Any person interested in conducting research at Marshfield Clinic Health System involving human subjects, their data or specimens must receive approval from the Marshfield Clinic Health System's Institutional Review Board (IRB), in accordance with the policy/procedure, “Human Participants in Research & the Human Research Protection Program.” The Office of Research Support Services/IRB provides investigators with decision charts designed to aid investigators in deciding whether their studies meet the definition of human subjects research, or whether they meet one of the exemptions from IRB review.
Of Note: IRB policies, procedures, and resource guides are found in the Document Control System (DCS) on the MCHS intranet.
What is Research?
What is Human Subject Research?
What Are the Different Types of Clinical Research?
What is a Clinical Trial?
What is a Clinical Investigation?
What is Minimal Risk?
What is Private Information?
How Do I Get Started in Human Subject Research?
What Training is needed?
What is a Certificate of Confidentiality (CoC)?
Does my study require a Certificate of Confidentiality, and if so how do I obtain one?
What is my responsibility as an Investigator
What Types of IRB Review are there?
Does my project need IRB review?
I’m in a rush to start my project. Can my protocol be granted pre-approval status?
Do I need IRB review/approval for Quality Improvement and/or Quality Assurance Activities?
Do I need IRB review/approval for a Single Case Report or Case Series?
Do studies involving simple surveys require IRB review?
Do I need to submit a protocol for review when I am only analyzing existing data?
Does Expedited Review mean that my protocol application gets processed faster?
What is the difference between “Emergency Use” and “Treatment Use”, and how do I determine which situation I have?
Does a Humanitarian Use Device (HUD) require IRB review?
How long will it take to get an approval for my project?
How long does approval last?
Will I be notified when it is time for me to renew my protocol?
Where do I submit my protocol?
What is informed Consent?
What information needs to be included on the consent document?
How do I create an Informed Consent document or assent document?
Do I always have to obtain informed consent?
What is signed informed consent?
Do research participants always have to sign the consent document?
How do I obtain consent from a cognitively impaired subject?
How is consent obtained from a non-English speaking subject?
What is a “waiver of documentation” of informed consent?
What is a “waiver” of consent? How is it different from a “waiver of documentation” of informed consent?
Do I always have to obtain written permission from parents for children to participate?
What is HIPAA?
What is Protected Health Information (PHI)?
What does the Privacy Rule (HIPAA) do?
Does HIPAA override the Common Rule and IRB Regulations?
What is the difference between HIPAA “Authorization” and Informed consent?
What individual rights does the Privacy Rule provide? And are these relevant to research subjects?
What is identifiable protected health information (PHI)? Can health information be de-identified? What is a “limited data set”?
Is coded information identifiable according to the Privacy Rule?
What is an Authorization? Is it different from a Privacy Notice?
What are the required elements in an Authorization?
What does revocation of Authorization mean?
When is authorization to disclose protected health information (PHI) not required for research?
Will the Privacy Rule affect the content of informed consent documents?
Can I make changes to the study once it is approved?
How do I report an unanticipated problem?
What happens if my study approval lapses due to non or late submission of a continuing review report?
When should I register my research with Clinical Trials.gov?
How do I close a study with the IRB?
A. A systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.
- Systematic Investigation is typically a predetermined method for studying a specific topic, answering a specific question (s), testing a specific hypothesis (es) or developing theory
- Generalizable knowledge means the intent or purpose of the systematic investigation is dissemination of findings. Common ways of disseminating results include publishing or presenting
A. Dept. of Health & Human Services (DHHS) defines it as a living individual about whom an investigator conducting research obtains (possess), uses studies, generates or analyzes: 1) information or biospecimens through intervention or interaction with the individual or 2) identifiable private information or identifiable biospecimens.
- Intervention: includes both physical procedures (e.g. venipuncture) by which data are gathered and manipulation of the participant or the participant's environment performed for research purposes.
- Interaction: includes communications or interpersonal contact between investigators (or research team) and participant. Examples include interviews, questionnaires, surveys, observations, manipulations subject behavior, diet, or environment, physical measurements, specimen collection (e.g. blood tissue) and administration of experimental drugs or devices.
A. Different types of clinical research are used depending on what the researchers are studying. Below are descriptions of some different kinds of clinical research.
- Treatment Research generally involves an intervention such as medication, psychotherapy, new devices, or new approaches to surgery or radiation therapy.
- Prevention Research looks for better ways to prevent disorders from developing or returning. Different kinds of prevention research may study medicines, vitamins, vaccines, minerals, or lifestyle changes.
