research compliance -...
Post on 28-Jul-2018
212 Views
Preview:
TRANSCRIPT
UA College of Medicine, Phoenix Page 2
TABLE OF CONTENTS
Introduction………………………………………………………………………………………. Page 4
University of Arizona Policies…………………………………………………………... Page 4
What is the Basis for the Ethical and Regulatory Compliance that is Mandated for Human Subject Research?.................................... Page 5
Education and Training for Protection of Human Subjects…………….. Page 6
What is the Purpose of the IRB?............................................... Page 7
What are the Facts Often Misunderstood about the IRB?.............. Page 7
What Functions does the IRB Perform?...................................... Page 8
Who serves on the IRB? Can I Become and IRB Member?............ Page 10
When Must the University of Arizona Institutional Review Board (IRB) Review a project that is not conducted at a UA Facility?....... Page 11
What are the Steps I Must Take to Prepare for IRB Review? ……….. Page 11
What is the IRB Review Process?.............................................. Page 13
How is the Principal Investigator notified of the Results of an IRB
Review?................................................................................ Page 14
Can my Research Begin?......................................................... Page 15
What IRB Forms Must I be Familiar with at UA or UA COM-P?....... Page 16
How does Health Insurance Portability and Accountability Act
Regulations (HIPAA) and Personal Health Information (PHI) and the IRB Interface?................................................................. Page 16
How is HIPAA Privacy and the IRB Related?............................... Page 17
What is HIPAA/HITECH relation with IRB?................................. Page 18
What is Informed Consent and How is This Related to the IRB?.... Page 19
What is a Waiver or Alteration of Authorization and the IRB?....... Page 21
UA College of Medicine, Phoenix Page 3
What is a Waiver of Authorization?.......................................... Page 21
. What is an Alteration of Authorization and How is This Different
From a Waiver of Authorization?.............................................. Page 22
What is a Data Use Agreement and How is This Connected With the IRB?....................................................................... Page 22
How is Confidentiality of Participant Information and the IRB
Related?.............................................................................. Page 22
Can There be Additional Requirements?................................... Page 23
What is a Certificates of Confidentiality (CoC) and its Relationship to the IRB?........................................................ Page 23
APPENDIX A – Exemption Categories………………………………………….. Page 25
APPENDIX B – Expedited Categories……………………………………….……. Page 27
Figure 1. IRB Process for Research Conducted at UA College of Medicine-Phoenix……………………………………………………………….……… Page 30
Figure 2. IRB Process……………………………………………………………….….. Page 31
Figure 3. IRB Process if Research is Conducted at an External
Institution – Requires a Deferral from the UA COM-P…………….…… Page 32
UA College of Medicine, Phoenix Page 4
Introduction
Research provides an opportunity to discover new knowledge in an area of
medicine or science that an individual is passionate about. Basic and clinical faculty, as well as medical and graduate students who are considering
careers in academic medicine must become familiar with the regulatory issues related to human subject participation.
This handbook will review the Federal, State and University of Arizona
regulations and policies necessary to assist an investigator with the compliance issues related to the use of human subject participation. It is
important that in order to conduct research involving human subjects
requires not only the Principal Investigator but includes all members of a research project to take part in a human subject education and training
program. Education and training in human subject protection is a federal requirement.
University of Arizona Policies The University of Arizona (UA) is committed to protecting the rights and
welfare of subjects in human research investigations. The UA holds a Federalwide Assurance (FWA) issued by the Office of Human Research
Protections (OHRP). This is a written agreement between the government and the UA in which it describes the jurisdiction, composition, policies and
methods of procedure for human subject research conducted at a UA facility.
The UA’s Human Subject Protection Program (HSPP) located in Tucson is a
comprehensive system to ensure the protection of the rights and welfare of subjects in Human Research. The HSPP involves all individuals in the
organization including those UA employees in Phoenix, key individuals and committees fulfilling their roles and responsibilities as described in this
handbook.
The UA’s plan is to comply with all ethical and legal requirements for the conduct and oversight of Human Research. The President of the University of
Arizona has designated the University of Arizona’s Institutional Review Board (IRB) in Tucson as the independent review committee charged with the
protection of human research subjects. Therefore, any research conducted in Phoenix on the UA COM-P property involving human subjects must be
submitted to the Phoenix, Research Administration Office (RAO) Figure 1. The RAO will review the application for completeness before forwarding to
UA’s HSPP located at 1618 E. Helen Street Tucson, Arizona were it will be
evaluated and, if necessary, reviewed by the Institutional Review Board (IRB) Figure 2. Research involving human subjects can only begin if the
UA College of Medicine, Phoenix Page 5
research is approved or exempt and the Principal Investigator has received a
written letter stating approval or exemption. In some cases the research may be considered non-human research. To determine whether a project is
considered non-human research an investigator can fill out Form 309 to assist the RAO with this decision. If the research is not subject to IRB
review the form 309 is signed and filed with the research protocol. The research project can commence only when this determination is made.
If one of our UA faculty members, medical or graduate students is engaged
in human research at an institution that is not part of the UA, the IRB located at that institution must review the research protocol. If that
institution’s IRB approves of the research, the UA faculty member, medical or graduate student must submit the IRB approval letter from that institution
along with the protocol to the Phoenix, RAO. The RAO will review the documents for completeness and send them to the Tucson HSPP for a
deferral, Figure 3. This requires the use of the UA Form 200 or 207. This
means that the oversight of the research remains with the Institution’s IRB where the research is taking place. Therefore, all communication regarding
the research project (ie., an amendment, continuing review, adverse event) must be conducted with that Institution’s IRB and not the Tucson UA IRB.
What is the Basis for the Ethical and Regulatory Compliance that is Mandated for Human Subject Research?
