Evidence Record

The NIST Privacy Framework treats privacy as risk to individuals arising from data processing and calls for identifying processing activities, risks, legal requirements, controls, communication, and protection. For this study, the relevant implication is to map every collection, transformation, access, and retention step before recruitment rather than treating de-identification as a complete privacy strategy.

This evidence constrains protocol design; it does not test the handoff hypothesis.

Limitations

The framework is voluntary and risk-based. It does not determine the study's legal jurisdiction, institutional obligations, or exact controls.