- Diagnostic Research refers to the practice of looking for better ways to identify a particular disorder or condition.
- Screening Research aims to find the best ways to detect certain disorders or health conditions.
- Quality of Life Research explores ways to improve comfort and the quality of life for individuals with a chronic illness.
- Genetic studies aim to improve the prediction of disorders by identifying and understanding how genes and illnesses may be related. Research in this area may explore ways in which a person’s genes make him or her more or less likely to develop a disorder. This may lead to development of tailor-made treatments based on a patient’s genetic make-up.
- Epidemiological studies seek to identify the patterns, causes, and control of disorders in groups of people.
An important note: some clinical research is “outpatient,” meaning that participants do not stay overnight at the hospital. Some is “inpatient,” meaning that participants will need to stay for at least one night in the hospital or research center. Be sure to ask the researchers what their study requires.
Phases of clinical trials: when clinical research is used to evaluate medications and devices
Clinical trials are a kind of clinical research designed to evaluate and test new interventions such as psychotherapy or medications. Clinical trials are often conducted in four phases. The trials at each phase have a different purpose and help scientists answer different questions.
- Phase I trials
Researchers test an experimental drug or treatment in a small group of people for the first time. The researchers evaluate the treatment’s safety, determine a safe dosage range, and identify side effects.
- Phase II trials
The experimental drug or treatment is given to a larger group of people to see if it is effective and to further evaluate its safety.
- Phase III trials
The experimental study drug or treatment is given to large groups of people. Researchers confirm its effectiveness, monitor side effects, compare it to commonly used treatments, and collect information that will allow the experimental drug or treatment to be used safely.
- Phase IV trials
Post-marketing studies, which are conducted after a treatment is approved for use by the FDA, provide additional information including the treatment or drug’s risks, benefits, and best use.
Examples of other kinds of clinical research
Many people believe that all clinical research involves testing of new medications or devices. This is not true, however. Some studies do not involve testing medications and a person’s regular medications may not need to be changed. Healthy volunteers are also needed so that researchers can compare their results to results of people with the illness being studied. Some examples of other kinds of research include the following:
- A long-term study that involves psychological tests or brain scans
- A genetic study that involves blood tests but no changes in medication
- A study of family history that involves talking to family members to learn about people’s medical needs and history.
A. According to the National Institute of Health (NIH) a clinical trial is “a research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include placebo or other control) to evaluate the effects of those interventions on health-related biomedical or behavioral outcomes.
Use the following four questions to determine the difference between a clinical study and a clinical trial:
- Does the study involve human participants?
- Are the participants prospectively assigned to an intervention?
- Is the study designed to evaluate the effect of the intervention on the participants?
- Is the effect being evaluated a health-related biomedical or behavioral outcome?
Note that If the answers to the 4 questions are yes, your study meets the NIH definition of a clinical trial, even if…
- You are studying healthy participants
- Your study does not have a comparison group (e.g., placebo or control)
- Your study is only designed to assess the pharmacokinetics, safety, and/or maximum tolerated dose of an investigational drug
- Your study is utilizing a behavioral intervention
Studies intended solely to refine measures are not considered clinical trials. Studies that involve secondary research with biological specimens or health information are not clinical trials.
A. According to the Food and Drug Administration (FDA) – 21 CFR 56.102(c) a “clinical investigation means any experiment that involves a test article and one or more subjects, and that either must meet the requirement for prior submission to the FDA under section 505(i), 507(d), or 520(g) of the act, or need not meet the requirements for prior submission to the FDA under these section of the act, but the results of which are intended to be later submitted to, or held for inspection by the FDA as part of an application for research or marketing permit. The term does not include experiments that must meet the provisions of part 58, regarding nonclinical laboratory studies. The terms research, clinical research, clinical study, study and clinical investigation are deemed to be synonymous for purposes of this part”
For an activity involving drugs: “Clinical investigation means any experiment in which a drug is administered or dispensed to, or used involving, one or more human subjects. For the purposes of this part, an experiment is any use of a drug except for the use of a marketed drug in the course of medical practice.” 21 CFR 312.3(b)
For an activity involving devices: “Investigation means a clinical investigation or research involving one or more subjects to determine the safety or effectiveness of a device.” 21 CFR 812.3(h)
“Test article means any drug (including a biological product for human use), medical device for human use, human food additive, color additive, electronic product, or any other article subject to regulation under the act or under sections 351 and 354-360F of the Public Health Service Act” (42 U.S.C. 262 and 263b-263n). 21 CFR 50.3(j)
A. Under 45 CFR 46.404, Minimal risk means “that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests”.
A. According to the Office for Human Research Protections (OHRP) private information “includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record). Private information must be individually identifiable (i.e. the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects.”