The principles mandating regulatory compliance concerning human subject research began with the Nuremberg Code, the Declaration of Helsinki and
the Belmont Report. Each of these documents defined the minimum codes/rules for conducting research with human beings. Recognition of the
need for guidelines dealing with human subjects in research emerged following the Nuremberg trials, where the medical experimentation abuses of
World War II Nazi doctors came to public attention. This led to the creation
of the Nuremberg Code in 1945, the first legal attempt to deal with ethical issues of modern research. As biomedical research efforts expanded, the
need for a more specific international code of ethics was formulated in the 1964 Declaration of Helsinki. In 1974 the United States Congress passed the
National Research Act, creating the National Commission for the Protection of Human Subjects in Biomedical and Behavioral Research. This commission
set the definitive standards of the Institutional Review board (IRB). In 1979 the National Commission published recommendations known as the Belmont
Report.
The Belmont Report outlines three general ethical principles that must govern human subjects’ research. They are:
UA College of Medicine, Phoenix Page 6
Beneficence: To maximize benefits for science, humanity, and research
participants and to avoid or minimize risk or harm.
Respect: To protect the autonomy and privacy rights of participants.
Justice: To ensure the fair distribution among persons and groups of the costs and benefits of research.
These regulations, which set standards for review of human research
activities by IRBs, now apply to all activities involving human subjects within the University of Arizona.
Education and Training for Protection of Human Subjects As part of the agreement that the university has with the government all
personnel who participate in collecting or handling data from human subjects
as a systematic investigation must complete approved human subject training. While the National Institutes of Health (NIH) has an online training
program that students and faculty can take, the UA COM-P requires that all faculty and medical students engaged in human subjects research take the
CITI training as part of the required education in human subject protection. The website can be accessed from any computer with web access. The
website is http://www.citiprogram.org. One needs to register then login and look for the UA College of Medicine-Phoenix in the drop-down menu. Do not
select the University of Arizona – that is the Tucson site). You are required to take the following modules:
1. Biomedical Research Investigators: Basic Course
2. Health Information Privacy and Security 3. Bloodborne Pathogens – medical students only
When you have completed the modules you will be aware of the historical, social, and legal components of human subjects’ protection. A cumulative
passing grade of 80% is required. Upon completion of the modules the RAO will receive notice of completion that will allow us to track your training to
ensure compliance. You should print a copy of the completion certificate verifying the training for your files as you will be required to supply this
document with any human subject investigation. On the UA COM-P you will be required to take a refresher course in the fourth year following the initial
training. It is also important to understand that if a research project is conducted in another institution you may be required to take their training
as well as the training required by UA COM-P.
UA College of Medicine, Phoenix Page 7
What is the Purpose of the IRB? UA COM-P encourages and supports the scholarly activity of faculty, staff
and students. Scholarly activity often involves the use of human subjects for data collection and analysis. The University of Arizona IRB serves as the
University’s “protective eye” to ensure:
that the rights and welfare of human subjects are protected; that risks have been considered and minimized;
that the potential for benefit has been identified and maximized; that all human subjects only volunteer to participate in research after
being provided with legally effective informed consent; and that any research is conducted in an ethical manner and in compliance
with established standards, including handling all private information with confidentiality.
What are the Facts Often Misunderstood about the IRB?
1. Federal regulations for research involving human subjects is not limited to just drug or medical studies. There is sometimes a
misconception that if the subject is not undergoing medical procedures, the project is not covered by the regulations. Any project
where data on a human subject is obtained through intervention with, manipulation of, interviewing, communicating with, or observing
human subjects for the purposes of gathering data must be approved by the IRB, including the distribution of surveys for research purposes.
2. Certain types of projects are exempt from full IRB review. This does
not mean that these projects may be conducted without submitting them to the IRB for approval. An exempt protocol still requires IRB
approval. Exemption from IRB review must be documented. Many
journals now require proof of IRB review or exemption before accepting manuscript submissions. The explanation of projects which
may qualify for exempt status can be found in the APPENDIX A of this manual.
3. Vulnerable populations include: children, minors, prisoners, the
mentally impaired, inmates of mental institutions, the competency-impaired aged, the economically and educationally disadvantaged, or
any other person whose judgment when consenting to participation may be impaired. Research involving vulnerable subjects is never
exempt from IRB review and approval.
UA College of Medicine, Phoenix Page 8
4. In Arizona a minor is an unmarried person who has not reached the
age of 18. Please note that this is a departure from a few states, such as Alabama where the age is 19. A person under age may not sign a
consent form to participate in research. A parent or guardian must give this consent. A child over the age of 10 who may reasonably
understand the nature, risks and benefits of the research may assent to participate, but this must still be confirmed by parental/guardian
consent.
5. IRB approval, or a letter of exemption, must be obtained before a project is started. This means you may not collect any data but you
can conduct a literature search.
6. The regulations regarding the content of any solicitation for subjects (advertisements, notices in newspapers, flyers, etc.) are explicit. All
advertisements and methods of recruitment must all be approved by
the IRB. If the research project is sponsored by a pharmaceutical any marketing most often requires the approval of that sponsor as well as
the IRB.
7. Risk to a subject is not limited to physical harm. Emotional, psychological, social, or financial damage is also possible and should
be considered.
What Functions does the IRB Perform?
The IRB is authorized to review, approve, require modifications in, or disapprove human subjects research activities conducted by or through the
University of Arizona. Information that is important to know about when conducting human research.
1. The Federal interpretation of what is “human subjects’ research” is expanding while compliance enforcement is tightening. Any individual
(inside or outside the university) who desires to conduct any systematic investigation that involves obtaining any information about
University of Arizona’s individuals (administrators, faculty, staff, or students) must obtain official University of Arizona IRB clearance.
2. Individuals seeking to conduct research may not solicit subject
participation or begin data collection until they have obtained clearance by the IRB of the institution they are conducting the
research at. If the study is conducted at UA COM-P the University of Arizona’s IRB (Tucson) must approve. If the research is conducted at
an institution other than the UA COM-P the IRB of that institution will
UA College of Medicine, Phoenix Page 9
review the project and provide a decision. If the external institution
provides an approval the faculty member, medical or graduate student must file a Form 200 or 207 with the RAO Building 1, and Room 1272.
