When the primary potential harm is the breach of individually identifiable data, to protect against such disclosures researchers should: a) Substitute codes for identifiers and maintain code lists and data files in separate files in the research laboratory. b) Have the files in physical possession at all times. c) Only report aggregate data in aggregate form. d) Encrypt the data and store it in password protected files on institutionally maintained servers with limited access.