A. Please see Investigator Resource – 10 Steps to Get Started page on this website.
A. All study personnel engaged in Human Subject Research must complete the Human Subject Protection Training found within the Collaborative Institutional Training Initiative (CITI) – an online training program for human subject research. The CITI site can be accessed at www.citiprogram.org. Research Certification is valid for a two-year period, after which time a refresher CITI course must be completed.
In addition, all key study personnel engaged in the research must complete the computer based conflict of interest (COI) training and disclosure. This training is to be done annually. A notice will be sent out to remind personnel of when it need to be completed after initial training/disclosure completed.
A. A Certificate of Confidentiality (Certificate) protects the privacy of research participants enrolled in biomedical, behavioral, clinical or other research. With limited exceptions, researchers may not disclose names or any information, documents or biospecimens containing identifiable, sensitive information. The Certificate prohibits disclosure in response to legal demands, such as a subpoena.
A. National Institutes of Health (NIH) funded researchers are automatically issued a CoC through their award. Other Department of Health and Human Services (DHHS) agencies issue CoCs to researchers they fund. Researchers no funded by HHS can continue to apply to NIH or the FDA as appropriate to request a CoC for HHS-mission relevant research. For additional information on CoCs see: https://humansubjects.nih.gov/coc/index or https://humansubjects.nih.gov/coc/faqs
A. See PI Responsibility page on this website.
A. According to federal regulations 45 CFR 46.102 (h) means “an institutional review board established in accord with and for the purposes expressed in this policy”. The IRB is to provide ethical and regulatory oversight of research that involves human subject by:
- Protecting the rights, welfare and well-being of human research participants, recruited to participant in research
- Ensuring compliance with relevant local, state and federal laws and regulations
- Ensuring compliance with MCHS policies and regulations
- Employing the highest ethical standards for human research protection in all human subjects research by adhering to the ethical principles outlined in the Belmont report:
- Respect for persons
- Individuals should be treated as autonomous agents
- Persons with diminished autonomy are entitled to protection
- Persons are treated in a ethical manner not only by respecting their decisions and protecting them from harm, but also by making efforts to secure their well-being
- (1) Do No Harm (2) Maximize possible benefits and minimize possible harms
- Fairness in distribution (select participant equitably)
- Who ought to receive the benefits of research and bear its burden?
- Respect for persons
- Giving guidance to ensure sound research design, scientific integrity and determining if the research contributes to generalizable knowledge and is worth exposing subjects to risk.
- Respect for persons
A. Marshfield Clinic Health System’s Institutional Review Board holds their convened board meetings on the first and third Tuesday of the month from 12-1:30pm in ML50. See also IRB Meeting schedule on this website.
A. The Department of Health & Human Services (DHHS) regulations (45 CFR 46.107) and Food and Drug Administration regulations (21 CFR 56.107) set forth IRB membership requirements. They require that an IRB:
- Have at least five members with varying backgrounds to promote complete and adequate review of research activities commonly conducted by the institution;
- Be sufficiently qualified through the experience and expertise of its members, as well as the diversity of the members, including consideration of race, gender, cultural backgrounds, and sensitivity to such issues as community attitudes, to promote respect for its advice and counsel in safeguarding the rights and welfare of human subjects;
- Include members who are able to ascertain the acceptability of proposed research in terms of institutional commitment and regulations, applicable law, and standards of professional conduct and practice;
- Which regularly review research involves a vulnerable category of subject such as children, prisoners, pregnant women, or handicapped or mentally disabled persons, consideration be given to the inclusion of one or more individuals who are knowledgeable about and experienced in working with these subjects;
- make every nondiscriminatory effort to ensure that the IRB does not consist entirely of men or entirely of women;
- not consist entirely of members of one profession; and
- include at least one member whose primary concerns are in scientific areas (e.g., MD, DO, DDS, Ph.D, PharmD or Bachelor of Science in Nursing), one member whose primary concerns are in non-scientific areas (e.g. lawyer, clergy, ethicists, teachers, engineers, accountants, musicians, business majors)and one individual who is not affiliated with the institution, nor is an immediate member of the family of a person affiliated with the institution. (For the purpose of this policy, affiliation means employment by Marshfield Clinic Health System, and immediate means spouse, sibling, or parent or child).
In addition, MCHS IRB will have at least one member who represents the perspective of research participants through personal experience in that role.