The staff will review the application before forwarding the document to the Tucson office. The Tucson office will review the application and
defer to the IRB of the institution where the research is being conducted. However, in research involving high risk the UA IRB
(Tucson) may want to review the application by a formal review process rather than defer. No research can begin until the UA
approval or deferral is received by the Principal Investigator in letter form.
3. The University of Arizona faculty medical or graduate student who
wishes to submit an application for Federal grant funds must have an IRB process in place to assure that proposals submitted are compliant
with Federal human subjects’ regulations.
4. More journals are requesting proof of IRB clearance as a condition of
publishing articles.
5. Human subjects’ research is a compliance matter. The IRB evaluates the risk to human subjects and must determine if the human subject
receives sufficient information to make an informed decision about participation in the study.
6. While it is true that the IRB process adds steps to the development of
research ideas, going through the process facilitates thorough planning.
In situations where a faculty member or student joins a research project
after it has already been reviewed by an institution’s IRB and that faculty
member or student will have direct interaction or intervention with patients in this study the Principal Investigator will need to submit an amendment to
the IRB of record listing the addition of the faculty member medical or graduate student as a new associate with supporting documentation as to
the training of that individual. All researchers must complete appropriate NIH human subjects training although most universities are now going to
CITI training as the first line of education for human subject research. This is generally followed by additional education in the form of lectures,
seminars, and workshops. Copies of the completed/updated training certificate(s) are required from the all individuals participating in the
investigation as well as any documentation that may be required by the non-university institution. A Principal Investigator’s CV is required and kept with
each individual research protocol application. Therefore, an updated CV of
UA College of Medicine, Phoenix Page 10
the Principal Investigator may be requested when submitting an amendment
at some later date. Generally a CV is required only of the Principal Investigator although the IRB can request CV’s on any member of the team
to determine their expertise for their part of the investigation. Different institutions will have different requirements. Faculty and students
conducting research at institutions that are not UA facilities should seek information from the Research Administration Office of that institution as to
their requirements.
Who serves on the IRB? Can I Become and IRB Member?
The IRB is composed of at least 5 members with varying backgrounds to promote complete and adequate review of research activities commonly
conducted at an institution. The membership includes individuals with the necessary experience and expertise and knowledge of the local research
context to review the scope of biomedical and behavioral research
conducted. Members include both men and women and members of minority groups. Designated alternates may be used. The membership
includes: Physicians;
Scientists; Nurses;
Pharmacists; Federal regulations require at least one of these five members be
unaffiliated with the institution. This person cannot be a part of the immediate family of a person who is affiliated with the institution; and
At least one member whose primary concerns are in nonscientific areas, such as lawyers, ethicists, and clergy.
Most IRBs have some twenty or more members to ensure the breath of
expertise needed in reviewing the human subject research protocols. The
membership roster and IRB registration information are updated as needed when membership changes. The revised IRB registration is submitted to the
Office for Human Research Protections (OHRP) as required by the institution’s FWA.
The membership of the IRB is reviewed at least annually to determine if the
membership includes individuals with varying backgrounds and the experience and expertise needed to review the scope of biomedical and
behavioral research conducted as well as other competencies necessary to interpret regulations, relevant law, ethical conduct, risk:benefit and
volunteerism.
UA College of Medicine, Phoenix Page 11
Faculty, medical and graduate students can become a member of the IRB.
However, this is a time consuming role and therefore most institutions who wish to make the IRB a part of medical education have a three month
rotation that students participate in as an observer. The students are given protocols under IRB review and asked to evaluate them against a checklist.
Their opinion will be solicited as regards the ethics or appropriateness of the study.
When Must the University of Arizona Institutional Review Board (IRB) Review a project that is not conducted at a UA Facility?
University of Arizona (UA) has assured the Federal government that it will comply with the Department of Health and Human Services (DHHS)
regulations for the protection of research participants, 45 CFR 46. UA has agreed that research activities involving human participants, regardless of
sponsorship, will be reviewed by the UAs IRB when one or more of the
following apply: the research is sponsored by this University of Arizona, or
the research is conducted by or under the direction of any employee or agent of this University of Arizona in connection with his or her
institutional responsibilities, or the research is conducted by or under the direction of any employee or
agent of this University of Arizona using any property or facility of this institution, or
the research involves the use of University of Arizona’s non-public information to identify or contact human research participants or
prospective participants.
What are the Steps I Must Take to Prepare for IRB Review?
1. Complete the online training program described above.
(www.citiprogram.org).
2. Complete Form 309 "Human Research Determination" if you are unsure whether your investigation/project requires IRB review. The
UA COM-P RAO staff will help with any questions.
3. If the RAO determines your Investigation/project is human research that requires IRB review you will need to:
a. Determine the site/institution where the research will take place. b. Determine if an external institution has an IRB.
i. If this institution does not have an IRB the UA COM-P will accept the Western Institutional Review Board’s (WIRB)
review.
UA College of Medicine, Phoenix Page 12
ii. External Institutional IRB – go to their IRB office (generally
referred to as Research Administration) and request an application. Determine what documents are required in
addition to the protocol when submitting to the IRB.
