__________________________________________________________________________
NEBRASKA’S HEALTH SCIENCE CENTER
OFFICE OF REGULATORY AFFAIRS (ORA)
Institutional Review Board (IRB)
EDUCATIONAL GUIDE
MEDICAL RECORDS RESEARCH
NOT ALL QUESTIONS WITHIN THE APPLICATION CONTAIN AN EDUCATIONAL NOTE.
THE NUMBERS AND LETTERS CORRESPOND WITH THE QUESTIONS ON THE APPLICATION.
SECTION I
4.
FUNDING SOURCE
All research must have a source of funding. Examples of other funding sources may be
departmental funds, Clinical Research Center Support grants, or personal funding.
SECTION II
PROTOCOL ABSTRACT
Examples of protocol abstracts are available from the ORA or on the IRB website.
PURPOSE OF THE STUDY AND BACKGROUND (1-2)
2.
This section should clearly support the purpose of the study, contain appropriate key
literature citations, and should not exceed three pages in length.
METHODS AND PROCEDURES (3-13)
3.
All prospective subjects have a right to privacy. Therefore, research personnel must have
ethical access to clinical information with associated PHI in accordance with HRPP policy
#3.9.
4.
Use of existing records means that 1) all of the data that will be accessed and used exists as
of the date of this IRB application, and 2) no additional data will be collected for research
purposes.
In research involving existing medical records with associated PHI, written informed consent
is required unless:
1) All 18 subject identifiers specified by HIPAA are stripped from the data by the
investigator or designated study personnel when recording data for research purposes, or
2) Retention of a subset of subject identifiers are limited to a) town, city, state and zip code
and b) all elements of dates, or
3) A waiver of consent/authorization is granted by the IRB in accordance with the specific
requirements of 45 CFR 46.116(d) and 45 CFR 160, 164 (HIPAA Rule). (See Section II.14
for a list of the HIPAA identifiers.)
Page 1 of 5
Educational Guide – Medical Records (07-27-10)
5.
In research involving prospectively obtained medical records written informed consent is
required unless waived by the IRB in accordance with the specific requirements of 45 CFR
46.116(d) and 45 CFR 160, 164 (HIPAA Rule).
10.
Subjects who may be vulnerable to coercion, undue influence or increased risk must be
provided with appropriate additional safeguards. Depending upon the nature of the study,
the IRB may require completion of an addendum to this application.
CONFIDENTIALITY AND SECURITY OF RESEARCH DATA (14-23)
14. The listed identifiers pertain to a) the individual subject, and b) relatives, employers, or
household members of the individual subject.
15.
In order to protect confidentiality, the least number of HIPAA specified identifiers should be
recorded.
16.
In order to protect confidentiality, subject identifiers should be removed from research data as
soon as feasible in consideration of the objectives of the research.
18.
Research data must be stored and secured in a manner which fully protects confidentiality.
This section should describe how data is stored and secured at all stages of collection and
analysis, including hard copy and/or electronically on local computers or shared secure
drives. For example, hard copies must be stored in a secure location (e.g., locked room and
file cabinet) and all electronic copies, which include PHI, must be protected in accordance
with UNMC Computer Use and Electronic Information Security Policy No. 6051. This policy
requires that all mobile devices (e.g., laptops, flash drives) which contain PHI must be
encrypted in order to minimize the potential for breach. In addition, all research data should
be stored with a backup system.
23.
Generally, research data is subject to disclosure for the duration of the research and until
data analysis is complete. For research without a foreseeable end-point (i.e., registry
studies), the data may be subject to disclosure indefinitely.)
A data use agreement may be required in accordance with the HIPAA Rule at 45 CFR
164.514(e)(1).
POTENTIAL RISKS AND BENEFITS (24-27)
24. A risk is a potential harm associated with the research that a reasonable person would likely
consider significant. Breach of confidentiality is a risk for virtually all research using medical
records where subject identifiers are maintained. In this section, describe the psychological,
social, economic or legal harms that may result from loss of confidentiality.
25.
Any statement concerning the prospect of direct subject benefit should be fully supported by
the protocol.
26.
Societal benefit generally refers to the advancement of knowledge which may lead to new
discoveries. For example, research may ultimately result in the development of new or
improved treatments or diagnostic tests which may benefit future patients.
27.
The investigator should determine the overall risk classification for the research based upon
the following factors: 1) nature of the research, 2) evaluation of subject susceptibility and
vulnerability to possible harm and discomfort, and 3) the steps taken to minimize risk. The
estimation of risk is, therefore, both procedure-specific and population-dependent.
Page 2 of 5
Educational Guide – Medical Records (07-27-10)
Minimal risk means "The probability (of occurrence) and magnitude (seriousness) of harm or
discomfort associated with the research are not greater than those ordinarily encountered in
daily life (of the average person in the general population) or during the performance of
routine physical or psychological examinations or tests." Minimal risk, therefore, is used to
define a relatively low threshold of anticipated harm or discomfort associated with the
research.