The regulations also indicate that an IRB may, at its discretion, invite individuals with competence in special areas to assist in the review of issues which require expertise beyond or in addition to that available on the IRB.
A. IRB review is required whenever an investigator who is affiliated with the institution conducts research with human participants. Research is defined in 45 CFR 46 as “ a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge”. A human subject or participant is defined in 45 CFR 46 as “a living individual about whom a investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information”.
A. It is the only type of assurance currently accepted and approved by the Office Human Research Protections (OHRP). Through the FWA, an institution commits to DHHS that it will comply with the requirements in the HHS Protection of Human Subjects regulations at 45 CFR part 46. See https://www.hhs.gov/ohrp/register-irbs-and-obtain-fwas/fwas/fwa-protection-of-human-subjecct/index.html for specific terms, applicability, and details of FWA.
Marshfield Clinic Health Systems:
- FWA#00000873 Expiration is 12/1/2022
- IRB#00000673 Expiration is 2/01/2021
A. Types of IRB review include convened full board, expedited, and exempt review. Please see Investigator Resource - Human Subject Determinations & IRB Review page on this website.
A. Sometimes it is difficult to discern whether a proposed activity constitutes research or human subject research. The MCHS IRB is the sole body designated to make human subject research determinations. MCHS IRB has created a form to assist with this determination. The information provided will be reviewed to determine whether the proposed activity would require review and approval by the MCHS IRB. Please complete the “IRB Review Determination Request”, sign and send to the IRB Office at 1R-4. Within 5 working days the submission will be reviewed and a determination provided to the investigator.
A. No, There is no provision allowing you to be granted a pre-approval status to start your project. Your protocol must be submitted, reviewed and approved in writing before you can start you project so please plan ahead.
If you begin your project before IRB review, you will be non-compliant and this will need to be reported to the Research Compliance Officer.
A. Most program evaluations do not qualify as human subjects research, however, some program evaluation activities meet the definition of human subjects research and require IRB review, approval and oversight. Please review the IRB resources guide entitled, “Program Evaluation, including QA and QI: Determining the Need for IRB Review” for full details and process. This guide is located in the Document Control System (DCS).
A. Depending upon the report you are intending. A single case report does not meet the federal definition of research and does not, therefore, require IRB review and approval. However, HIPAA provision governing privacy of patient information apply to a single case report if individually identifiable health information is contained within the case report and the report is disclosed to an external entity. Please see the IRB procedure entitled, “Case Report” for further details on Case Reports and authorizations forms required.
Also see IRB Procedure entitle, “Case Report” for details on Case Series that require IRB approval and those that do not require IRB approval.
A. Yes, if the study meets the definition for research with human participants, as explained above. MCHS’s Federal Wide Assurance (FWA) with the U.S. Department of Health and Human Services (DHHS) states that all research being conducted under the auspices of this institution is participant to review and approval by the IRB. Written approval from the IRB must be in place before any interventions or interactions with human participants (e.g. recruitment) actually begin.
A. Yes, Research involving the secondary analysis of existing data must be reviewed by the IRB and/or by the IRB staff to ensure that the original data were properly and ethically obtained and to ensure that the objectives of the secondary analysis are in keeping with those for which consent was obtained. Depending on the nature of the data, your protocol may fall under a federal exemption; however the determination for exemption must be made by the IRB office, thus submitting a protocol to the IRB is still necessary.
A. No. Expedited Review is for research projects that may be reviewed and approved without convening a meeting of the entire IRB. The term “expedited” can be misleading: review of this type are not “quicker” or conducted with less rigor, rather fewer reviewers are required. Expedited review can be considered when research activities present no more than minimal risk to human subjects and involve only procedures listed in one or more of the expedited review categories. These categories can be found on the IRB Application – New Research form located in the Policy & Handbook Library – Form Directory or in the electronic submission system (iRIS), IRB Application –New Research for those already trained.
A. See IRB procedures entitled, “Expanded Access-Physician Initiation of Emergency Use of a Test Article” and “Expanded Access –Treatment INDs and IDEs”.
A. Yes, although use of a HUD for clinical treatment and/or diagnosis of a condition without concurrent collection of safety or effectiveness data is not considered human subjects research, the FDA still requires an IRB to initially review and approval local HUD use. For details on HUD submissions to the IRB, see “Humanitarian Use Devices” policy located in the Document Control System (DCS).
A. Depending upon the type of submission you have will determine the amount of time it will take to get a determination of approval on your project.
A. If your protocol was reviewed and found to be exempt you will only need to update the IRB about your protocol if something changes that would no longer make the activities exempt.