4. The UA COM-P, RAO staff will assist you in filling out the application if necessary.
5. Complete the application and be sure to include in the application any
and all necessary supporting documents required such as: a. Human subject training
b. Protocol for human subject research c. Informed consent if applicable
d. Funding source if applicable e. Research instruments such as:
i. Copy of any survey, questionnaire, and/or interview
questions that are to be used. ii. Published materials can be incorporated by providing a full
citation to the materials. iii. Graphical and verbal stimuli, if not completely described on
the IRB application form, should be attached or a complete citation provided.
f. Debriefing – if applicable. Whenever deception is involved as part of the research or information is withheld from a participant
prior to or during the research, this information must be disclosed to the participant at the close of the research either
verbally or in writing. A copy of this statement must be attached and fully describe the process to be used in the protocol.
g. Advertisements - If participants will be obtained through advertisements, attach a copy of the ad.
h. Certificates of Confidentiality - When data are being collected
about sensitive issues (such as illegal behavior, or alcohol or drug use), the Principal Investigator/mentor may consider
applying for a Certificate of Confidentiality. http://grants.nih.gov/grants/policy/coc/background.htm.
i. Under Federal law, researchers can obtain an advance grant of confidentiality that will provide protections against a subpoena
for research data [Public Health Service Act 30l(d)]. Protection will be granted sparingly and only when the research is of a
sensitive nature and where the protection is judged necessary to achieve the research objectives.
6. The research proposal and IRB forms should be submitted in both hard
copy and electronic (e-mail) format to the RAO.
UA College of Medicine, Phoenix Page 13
What is the IRB Review Process?
As soon as a research proposal is submitted to an Tucson HSPP office, it is assigned a protocol number. Each submission is referred to as a “protocol”
and the HSPP staff will refer to the protocol number when communicating about the submission. The protocol number helps HSPP keep track of
submission(s) related to the protocol and communicate about them without revealing confidential information during the review process. Once the
protocol is assigned a number by the HSPP, a determination will be made as to the appropriate type of review to be conducted. Consistent with U.S. legal
standards regarding IRB reviews, the HSPP will first determine if the proposed activities constitute research as defined by federal regulations. If
the proposed activities do not fit the criteria for research, the HSPP will issue a formal letter to the Principal Investigator/ mentor who will inform the
Principal Investigator indicating that the proposal needs no review by the
IRB. If the proposal fits the criteria for research activities, there are three levels of review that can be conducted for an initial research proposal. These
are:
Exempt - Certain kinds of research involving minimal risk or less than minimal risk may be “exempt” from continuing IRB review when the
activities fall into one or more of the Exempt categories of research. Investigators must submit proposed exempt research to the IRB for
exempt determination. An example of an Exempt research project is a “chart review”, or an anonymous survey. APPENDIX A
Minimal risk means that the probability and magnitude of harm or
discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the
performance of routine physical or psychological examinations or tests.
Expedited - The Expedited category is used for certain kinds of
research involving no more than minimal risk and for minor changes in already approved research. An Expedited review is performed by the
IRB chair or a designated voting member rather than by the entire convened IRB. APPEDIX B
Full Board Review - Research involving greater than minimal risk must
be reviewed at a fully convened IRB meeting at which a quorum of IRB members is present. Biomedical research and some social/behavioral
research with vulnerable subjects, e.g. pregnant women, prisoners, or with children may require Full Board review. For the research to be
approved, it must receive the approval of a majority of IRB members.
UA College of Medicine, Phoenix Page 14
The HSPP staff will read the submitted research proposal on Form 200 or 207 and determine which level of review is needed. The only legally
authorized entity at UA that can determine what is or is not research (as defined in 45 C.F.R. §46.102 (2005)), for purposes of regulatory compliance
and human subjects protection, is the UA’s IRB or a person or persons designated by the UA IRB. Several of the UA Colleges in Tucson have
designated people within their departments that can make this determination. No other person, group, or department with UA IRB
designation, or entity has the legal authority to make such a determination.
Research that involves minimal risk to human subjects and meets certain regulatory guidelines may be exempt from additional review and such
exemptions are granted by the HSPP. Other research that also includes minimal risk to the subjects may, however, require an expedited review.
Expedited reviews include review by both HSPP staff and one or more IRB
members. Research that involves greater than minimal risk to the subjects and/or includes certain protected subjects such as prisoners may require full
review by the IRB. A summary of the levels of review for research proposals involving human subjects can be found on the Tucson HSPP website at:
http://orcr.vpr.arizona.edu. Once the IRB determines what type of review is needed the proposal is sent on to the parties who will conduct the review.
The Principal Investigator will be notified of the type of review to be conducted. Approximate time frames for completion of reviews, depending
on the level of review can be gotten from the IRB website, which lists the dates of meetings of the IRB.
How is the Principal Investigator notified of the Results of an IRB Review?
The review is conducted according to the requirements set forth in relevant
federal and state laws and UA Policies, Procedures, and Guidance for Human Subjects Research. The reviewer, or the entire IRB if a full board review, will
consider the features of the proposed study and whether they meet the federal requirements. In some cases, a reviewer may request additional
information prior to completing the review. When necessary, the HSPP will contact the Principal Investigator who will contact the research team to
request specific information about the research proposal; the Principal Investigator is responsible for obtaining the requested information and
submitting it to the HSPP in order for the review to be completed.
After the level of review has been determined (i.e., Not Human Subject Research, Exempt, Expedited, or Full Board) and the review process has
been completed, there are three types of decisions that can result. The HSPP
UA College of Medicine, Phoenix Page 15
staff will notify the Principal Investigator who will notify the research team of
the results of the review. The three potential decisions are:
Approved as Written Approved with Conditions
Not Approved
If a proposal is approved as written, then the Principal Investigator can notify the research team of the decision. The research can begin according
to the planned time frame if the research is being conducted at the University of Arizona.
If the research is to be conducted at an external institution the approval of
that external institution’s IRB must be followed by the Principal Investigator and the research team applying for a deferral from the UA IRB. This is done
by completing either Form 200 or 207 (discussed above) and submitting
with all the requested documents. Research can only begin when the UA IRB provides a deferral approval.
