were interested in participating in this study. All of these trials used a form of EDC system for data collection and management. Stakeholders in four clinical trials were willing to participate in this study. Stakeholders were site coordinators, statisticians, monitors, and study project managers. Three studies had at least one commercial sponsor and were consequently expected to follow FDA regulations. The fourth trial did not have a commercial sponsor but was sufficiently high in profile that it received strong regulatory oversight by Health Canada.

The clinical trials that participated were not representative of all clinical trials in Canada. They were, however, likely examples of trials where the stakeholders were sufficiently comfortable with their security practices that they agreed to participate.

The stakeholders identified password-protected electronic files that were generated or created during these trials and that were sent or received by email. All files met the following criteria:

We chose these file formats because they are the most commonly used based on their market penetration. Focusing on these document types provided us with an indicator of password strengths used by PHI custodians when they are free to select whatever password they want.

Even if the EDC system used in the trial supported some form of secure file sharing, the email exchanges we obtained the files from were with individuals involved in the trial but who did not have an account on the EDC system (eg, external statisticians and information technology specialists).

In total we examined 15 files from the four clinical trials. Nine were ZIP files and the remainder were Microsoft Office documents.

We purchased two commercial password recovery tools (Visual Zip Password Recovery Master version 6.2, Rixler Software, and Accent Office Password Recovery version 2.6, AccentSoft Utilities, St Petersburg, Russian Federation) and attempted to recover the passwords. We selected those tools based on listings at the openwall.com site, usability, and recommendations from security administrators at our institutions. Using commercial tools allowed us to assess the risk from an unsophisticated adversary.

One tool would attempt to recover the password for the Word document, and the second tool would attempt to recover the password for the whole of the ZIP archive (ie, there is one password for the whole archive). The tools use a number of techniques, including a dictionary attack, common password patterns, heuristics, brute force to recover the password, and by taking advantage of known vulnerabilities.

For dictionary attacks, we enhanced the dictionaries used to include Canada-specific terms (such as city and province names and famous personality names) and other commonly used terms and passwords (see Multimedia Appendices 2 and 3).

There are known vulnerabilities in some of the encryption methods that are used for these file types. Up to and including Word 2003, the default encryption was “97/2000 compatible.” This was an RC4 stream cipher with a 40-bit key. Because of the small key size, it would be possible to try all binary keys until one that works is found. This would not recover the password itself but would allow an adversary to access the contents of the password-protected file. Similarly, older versions of WinZip used the ZIP 2.0 encryption standard, which was considered weak. Only versions 9 and above of WinZip provide stronger encryption algorithms, such as Advanced Encryption Standard.

We used a computer running a 2 GHz dual processor with 2 GB of memory to execute the tool. The password recovery tools were allowed to run for 24 hours on each file before they were stopped.

The password recovery process was performed under the auspices of or by the stakeholder(s) themselves. Therefore, no files were transferred to any entity outside the data custodian to perform this study. The password recovery software was installed on a virtual machine and the software was run within the virtual machine on the data custodian’s equipment. The first author participated in running and monitoring the execution of the software. Each virtual machine instance, including all of the data files within it, was deleted after the analysis. We determined how many files had their password recovered during the 24-hour period.

We identified 121 study coordinators who responded to a previous survey [1] and were located within the Toronto-Ottawa-Montreal corridor. We randomly selected a subset of 80 coordinators and sent each an email request to participate in a 1-hour interview. Assuming that we would not be able to reach 25% of the group due to a change in contact information following the previous study (eg, change of employment, relocation), we expected our email invitation to be received by approximately 60 coordinators in total. We expected a response rate of 33% from those 60 [38]. We therefore planned for a group of 20 interviewees. The purpose of the interviews was to understand the file-sharing practices used within a recent clinical trial in which each coordinator had been involved.

The 80 selected individuals were invited by email to participate (Multimedia Appendix 4 contains the text of the invitation email). As an incentive to participate, we organized a raffle for an iPod shuffle (Apple, Cupertino, CA, USA) that took place after the interviews had been completed. All interviewees were entered in the raffle.

Depending on the location and timing, some interviews were conducted face-to-face and some were conducted by telephone. The interviews were recorded and then transcribed verbatim. The open-ended interview questions are presented in Multimedia Appendix 4. The interview guide included a series of questions on the electronic file-sharing practices used during the conduct of clinical trials. Specifically, the questions elicited information related to how research coordinators addressed security and privacy issues and why they made certain file-sharing choices during clinical trials.

We used a general qualitative thematic approach to analyze the interview transcripts [39]. NVivo software version 8 (QRS International, Cambridge, MA, USA) facilitated the management and analysis of the data. We analyzed the data by developing a “start list” of codes based on the interview guide for the study, as well as the issues and themes that we expected to see in the data. However, recognizing that some codes would emerge or disappear during the analysis, we only used these predefined codes as starting points and embraced any new or revised issues or themes that emerged from the data.

The ZIP files contained more than 2000 data files in their archive. In all cases the tools were able to recover the password, except for one file where the password could not be cracked within the 24-hour period. One of the recovered files contained coding information and dictionaries, and therefore did not have any PHI.

In all cases the recovered passwords were poorly constructed [40], with names of local locations (eg, “ottawa”), names of animals (eg, “cobra”), car brands (eg, “nissan”), and common number sequences (eg, “123”). This makes it easier for password recovery tools to guess them.