Greater than minimal risk means the possible harms and discomforts of the research
involving the proposed study population are greater than those ordinarily encountered in the
daily life of the average person in the general population or during the performance of routine
physical or psychological examinations or tests.
INFORMED CONSENT (30)
30. Yes. A. The environment where informed consent will be obtained should be conducive to
discussion and thoughtful consideration by the prospective subject/LAR with
consideration given to the need to minimize the possibility of coercion or undue
influence.
B. The amount of time allotted to the process of consent is dependent upon 1) the
nature and complexity of the study, and 2) the need to minimize the possibility of
coercion or undue influence.
C. All research personnel involved in the process and documentation of informed
consent must be qualified by training and experience to explain the research to the
prospective subject/LAR and obtain valid informed consent.
D. All investigators have a legal and an ethical obligation to ensure that the prospective
subject/LAR has sufficient knowledge and comprehension of all of the elements of
informed consent to enable the subject/LAR to make an informed and enlightened
decision whether or not to participate and allow their medical records to be used in
research. Some investigators, therefore, choose to determine the level of
comprehension by questioning the individual concerning their understanding of all the
elements of informed consent. This section should clearly document that the
investigator has an adequate plan in place to assure existence of an acceptable level of
subject/LAR comprehension of all the elements of consent.
Note: In retrospective research involving medical records, written informed consent is
required from the subject or their LAR unless:
1. All 18 subject identifiers (as defined by HIPAA Rule) are stripped from the data by
the investigator or designated study personnel when recording data for research
purposes, or
2. Retention of a subset of subject identifiers are limited to a) town, city, state, and zip
code, or b) all elements of dates, or
3. A waiver of consent/authorization is granted by the IRB in accordance with the
specific requirements of 45 CFR 46.116(d) and 45 CFR 160,164 (HIPAA Rule). See
Section II.14 for the list of subject identifiers.
If PHI is obtained prospectively, written consent is required unless waived by the IRB in
accordance with the specific requirements of 45 CFR 46.116(d) and 45 CFR 160, 164
(HIPAA Rule).
If written informed consent will be obtained, submit one original and one copy of the
consent forms.
Page 3 of 5
Educational Guide – Medical Records (07-27-10)
If a waiver of consent is requested, submit the Addendum for Waiver or Alteration of
Informed Consent and HIPAA Authorization in Biomedical Research Involving Adult
Subjects or the Addendum for Waiver or Alteration of Parental-Guardian Permission and
Child Assent and HIPAA Authorization (available on the IRB website,
http://unmc.edu/irb).
Utilization of a separate youth or child assent form is not required for research involving
use of medical records. However, participants aged 13-18 must sign the parental
consent form. Assent from participants 7-12 must be obtained verbally and documented
in the record.
REFERENCES (31)
31. The IRB understands that the full protocol may contain a very extensive listing of references.
However, to assure that the full IRB has sufficient information to complete their review this
application must contain at least the key references.
Page 4 of 5
Educational Guide – Medical Records (07-27-10)
MEDICAL RECORDS RESEARCH
SECTION III
GENERAL INFORMATION
Medical Records Research utilizes individual medical records or databases with subject identifiers
for both retrospective and prospective studies. Proposals to conduct research that involves only
medical records information must be submitted on this application which is designed to help the
investigator address all necessary human subject protections as required by federal regulations,
HIPAA Rule, and HRPP policies.
SUBMISSION DEADLINE
Protocols can be submitted on any business day. Incomplete submissions may, however,
result in delay of IRB review.
SUBMISSION CHECKLIST
Check the appropriate box. Submit one original copy of each of the following:
Medical Records Research application
Vulnerable Population Addenda (if appropriate) Note: As indicated in Section II.10, contact
the Office of Regulatory Affairs to determine if an addendum is required for this medical
records application.
Informed consent document (as applicable)
Waiver or Alteration of Informed Consent (if appropriate)
Recruitment material (if appropriate)
Copy of the grant application (if appropriate)
IRB Review Fee Form (as applicable) Note: All commercially sponsored medical record
research projects are assessed an IRB review fee at the time of initial review. This fee covers
all subsequent IRB actions pertaining to research (i.e., Request for Change, Continuing
Review).
ADDITIONAL REVIEW REQUIREMENTS
Indicate if this proposal requires review by any of the following committees/groups:
Note: It is the investigator’s responsibility to submit all appropriate documentation as required by
the applicable review committee/group.
UNMC/Eppley Cancer Center Scientific Review Committee (SRC)
Note: Research involving the use of medical records of cancer patients must be
independently reviewed by the SRC. Forms are available on the SRC website at:
http://www.unmc.edu/ccto/. Final IRB approval is contingent upon SRC final approval.
Sponsored Programs Administration (SPA)
Note: Final IRB approval and release is contingent upon completion of a signed contract for
all commercially sponsored medical records research.
Page 5 of 5
Educational Guide – Medical Records (07-27-10)