Approvals are given for no more than 12 month time periods. If a proposal is
approved with conditions, then the research can begin only after the stated conditions are met. If a proposal is not approved, then none of the research
can be conducted. In such cases, the Principal Investigator should meet with the research team and discuss revising the proposal to meet IRB
requirements. If the Principal Investigator and research team decide to re-submit a proposal, the process would include the same steps as the initial
research proposal.
Can my Research Begin?
Only after a proposal has been approved by the IRB can a research project
begin. Research initiated prior to IRB approval is subject to potential termination by the IRB. Any data collected before or after the time period
approved by the IRB is subject to potential confiscation by the IRB. Both the Principal Investigator and research team, who engage in research activities
that have not been approved by the IRB, are subject to applicable UA and/or federal penalties.
The steps in the IRB review process for human subject research are depicted
in a flow chart, Figure 1.
UA College of Medicine, Phoenix Page 16
What IRB Forms Must I be Familiar with at UA or UA COM-P?
Faculty and medical students should be aware that there are a number of different forms that the IRB uses for research proposal submissions. Use
either Form 200 or 207 for initial application. If your project has been approved by the UA IRB (Tucson) as an expedited or full board review you
will be required to submit a continuing review progress report before that one year. Failure to submit that continuing review on time will immediately
terminate the project which means you may not collect any additional information. If more data is to be collected you will have to resubmit Form
200 or 207 just as if this is a new application.
The Principal Investigator will be notified that a continuing review is required. It is the responsibility of the Principal Investigator to submit this
at least 45 days prior to the due date to ensure continuance of the project.
Below are the names of important IRB forms that investigators interested in
submitting an application to the Tucson IRB will need. These forms can be obtained directly from the RAO web site: www.orca.vpr.arizona.edu/irb
Application for Human Research – Form 200
Application for COM-Phoenix Scholarly Project – Form 207 Continuing Review Progress Report – Form 212
Modification of Approved Human Research – Form 213
How does Health Insurance Portability and Accountability Act
Regulations (HIPAA) and Personal Health Information (PHI) and the IRB Interface?
PHI (Protected Health Information) means individually identifiable health information that is created or received by a health care provider, health
plan, employer, or health care clearinghouse and that relates to the mental
or physical health of the Individual, the provision of health care to the Individual, or payment for the provision of health care to the Individual.
In order to be de-identified, health information must be stripped of all of the
following elements: 1. Names;
2. Social Security numbers; 3. Telephone numbers;
4. All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent
geocodes, except for the initial three digits of a zip code, if, according to the current publicly available data from the Bureau of the Census:
UA College of Medicine, Phoenix Page 17
a. The geographic unit formed by combining all zip codes with the
same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic
units containing 20,000 or fewer people is changed to 000; 5. All elements of dates (except year) for dates directly related to an
individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year)
indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
6. Fax numbers; 7. Electronic mail addresses;
8. Medical record numbers; 9. Health plan beneficiary numbers;
10. Account numbers; 11. Certificate/license numbers;
12. Vehicle identifiers and serial numbers, including license plate
numbers; 13. Device identifiers and serial numbers;
14. Web Universal Resource Locators (URLs); 15. Internet Protocol (IP) address numbers;
16. Biometric identifiers, including finger and voice prints; 17. Full face photographic images and any comparable images; and
18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to
code the research data) A limited data set is described as health information that excludes the direct identifiers listed above, except
that may include city; state; ZIP Code; elements of date; and other numbers, characteristics, or codes not listed as direct identifiers. A
data use agreement is needed to obtain satisfactory assurances that the recipient of the limited data set will use or disclose the PHI in the
data set only for specified purposes.
How is HIPAA Privacy and the IRB Related? The Privacy Rule, at 45 CFR parts 160 and 164, establishes a category of
health information, defined as protected health information (PHI), which a covered entity may only use or disclose to others in certain circumstances
and under certain conditions. In general, the Privacy Rule requires an individual to provide signed permission, known as an Authorization under
section 164.508 of the Privacy Rule, before a covered entity can use or disclose the individual's PHI for research purposes. Under certain
circumstances, however, the Privacy Rule permits a covered entity to use or disclose PHI for research without an individual's Authorization. One way a
covered entity can use or disclose PHI for research without an Authorization
UA College of Medicine, Phoenix Page 18
is by obtaining proper documentation of a Waiver of Authorization
requirement that is granted by the institution’s IRB or a new type of review committee called a Privacy Board.
To approve research, the IRB must determine that, where appropriate, there
are adequate provisions to protect the privacy interests of potential or current participants, from the screening and recruitment through all phases
of research. If the protocol does not include adequate provisions to protect the privacy interests of the participants, the IRB may not approve the
protocol as written.
The Principal Investigator must describe in the Protocol Application the provisions for protecting the privacy of participants during screening, data
collection and other interactions. The IRB assesses the information during the review process and at convened meetings. As necessary, the IRB will
ask for additional details during its review. Provisions for protecting the
privacy interests of participants or participants should include: 1. Ensuring that the conditions under which information will be collected
(e.g., physical locations, telephone contact, mail or email solicitations) afford protections against interactions with participants being
witnessed, overheard or inadvertently intercepted or viewed. For example, a potential or current participant may feel uncomfortable:
a. Being seen entering a place that they feel might stigmatize them, such as a pregnancy counseling center;
b. Having physical measurements recorded in a non-private setting;
c. Discussing private medical information in a setting with other than a health care provider or in other than a private clinical
setting; d. Answering sensitive questions by telephone while at home or
work.
2. Limiting the information being collected to only the minimum amount of data necessary to accomplish the research purposes.
What is HIPAA/HITECH relation with IRB? The Health Information Technology for Economic and Clinical Health
(HITECH) Act, is designed to modify the HIPAA Privacy, Security, and Enforcement Rules in order to strengthen the privacy and security
protections for health information.