The files with recovered passwords that had PHI included Microsoft Word, Microsoft Excel, SAS, and XML (Clinical Data Interchange Standards Consortium Operational Data Model format files). They contained raw data from the clinical trials. In total, more than 10,000 patient records were in these files, and many with PHI on the subjects. For example, fields included name of study site, dates of screening and randomization, date of birth, initials, gender, and medical history.

For Microsoft Office document files, password-protecting a document is not the same as encrypting its contents [41]. Password protection controls the actions that can be performed on the document, such as who can modify a document, but the contents themselves are not encrypted. It may not always be obvious to an end user that such document protection does not protect the document contents themselves. A different program that ignores the document protections can be used to read the unencrypted contents, or they can be examined through a binary file viewer. All of the files in our sample were encrypted, but all used the default “97/2000 compatible” encryption.

Passwords on older versions of Word and Excel files are relatively straightforward to recover under certain conditions [42]. Word and Excel 2003 also have an option to use an RC4 stream cipher with a key length of up to 128 bits. A weakness in the implementation of the encryption module makes it possible for an adversary to compare two versions of a password-protected file to recover its plaintext contents [42,43]. In such a case password strength would not have affected the ability to extract the PHI. However, in our study we had only one version of each document and therefore our files were not vulnerable to this attack.

All of the ZIP files in our data set used the ZIP 2.0 encryption standard. All of the recovered passwords from the ZIP files were poor choices, and most of them were in our dictionaries or derived from words in the dictionaries (eg, ottawa followed by a digit).

We interviewed 20 study coordinators in the Toronto-Ottawa-Montreal corridor.

There was a marked difference between industry-sponsored trials and investigator-initiated trials. Specifically, industry-sponsored trials tended to have more formal processes in place to protect PHI and defined mechanisms for sharing data among those directly involved in the trial.

The three primary modes for sharing electronic information in the context of trials were as follows.

Previous work had indicated that password-protected files containing the PHI of clinical trial participants were being sent by email. Our initial study objective was to examine the strength of the passwords used to protect those files. Strong passwords were seen as an indicator of following good security practices in the context of clinical research.

We obtained a sample of 15 encrypted files that were sent by insecure email and were able to recover the passwords for 93% (14/15) of the files using commercial password recovery tools. Thirteen of those 14 files (93%) had sensitive health information in them. Therefore, in total 13/15 files were recovered and had PHI (87%). Since we were able to recover passwords using off-the-shelf tools, then it would be quite easy for an unsophisticated adversary to also do so. This result is consistent with previous research showing that health care professionals choose weak passwords to access patient data when there are no restrictions on password strength [44].

Perhaps more alarming, all of the Office and ZIP files in our sample used the default weak encryption methods. Therefore, an adversary had two different ways to extract the PHI: by attacking the weak algorithm itself or by attacking the weak password. In the current version of the WinZip tool (version 14.5), the default encryption is still based on the weak ZIP 2.0 standard.

At the time of this study the default applications for these file formats (ie, Microsoft Office and WinZip) did not enforce any password strengths, which means users could create any password they wished. For example, in earlier versions of WinZip that did provide password protection it was not possible to enforce a particular password strength (older versions of WinZip are still available [45]). Similarly, only recent versions of Microsoft Word have provided password strength enforcement [46]. Therefore, the passwords chosen were those that the stakeholders believed were sufficiently strong.

A follow-up interview study to examine the file-sharing practices of clinical trial study coordinators indicated that some PHI was exchanged by email that was not encrypted (eg, queries about specific patient data). Shared drives were another commonly used mechanism for exchanging files containing participant PHI. Shared drives create additional risks because, in practice, all files posted on the drive share a common password, and this common password is also shared among all stakeholders who need to access any one of the files. Sharing passwords is a violation of best-security practices. Furthermore, this goes against another best practice of limiting access to PHI to only the information that an individual needs (ie, a person who needs to access a single file should not get the password to access all files). From a regulatory perspective, it is also not possible to maintain audit trails of modifications made to files on shared drives.

Given the small number of trials from which we obtained files, broad generalization of the results is difficult. But we did expect that only trials that had good security and privacy practices would be willing to participate. We also expected that only study coordinators who were comfortable with the quality of their security practices would be willing to participate in the interviews. Therefore, the findings are expected to be biased toward those who were security-aware and were investing in protecting the data. Should this be case, then the more general state of affairs would be worse than depicted by our conservative results.

All of our data were collected from Canadian trials and Canadian coordinators. While the regulated trials from which we collected data had international sponsors and our interviewees participated in and discussed practices in international trials, our findings are specific to practices within a Canadian geography.

Our results indicate a potential privacy risk rather than an actual risk, since we do not know whether anyone has actually inappropriately accessed these files and cracked their passwords. However, this should not dilute the seriousness of the risk, since one purpose of having good password management practices is to act as a deterrent against an attack.

When sharing files containing PHI in the context of clinical trials, it is critical to encrypt all PHI. However, such a practice does not provide much protection if the passwords are weak or if the passwords are widely shared. Our study indicated that the passwords used are not strong and could be compromised using a commercial password recovery tool, and that some file-sharing practices used in clinical trials promote the wide sharing of passwords among study staff.

These results suggest that stronger oversight is needed on the transfer of health information in the context of clinical trials, and better training and enforcement (technical and procedural) of good security practices.