For all other protocols IRB approval is for a maximum of 1 year. At the end of this period you need to complete and submit an IRB Continuation request for renewal. If you have made changes to your research during the year, you will need to submit a Change/Update to Original Submission prior to the annual report and prior to the changes taking place.
A. Yes, the IRB will send out a courtesy reminder notice approximately 30 days prior to the annual review being due for you to complete the IRB Continuation Request. However, it is ultimately your responsibility to keep track of the deadlines and keep your approvals current.
A. The Institutional Review Board is located in 1R-4, therefore all submission for IRB review should be routed there. We are in the process of piloting and converting to an online human subjects approval system, called “iRIS” and once training is complete, protocol submissions will go through the iRIS system.
A. If your project is "less than minimal risk" and meets one or more of the exempt categories listed in the IRB Exemption Request form, fill out this form, sign and then submit to the IRB at 1R-4 along with all applicable materials.
If your project is "not greater than minimal risk" and meets one or more of the Expedited review categories, in the IRB Application - New Research form, fill out this form, sign and submit to the IRB at 1R-4 along with all applicable materials.
For human subject research projects that are "more than minimal risk" to participants/subjects, fill out the IRB Application - New Research form, sign and submit to the IRB at 1R-4 along with all applicable materials (e.g. protocol, informed consent, recruitment materials, etc.)
Submission for convened/full board review are requested 3 weeks prior to the bi-monthly scheduled IRB meeting date that the investigator wished to have the project reviewed. Upon receipt the IRB Analyst will preview the submission for completeness and accuracy. It will then be placed on the appropriate IRB meeting agenda and assigned to two primary reviewers with at least one being a clinician. After a thorough review from the primary reviewers, the study will be provided to all board members to review prior to the meeting. During the meeting the study will be discussed and members will vote on a determination of approval, request modifications to secure approval, table the study or disapprove. Approximately within a week the investigator will receive a determination letter.
A. The “IRB Application – Data Collection & Retention for Protocol Development”
A. Informed consent is one of the primary ethical requirements underpinning research with human participants; it reflects the basic principle of respect for persons. It is too often forgotten that informed consent is an ongoing process, not a piece of paper or a discrete moment in time. Informed consent assures that prospective human participants will understand the nature of the research and can knowledgeably and voluntarily decide whether or not to participate. The prospective participant should be presented with the information, and then given an opportunity to ask questions and have them answered, prior to signing the consent document.
A. The informed consent process should ensure that all critical information about a study is completely disclosed, and the prospective participants or their legally authorized representative adequately understand the research so that they can make informed choices. Thus, the information must be conveyed in language understandable to those being asked to participate in the research. There are specific criteria that the consent form should include which can be found in the “Informed Consent template” and the IRB procedure entitled, “Informed Consent for Research”.
A. If one is already provided for you by the sponsor, you may only need to incorporate the MCHS recommended language. However if a consent and/or assent needs to be created, an informed consent template and an assent template is provided in the Policy & Handbook Library – Forms directory
A. In general, yes, but there are some limited exceptions. The MCHS IRB is responsible for ensuring that basic ethical principles are abided by in all MCHS research activities. The expectation that the informed consent of research participants be obtained is based upon the Belmont principle of respect for persons, and regarded as extremely important in conducting ethical research. The IRB has the authority to waive some or all of the federal requirements for informed consent in certain circumstances. A request for waiver of informed consent must be specifically justified by the researcher in the protocol application submitted to the IRB.
A. Use most commonly, signed informed consent allows prospective participants to document their agreement to take part in research activities by signing and dating the consent document.
A. Not always, in certain circumstances, the IRB can waive the requirements that you obtain the participant’s signature on the consent form. A waiver of documentation request from the research would need to be provided to the IRB for review before this may occur.
A. See IRB policy entitled, “Adults Lacking Capacity to Consent” in the Document Control System (DCS).
A. Participants who have limited English proficiency may be enrolled in research provided that you have the resources to communicate effectively with participants during recruitment, while obtaining consent and for the duration of the research. You may use a short form as described in the IRB policy, “Informed Consent of Non-English Speaking Subjects” in the Document Control system (DCS).
A. A waiver of documentation of informed consent is a request whereby a signed consent document is not required. Examples include implied and verbal consent. Consent will still be obtained from participants; however, they will not be required to sign the consent form. There are only two circumstances when the IRB may waive the requirement to obtain a signed consent form:
- The only record linking the research participant and the research would be the consent document and the principal risk would be potential harm resulting from a breach of confidentiality (participant must be asked if he/she want documentation) OR
- The research presents no more than minimal risk of harm to participants and involves no procedure for which written consent is normally required outside of the research context (for example, no risk surveys or interviews)
PLEASE NOTE: The IRB will take into consideration the risks and potential harms involved in the research and consent process before granting a waiver of documentation of informed consent.