The proposed modifications to the HIPAA Rules include provisions extending the applicability of certain Privacy and Security Rule requirements to the
business associates of covered entities. HITECH establishes new limitations
UA College of Medicine, Phoenix Page 19
on the use and disclosure of protected health information for marketing and
fundraising purposes, prohibiting the sale of protected health information, and expanding individuals’ rights to access their information and to obtain
restrictions on certain disclosures of protected health information to health plans. In addition, the proposed rule adopts provisions designed to
strengthen and expand HIPAA’s enforcement provisions.
The HITECH Act is committed to the cause of seeing that healthcare facilities and practitioners adopting electronic health records (EHR) methodologies do
so within the realm of the HIPAA Privacy Rule regulations aimed at maintaining the sanctity of PHI. The following are regulations are denoted
under the HITECT Act:
1. Defining Penalties imposed on healthcare professionals found guilty of Privacy Rule violations.
2. Ensuring that access to medical data in the form of Electronic Health
Records becomes a national standard for storing/accessing patient information.
3. Laying down accountability clauses and defining penalties incurred on HIPAA-violating Business Associates.
4. Introduction of strict standards like the need to issue Notifications for PHI breaches wherein informing the concerned patient whose PHI has
been compromised is stressed upon.
It is the role of the IRB that each proposal under review contains provisions that ensure protection of PHI maintained with EHR.
What is Informed Consent and How is This Related to the IRB? Obtaining written informed consent from a potential participant is more than
just a signature on a form.
The consent document is to be used as a guide for the verbal explanation of the study.
The consent document should be the basis for a meaningful exchange between the researcher and the participant.
The participant's signature provides documentation of agreement to participate in a study, but is only one part of the consent process.
The consent document must not serve as a substitute for discussion.
The entire informed consent process involves giving a participant the following:
1. adequate information concerning the study,
UA College of Medicine, Phoenix Page 20
2. providing adequate opportunity for the participant to consider all
options, responding to the participant's questions, ensuring that the participant has comprehended this information,
3. obtaining the participant's voluntary agreement to participate, and continuing to provide information as the participant or situation
requires.
To be effective, the process should provide ample opportunity for the researcher and the participant to exchange information and ask questions.
In seeking informed consent, the following information must be provided to each subject:
1. A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject's
participation, a description of the procedures to be followed, and identification of any products which are experimental.
2. A description of any reasonably foreseeable risks or discomforts to the
subject. 3. A description of any benefits to the subject or to others which may
reasonably be expected from the research. 4. A disclosure of appropriate alternative procedures or courses of
treatment, if any, that might be advantageous to the subject. 5. A statement describing the extent, if any, to which confidentiality of
records identifying the subject will be maintained and that notes the possibility that external regulatory agencies, such as the Food and
Drug Administration, may inspect the records. 6. For research involving more than minimal risk, an explanation as to
whether any compensation and/or medical treatments are available if injury occurs and, if so, what they consist of, or where further
information may be obtained. 7. A statement that participation is voluntary, that refusal to participate
will involve no penalty or loss of benefits to which the subject is
otherwise entitled, and that the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is
otherwise entitled.
Additional elements may include: 1. A statement that the particular treatment or procedure may involve
risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant) which are currently unforeseeable.
2. Anticipated circumstances under which the subject's participation may be terminated by the investigator without regard to the subject's
consent. 3. Any additional costs to the subject that may result from participation
in the research.
UA College of Medicine, Phoenix Page 21
4. The consequences of a subject's decision to withdraw from the
research and procedures for orderly termination of participation by the subject.
5. A statement that significant new findings developed during the course of the research which may relate to the subject's willingness to
continue participation will be provided to the subject. 6. The approximate number of subjects involved in the study.
It is the responsibility of the IRB to see that all these elements are included
within the consent form and that the language is appropriate for the patients being consented. It is always recommended that the consent form be in the
primary language of the human subject or that an official interpreter be present.
What is a Waiver or Alteration of Authorization and the IRB?
In order to access PHI under a waiver or alteration of authorization for research, the IRB must determine that the following criteria are met:
1. Use or disclosure involves no more than minimal risk to privacy for the individual based on:
a. a plan to protect patient identifiers from improper use and disclosure;
b. a plan to destroy patient identifiers at the earliest opportunity, and
c. adequate written assurances that protected health information will not be reused or disclosed to others except as required by
Law, for oversight of the research, or for other research that would be permitted by HIPAA.
2. The research could not practicably be conducted without the waiver; 3. The research could not practicably be conducted without access to
protected health information; and
4. A brief description of the PHI necessary to do the research (i.e., minimum necessary); and
5. The privacy risks are reasonable in relation to the anticipated benefits to the individuals and the importance of knowledge gained through
research.
What is a Waiver of Authorization?
Obtaining an authorization may not be practicable for some types of research. In these cases, HIPAA allows the IRB to grant a waiver of
authorization. The Waiver of Authorization can be granted for the entire study (i.e., retrospective chart reviews). Additionally, a Waiver of
Authorization (for Recruitment) may be granted to cover solely the
UA College of Medicine, Phoenix Page 22
recruitment activities, but an authorization would be required when the
participant is enrolled.
What is an Alteration of Authorization and How is This Different
From a Waiver of Authorization? Under certain circumstances, the IRB may approve a request to omit one or
more of the required elements of authorization, for example, waiving the requirement to obtain a signature and date on HIPAA authorization when
conducting research by phone or via the Internet. While one element may be omitted all other elements must be included within the authorization.
What is a Data Use Agreement and How is This Connected With the IRB?
A Data Use Agreement (DUA) is a contractual document used for the
transfer of data that has been developed by nonprofit, government or private industry, where the data is nonpublic or is otherwise subject to some
restrictions on its use. Often these data are a necessary component of a research project, ie., a clinical trial, or a limited data set information as
defined in HIPAA.
The Privacy Rule of HIPAA requires a DUA must do the following: Establish what the data will be used for.
