Protocol Part 3 Research Procedures Records Review
Version: 9/21/12
Note: This template is designed for records review procedures only and should not be used for
trying to provide other research procedures/methodologies. When multiple research methodologies
or research involving more than one subject group (ex. children and their parents) are combined
into a single IRB submittal, more than one Protocol Part 3 document may be necessary for the
project. When uploading multiple procedure documents, name each upload descriptively (e.g.
Consent for teacher interview, Procedure for child observation).
1. Enter a Version Date for this document:
Participants Included in these Procedures:
2. Indicate here which groups of participants and consent procedures are applicable to the
research procedures presented in this particular Part 3 document. If these apply to ALL
participants, simply say so.
3. How will consent be obtained from/waived for persons whose records will be accessed by
the researcher prior to any member of the research team accessing the records?
Consent will not be obtained from any subjects prior to accessing records- Protocol Part 2
PSD for Waiver or Alteration of Consent will be required.
Consent will be obtained from all subjects or parents prior to accessing records- An
appropriate protocol Part 2 Consent Process will be required.
Consent will be obtained from some subjects or parents prior to accessing records but not
from others. An appropriate protocol Part 2 Consent Process and PSD for Waiver or Alteration
of Consent will be required. Provide a description of the groups that will and will not consent
to the record access:
Research and Confidentiality Procedures:
4. Indicate the total number of records/charts to be reviewed:
5. Describe the records to be accessed:
6. Are all records existing at the time of starting the project (e.g. Only school standardized test
records for tests from past years will be accessed) or are new records that will be
created/added to after the date of project inception (e.g. Records accessed will include
grades obtained by students in the upcoming school year)?
7. Describe how the research team will access the records:
8. Describe what information will be taken away from the site where the records reside.
Protocol Part 3 Research Procedures Records Review
Version: 9/21/12
9. When will record information accessed be de-identified? Keep in mind that names are not
the only identifiers.
(Only one of these should apply for a given access to records)
a. The research team will only be given access to records that are completely de-identified
with no reasonable way to figure out any participant’s identity- This situation may not be
human research, consult with the IRB before proceeding further.
b. The research team will only be given access to records that are de-identified but a code
(such as record number) exists so that it would be possible to obtain the identity from the
original supplier of the records but the supplier and researcher have agreed that the research
team will never be given access to information that will allow re-identification- This situation
may not be human research, consult with the IRB before proceeding further.
c. The research team will be provided access to identifiable data but before any information
leaves the possession of the supplier, information will be de-identified (e.g. the researcher is
given access to the file cabinets containing the records but only writes down information in the
research record that is completely de-identified).
d. The research team will be provided access to identifiable data. However, any information
that leaves the possession of the record supplier, will only contain a code so that, if again given
access to the original supplier’s records, a participant could be re-identified but without this
access, the researchers records are essentially de-identified.
e. The research team will be provided access to identifiable data and the information will
remain identifiable in the research record for a period of time before it is de-identified or
identifiable records are destroyed.
f. The research team will be provided access to identifiable data and the information will
permanently remain identifiable in the research record.
10. If you checked d, e, or f in the previous question, explain why access to de-identified data is
either not sufficient for achieving the goals of the study or an impractical method for
obtaining the data:
11. Describe confidentiality procedures for handling of the data obtained including when
applicable:
 How and where data will be stored at each step of the process.
 How data is either coded and/or de-identified
 How and when it is to be placed in permanent storage or destroyed
 Time frames relative to data collection for each of these steps
 Who (the class of individuals) will have access to data at each step
Make certain that all data is accounted for. This is especially important for identifiable records
such as audio or video.
12. Describe any additional procedures for protecting the confidentiality of the subjects’
responses including if the PI has plans to obtain a certificate of confidentiality (not usually
Protocol Part 3 Research Procedures Records Review
Version: 9/21/12
applicable- consult with the IRB on this) to keep data from being subpoenaed. If none, state
so.
Privacy:
Privacy deals with a participant’s control over access to oneself. Protection of privacy is an issue
when data collection is occurring, not an issue of what happens with collected data. What happens
with collected data is a confidentiality issue.
13. When data is obtained from records explain why the data collection does not constitute an
unreasonable invasion of participants’ privacy when the researcher accesses the records
(e.g. Data is obtained from the files of the admissions office at UB. The director of
admission has granted permission for the research team to use this information in the study.
No identifying information will be communicated as a part of the published results of the
study so the only person who will have new access to private information is the researcher.).
Risks:
14. The most common risks associated with a records review are those associated with a breach
of confidentiality. Depending on the records in use, a breach could result in any number of
negative consequences including but not limited to embarrassment, harm to relationships,
loss of job, incarceration, financial loss and even in some cases physical injury or death.
Describe the possible negative consequences that could result for individuals in this study if
a breach were to occur and information were to be released such that it could be associate
with a person’s identity:
15. Given the confidentiality procedures of this study, briefly discuss how likely/unlikely is
would be that a breach would result in any the negative consequences identified above:
16. Other than the risks associated with a breach of confidentiality, discuss any other risks
associated with the records review and protections in place to minimize these risks. If none,
simply state so.