A. A waiver of informed consent could: (1) alter some or all of the required elements of informed consent or (2) completely waive the requirement to obtain informed consent. The IRB may approve a consent procedure which does not include or alters some or all of the required elements of informed consent provided all of the following are true:
- The research involves no more than minimal risk
- The waiver of informed consent will not adversely affect the rights and welfare of the subjects
- It is not practicable to conduct the research without the waiver or alteration
- Whenever appropriate, participants will be provided with additional pertinent information after their participation.
Examples of types of studies in which some or all elements of consent have been waived include retrospective chart reviews, studies of existing pathology specimens, ethnographic research, studies that require deception or passive (opt-out) consent.
PLEASE NOTE: The IRB will take into consideration the risks and potential harms involved in the research before granting a waiver of informed consent. Additionally, there are restrictions for when the IRB may waive the requirements for child assent and parental permission.
A. No. There are two sets of circumstances where the IRB may waive the requirement for parental permission:
- The first involves research or demonstration projects that
- Are conducted by or subject to the approval of state or local government officials and are designed to study, evaluate, or otherwise examine: (i) public benefit or service programs; (ii) procedures for obtaining benefits or services under those programs; (iii) possible changes in or alternatives to those programs or procedures; or (iv) possible changes in methods or levels of payment for benefits or services under those programs; and
- Could not practicably be carried out without the waiver or alteration.
- The second involves research that
- Poses no more than minimal risk to the children;
- Would not adversely affect the rights and welfare of children if the IRB approved a waiver or alteration of the requirement for parental permission;
- Could not be carried out without the waiver or alteration; and
- Whenever appropriate, would provide the children with additional pertinent information after participation.
A. HIPAA is the acronym for the (Health Insurance Portability and Accountability Act of 1996) is United States legislation that provides data privacy and security provisions for safeguarding medical information. HIPAA is also known as the Kennedy-Kassebaum Act.
It calls for:
- Standardization of electronic patient health, administrative and financial data;
- Unique identifiers for individuals, employers, health plans and health care providers;
- Security standards protecting the confidentiality and integrity of health information
A. According to HIPAA’s Privacy Rule, PHI includes individually identifiable health information that relates to:
- An individual’s past, present or future physical or mental health or condition;
- The provision of health care to an individual; or
- The past, present or future payment for the provision of health care to an individual
A. Most health plans and health care providers that are covered by the Rule must comply with the requirements that were effective April 14, 2003.
The HIPAA Privacy Rule for the first time creates national standards to protect individuals’ medical records and other personal health information.
- It gives patients more control over their health information.
- It sets boundaries on the use and release of health records.
- It establishes appropriate safeguards that health care providers and others must achieve to protect the privacy of health information.
- It holds violators accountable, with civil and criminal penalties that can be imposed if they violate patients’ privacy rights.
- And it strikes a balance when public responsibility supports disclosure of some forms of data – for example, to protect public health.
For patients – it means being able to make informed choices when seeking care and reimbursement for care based on how personal health information may be used.
- It enables patients to find out how their information may be used, and about certain disclosures of their information that have been made.
- It generally limits release of information to the minimum reasonably needed for the purpose of the disclosure.
- It generally gives patients the right to examine and obtain a copy of their own health records and request corrections.
- It empowers individuals to control certain uses and disclosures of their health information.
A. No, The HIPAA Privacy Rule does not override the Common Rule or FDA's human subjects regulations. After April 14, 2003 you need to comply with both the Common Rule and the Privacy Rule.
- The Common Rule requires either an informed consent or a waiver of informed consent for any human subject research. Records review research is usually approved via an expedited review and a waiver of informed consent. The common rule allows a waiver only if specific criteria are met.
- The Privacy Rule requires a written authorization or waiver of authorization for access to existing protected health information. It is assumed that most records review will be allowed with a waiver of the authorization. The privacy Rule allows a waiver of authorization if specific criteria are met.
A. Informed consent is required under federal research regulations for the protection of human subjects. The HIPAA Privacy rule, a different regulation, separately requires that patients give written Authorization before a covered entity may use or disclose patients’ protected health information for research. There are different requirements for the content of informed consent and HIPAA Authorization. On a case by case basis the IRB may permit both to be combined in one form. An IRB may waive both consent and Authorization if the research meets all of the waiver criteria established by each of the applicable regulations.