Establish who is permitted to use or receive the limited data set. Provide that the limited data set recipient will:
o Not use the information in a matter inconsistent with the DUA or other laws.
o Employ safeguards to ensure that this does not happen. o Report to the covered entity any use of the information that was
not stipulated in the DUA.
o Ensure that any other parties, including subcontractors, agree to the same conditions as the limited data set recipient in the DUA.
o Not identify the information or contact the individuals themselves.
How is Confidentiality of Participant Information and the IRB Related?
As a condition of protocol approval, the IRB determines that there are adequate provisions to protect confidentiality of information related to
potential or current participants, throughout the research, including data analysis and retention. Principal Investigators are expected to design
UA College of Medicine, Phoenix Page 23
studies to maximize confidentiality to avoid unintentional and unauthorized
release or other disclosures.
Can There be Additional Requirements?
Yes. Additional requirements might apply, depending on the source of support/funding (e.g., Department of Education (re: access to instructional
material used in a research or experimentation program), Department of Energy (such as a required checklist for DOE requirements), Department of
Justice: National Institute of Justice (NIJ) and research conducted with the Bureau of Prisons): see GUI-42 Other Federal Agencies - Additional
Requirements.
The Principal Investigator must describe the provisions to protect the confidentiality of data in the Protocol Application. The IRB assesses the
information provided in the application during the review process and at
convened meetings. As necessary, the IRB will ask for additional details during its review.
In reviewing confidentiality protections, the IRB considers the nature,
probability, and magnitude of harms that would be likely to result from an unauthorized release of the collected information. It evaluates the proposed
anonymizing techniques, (e.g., de-identification, coding), storage plans, access restrictions, data security methods (e.g., encryption) and other
relevant factors in making its final determination concerning the appropriateness and adequacy of confidentiality protections. For active
protocols, any changes in confidentiality protection measures must be described in either a modification of human research Form 213 or continuing
review Form 212.
What is a Certificates of Confidentiality (CoC) and its Relationship to the IRB?
Where a protocol involves the collection of some sensitive information (e.g., about illegal conduct), the IRB may determine that special steps are needed
to protect participants from the risks of external investigative or judicial processes (legally mandated release of information for use in federal, state,
or local civil, criminal, administrative, legislative, or other legal proceedings). In such situations, the IRB may require that the Principal Investigator obtain
a Department of Health and Human Services (DHHS) Certificate of Confidentiality (CoC) pursuant to Section 241(d) of Title 42 of the United
States Code. Funding through DHHS or other federal funding is not a requirement for obtaining a CoC.
UA College of Medicine, Phoenix Page 24
When the Principal Investigator obtains a CoC, the IRB requires that
participants be informed about the protections and limitations under the CoC, through the consent document or HIPAA authorization. The consent
document must explain if the investigators will release information under any anticipated mandatory reporting or for internal or external audit
purposes (e.g., University of Arizona internal audit, DHHS, or FDA). In order that a participant may weigh the risk of such release of information and not
expect more confidentiality protection than is actually provided by the CoC, the IRB requires that the possibility of release for those purposes be stated
clearly and explicitly in both the protocol and the consent form. The IRB also requires that any participant enrolled after expiration or termination of a CoC
be informed that its protection will not apply to them, and that issuance of a CoC is not an endorsement of the research by the DHHS.
UA College of Medicine, Phoenix Page 25
APPENDIX A
EXEMPTION CATEGORIES
The study is exempt based upon the following criteria:
1. Research conducted in established or commonly accepted educational settings, involving normal educational practices,
such as: a. research on regular and special education instructional
strategies, or b. research on the effectiveness of or the comparison among
instructional techniques, curricula, or classroom management methods.
2. Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures,
interview procedures or observation of public behavior, unless: a. information obtained is recorded in such a manner that human
subjects can be identified, directly or through identifiers linked to the subjects; and
b. any disclosure of the human subjects' responses outside the research could reasonably place the subjects at risk of criminal
or civil liability or be damaging to the subjects' financial standing, employability, or reputation.
3. Research involving the use of educational tests (cognitive,
diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior that is
not exempt under paragraph (b)(2) of this section, if:
a. the human subjects are elected or appointed public officials or candidates for public office; or
b. Federal statute(s) require(s) without exception that the confidentiality of the personally identifiable information will be
maintained throughout the research and thereafter.
4. Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic
specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner
that subjects cannot be identified, directly or through identifiers linked to the subjects.
UA College of Medicine, Phoenix Page 26
5. Research and demonstration projects which are conducted by
or subject to the approval of Department or Agency heads, and which are designed to study, evaluate, or otherwise examine:
a. Public benefit or service programs; b. procedures for obtaining benefits or services under those
programs; c. possible changes in or alternatives to those programs or
procedures; or d. possible changes in methods or levels of payment for benefits or
services under those programs.
6. Taste and food quality evaluation and consumer acceptance studies:
a. if wholesome foods without additives are consumed or b. if a food is consumed that contains a food ingredient at or below
the level and for a use found to be safe, or agricultural chemical
or environmental contaminant at or below the level found to be safe, by the Food and Drug Administration or approved by the
Environmental Protection Agency or the Food Safety and Inspection Service of the U.S. Department of Agriculture.
UA College of Medicine, Phoenix Page 27
APPENDIX B
Expedited Categories
45 CFR 46.110 Categories of Research That May Be Reviewed through an
Expedited Review Procedure
1) Clinical studies of drugs and medical devices only when condition (a)
or (b) is met. a) Research on drugs for which an investigational new drug application
(21 CFR Part 312) is not required. (Note: Research on marketed drugs that significantly increases the risks or decreases the acceptability of
the risks associated with the use of the product is not eligible for expedited review.)
b) Research on medical devices for which (i) an investigational device exemption application (21 CFR Part 812) is not required; or (ii) the
medical device is cleared/approved for marketing and the medical device is being used in accordance with its cleared/approved labeling.
2) Collection of blood samples by finger stick, heel stick, ear stick, or
venipuncture as follows: a) from healthy, nonpregnant adults who weigh at least 110 pounds. For
these subjects, the amounts drawn may not exceed 550 ml in an 8
week period and collection may not occur more frequently than 2 times per week; or b. from other adults and children, considering the
age, weight, and health of the subjects, the collection procedure, the amount of blood to be collected, and the frequency with which it will
be collected. For these subjects, the amount drawn may not exceed the lesser of 50 ml or 3 ml per kg in an 8 week period and collection
may not occur more frequently than 2 times per week.
3) Prospective collection of biological specimens for research purposes by noninvasive means.
Examples: o hair and nail clippings in a nondisfiguring manner;
o deciduous teeth at time of exfoliation or if routine patient care indicates a need for extraction;
o permanent teeth if routine patient care indicates a need for
extraction; o excreta and external secretions (including sweat);
o uncannulated saliva collected either in an unstimulated fashion or stimulated by chewing gumbase or wax or by applying a dilute
citric solution to the tongue; o placenta removed at delivery;
UA College of Medicine, Phoenix Page 28
o amniotic fluid obtained at the time of rupture of the membrane
prior to or during labor; o supra- and subgingival dental plaque and calculus, provided the
collection procedure is not more invasive than routine prophylactic scaling of the teeth and the process is accomplished
in accordance with accepted prophylactic techniques; mucosal and skin cells collected by buccal scraping or swab, skin swab, or
mouth washings; o sputum collected after saline mist nebulization.
4) Collection of data through noninvasive procedures (not involving general anesthesia or sedation) routinely employed in clinical
practice, excluding procedures involving x-rays or microwaves. Where medical devices are employed, they must be cleared/approved for
marketing. (Studies intended to evaluate the safety and effectiveness of the medical device are not generally eligible for expedited review,
including studies of cleared medical devices for new indications.)
Examples: o physical sensors that are applied either to the surface of the
body or at a distance and do not involve input of significant amounts of energy into the subject or an invasion of the
subject's privacy; o weighing or testing sensory acuity;
o magnetic resonance imaging; o electrocardiography, electroencephalography, thermography,
detection of naturally occurring radioactivity, electroretinography, ultrasound, diagnostic infrared imaging,
doppler blood flow, and echocardiography; o moderate exercise, muscular strength testing, body composition
assessment, and flexibility testing where appropriate given the age, weight, and health of the individual.
5) Research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for
nonresearch purposes (such as medical treatment or diagnosis). (NOTE: Some research in this category may be exempt from the HHS
regulations for the protection of human subjects. 45 CFR 46.101(b)(4). This listing refers only to research that is not exempt.)
6) Collection of data from voice, video, digital, or image recordings
made for research purposes.
7) Research on individual or group characteristics or behavior (including, but not limited to, research on perception, cognition,
motivation, identity, language, communication, cultural beliefs or
UA College of Medicine, Phoenix Page 29
practices, and social behavior) or research employing survey,
interview, oral history, focus group, program evaluation, human factors evaluation, or quality assurance methodologies. (NOTE:
Some research in this category may be exempt from the HHS regulations for the protection of human subjects. 45 CFR 46.101(b)(2) and (b)(3).
This listing refers only to research that is not exempt.)
8) Continuing review of research previously approved by the convened IRB as follows:
a) Where; b) the research is permanently closed to the enrollment of new
subjects; c) all subjects have completed all research-related interventions;
and the research remains active only for long-term follow-up of subjects; or
d) where no subjects have been enrolled and no additional risks
have been identified; or e) where the remaining research activities are limited to data analysis.
9) Continuing review of research, not conducted under an investigational
new drug application or investigational device exemption where categories two (2) through eight (8) do not apply but the IRB has
determined and documented at a convened meeting that the research involves no greater than minimal risk and no additional risks have
been identified.
UA College of Medicine, Phoenix Page 30
IRB Process for Research Conducted at
UA College of Medicine-Phoenix
Bring protocol
To Research
Administration
Office
Determine if your
project is “research”
STEP 1
Does project
involve
Human
Subjects?
STEP 2
No IRB
review
needed -
you are
done
No
Yes
Determine
which review
process is
required
Exempt - your letter means
no further interactions
with IRB unless there is
a change in the protocol
Expedited – requires a
continuing review within
one year – failure to submit
will terminate the study
Full Board Review –
approval is for one year – a
continuing review will be
required – failure to submit
will terminate the study
No
Principal Investigator
is informed of the IRB
decision – approval
means research can
proceed with letter
STEP 3
Yes
Figure 1
UA College of Medicine, Phoenix Page 31
Figure 2
Reviewed by IRB designee
and Res. Admin. Ofc. staff
Correspondence
is prepared for PI
Reviewed by IRB designee
and Res. Admi. Ofc. staff Correspondence
is prepared for PI
Reviewed at
IRB meeting
Exempt?
Expedited?
Full
Board
NO
NO
Yes
Yes
Yes
IRB
application
to Research
Administration
Office
Determine
type of
review
required IRB PROCESS
Disapprove Correspondence
is prepared for PI.
Yes No
Defer approval Correspondence
is prepared.
Investigator
responds to
issues.
Yes
No
Correspondence is prepared for PI.
Protocol is placed in active file. Full approval
Contingent
approval
Correspondence
is prepared.
Investigator
responds to
contingencies.
Response
is reviewed
Yes
Yes
No
UA College of Medicine, Phoenix Page 32
IRB Process if Research is Conducted at an External
Institution – Requires a Deferral from the UA COM-P
External IRB
Research Approval
Proceed to RAO
with Form 207
and supporting
documents
Application is sent to Tucson
Office for Responsible
Conduct of Research
Application is Reviewed
A Deferral to the IRB of
Record is sent in letter form
To Principal Investigator
Research may
Begin when
Deferral is
received Figure 3
top related