A. The Privacy Rule gives all individuals, and hence research subjects, a number of rights. Items 3,4, and 6 are of particular relevance to research. Under HIPAA everybody can:
- Request access to their health care information
- Request that their health care information be amended
- Receive, upon request, an accounting of all disclosures of their medical information, if they haven’t specifically authorized the disclosures (or another exception does not apply)
- Revoke authorization for the use/disclosure of identifiable health information, to the extent the researchers have not already relied on it.
- Request alternative means or places of being contacted (e.g. home vs work)
- Request restrictions on uses or disclosures (but a covered entity or researcher is not required to agree).
A. The Privacy rule defines three categories of protected health information (PHI): identifiable information (to which the rule applies), de-identified information (to which the rule does not apply), and a limited data set (a middle option, to which limited parts of the rule apply). Each is explained below.
Identifiable information. The Privacy Rule defines "identifiable" information as information with any personal identifiers, as well as information about an individual, or his or her relatives, household members, or employer that alone or in combination could identify the individual. For more detail, see the list of 18 identifiers that must be removed to de-identify the information.
De-identified information. PHI that has been de-identified may be used without authorization and is not covered by the Privacy rule. Click here for a Fact sheet on De-Identification.
Limited data set. This is a data set that is not fully de-identified according to the Privacy rule regulations. While it excludes 15 of the 18 personal identifiers listed for de-identification, it allows the retention of:
- Dates (e.g., date of birth, admission and discharge date)
- Some geographic information (city, state and zip code but not street address) and other unique codes and characteristics that are not expressly excluded. Most Privacy Rule requirements do not apply to a limited data set used internally or disclosed (for example, disclosures do not have to be tracked). There are restrictions on the use of limited data sets including:
- The limited data set option is available only for research, health care operations, and public health purposes.
- AND, the following two requirements apply:
- the covered entity may release only the minimum necessary information, so the intended recipient must indicate what is needed; and
- the recipient must agree to a "data use agreement" which generally describes the permitted uses and disclosures of the information received and prohibits re-identifying or using this information to contact the individuals. A data use agreement is an agreement between the covered entity (perhaps via the Privacy Officer) and the recipient of the data. Note, a data use agreement is required for recipients that are both internal and external to the covered entity.
A. The Privacy Rule considers coded information to be de-identified if 18 specific identifiers are coded and the individual cannot reasonably be identified. The Privacy Rule does consider the code itself to be identifiable and hence, protected health information. Note, the Common Rule, in contrast to the Privacy rule, considers coded information to be identifiable. So while access to the coded information alone is not covered by the Privacy rule it is covered by the common rule and requires IRB review.
A. The Privacy Notice is a document that describes how the covered entity will use, disclose, and protect a person's health information. Everyone entering the covered entity should receive a copy of this notice, and a good faith effort must be made to have each recipient sign a form attesting to receipt of the notice. An Authorization is a document signed by a person to allow disclosure of their protected health information (PHI) to somebody outside the covered entity that stores the PHI. If you need access to your subjects' PHI you will need a signed Authorization from each subject that explains clearly to the subject what PHI you need to access, how you will use it, and who will see this information. Authorization agreements must be secured from the covered entity providing access to the information.
- Specific and meaningful description of what information will be used or disclosed.
- Identification of who may use or disclose the PHI.
- Identification of to whom the PHI will be disclosed.
- Why the use or disclosure is being made - each purpose must be included.
- Statement regarding how long the use or disclosure will continue. For research purposes no expiration date is required but this must be stated in the authorization.
- Notice that the authorization may be revoked by the subject.
- Notice that the information may be disclosed to others who are not subject to the Privacy Rule.
- Notice that the covered entity may or may not condition treatment or payment on the individual's signature of the authorization.
- Individual's signature and date.
A. Research subjects have had a longstanding right to revoke their consent to participate in research. In addition, the Privacy Rule permits a subject to revoke permission for researchers to use or disclose his or her identifiable information for research. The researchers must honor this request, except to the extent they have already relied on the permission. For example, if a researcher has already included a person's protected health information (PHI) in an analysis, the analysis can be maintained but the researcher should consult with the IRB regarding the individual's request. In addition, HHS guidance specifies that researchers may "continue using and disclosing protected health information that was obtained prior to the time the individual revoked his or her authorization, as necessary to maintain the integrity of the research study". Researchers may also use or disclose PHI already gathered for purposes such as accounting for the subject's withdrawal, reporting adverse events, or complying with investigations.
A. Authorization of disclosure for research purposes is not generally required if:
- a waiver of authorization has been approved
- the research is on decedents
- the activity is preparatory to research
- the research involves a limited data set or de-identified health care information.
A. Yes, for studies that require access the subjects' protected health information. The Common Rule already requires the informed consent process to address how confidentiality will be protected. The Privacy Rule imposes a more specific requirement. In addition to informed consent, investigators must obtain written authorization for the use and disclosure of subjects' identifiable health information. This authorization must include several details. Although the Privacy Rule allows an authorization to be incorporated into the informed consent form the MCHS IRB will require a separate authorization form. In addition, the informed consent document should contain wording that states that the investigator plans to access the subject's existing protected health information (PHI), and that the subject's authorization to access this information will be obtained. Although the Privacy rule does not cover PHI once it has left a covered entity, the informed consent should also include information about how the researcher will use and disclose information generated in the course of the research.
A. Per federal regulations, once a human subject research study is approved by an IRB, any subsequent changes to the study must be reviewed and approved by the IRB prior to implementation except when necessary to avoid an immediate apparent hazard to a subject. You will need to complete, sign and submit a IRB “Change/Update to Original Submission” form.
A. Investigators must promptly report all unanticipated problems that may involve risk to subjects or others to the MCHS Institutional Review Board.
In urgent situations, contact the IRB office to report the problem to the MCHS IRB within 24 hours of knowledge of the event or sooner as appropriate.
For all other unanticipated problems that may involve risk to subjects or others, the unanticipated problem reporting form (clinical or non-clinical) with any pertinent supporting documents (e.g., study sponsor report, communications) should be completed and submitted by the investigator within 72 hours to the IRB.
A. The federal regulations make no provision for any grace period extending the conduct of research beyond the expiration date of IRB approval. A lapse in IRB approval of research occurs whenever an investigator has failed to provide continuing review information to the IRB; OR the IRB cannot conduct continuing review by the expiration date of IRB approval.
If the approval of the research study expires, all human subject research procedures related to the protocol must cease, including recruitment, advertisement, screening, enrollment, consent, interventions, interactions, and collection of private identifiable information. The continuation of human subject research procedures without IRB approval is a violation of federal regulations.
A. You must register your research with ClinicalTrials.gov if it meets the requirement for submission. Please see the ClinicalTrials.gov website for more information: https://clinicaltrials.gov/ct2/manage-recs/background. If you are required to register your research, you must also include a statement indicating so in your consent document. This statement is provided in the Informed Consent Template.
A. If ALL research-related activities with human subjects have been completed, and all data collection and analysis of identifiable private information described in the IRB-approved research plan have been completed, then the human subject research study has been completed, and the study may be closed with the IRB.
NOTE that full closure is a different action from temporarily closing a study to accrual. With a temporary closure to accrual, there is the possibility that study enrollment may resume with IRB re-review of the study/issue. Once a study is fully closed with the IRB, the research is considered complete, and no further research activities may occur.
When a human subject research study has been completed, the investigators no longer are required to obtain continuing review and approval of that study. No further research activities can be done including access of medical records to finalize data queries by the sponsor. Therefore, make sure that all data collection required by the study has been completed prior to study closure.
To close a study with the IRB, you will need to submit a “IRB End Oversight” form.
A. Data Use Agreements (DUA) address important issues such as limitations on us of the data, liability for harm arising from the use of the data, publication, and privacy rights that are associated with transfers of confidential or protected data. The understanding established by the DUA can help avoid later issues and will ensure the appropriate use of data for a specific research project, protecting both the provider and the recipient.
Establishing a Data Use Agreement (DUA) achieves the following:
- Protects the investment and reputation of both the investigator and the institution
- Ensures that the investigator and the institution receive credit for their work
- Prevents the inappropriate us of intellectual property or protected or confidential information that could cause harm to research subjects, the investigator or the institution
- Helps to shelter the investigator and the institution form any liability or loss from arising from a recipients us of data
- Assures that the recipients are using the data in accordance with applicable law
- Contractually obligates the recipient to use the data only for the purposes described in the DUA.
A. For Human Subject Data
- Disclosure of data for research purposes and
- Individual authorization for disclosure to this recipient is not/has not been obtained (from human subject, as through use of subject signed informed consent authorization) and
- Disclosure is permitted under an IRB approved protocol (for human subject research) or
- The researcher is disclosing or receiving a “de-identified or Limited Data Set of Protected Health Information (PHI), as defined under HIPAA.
For more details please review the “Data Use” policy.