research compliance -...

IRB 101:

An Investigator Handbook

Research Administration Office

UA College of Medicine, Phoenix

TABLE OF CONTENTS

Introduction………………………………………………………………………………………. Page 4

University of Arizona Policies…………………………………………………………... Page 4

What is the Basis for the Ethical and Regulatory Compliance that is Mandated for Human Subject Research?.................................... Page 5

Education and Training for Protection of Human Subjects…………….. Page 6

What is the Purpose of the IRB?............................................... Page 7

What are the Facts Often Misunderstood about the IRB?.............. Page 7

What Functions does the IRB Perform?...................................... Page 8

Who serves on the IRB? Can I Become and IRB Member?............ Page 10

When Must the University of Arizona Institutional Review Board (IRB) Review a project that is not conducted at a UA Facility?....... Page 11

What are the Steps I Must Take to Prepare for IRB Review? ……….. Page 11

What is the IRB Review Process?.............................................. Page 13

How is the Principal Investigator notified of the Results of an IRB

Review?................................................................................ Page 14

Can my Research Begin?......................................................... Page 15

What IRB Forms Must I be Familiar with at UA or UA COM-P?....... Page 16

How does Health Insurance Portability and Accountability Act

Regulations (HIPAA) and Personal Health Information (PHI) and the IRB Interface?................................................................. Page 16

How is HIPAA Privacy and the IRB Related?............................... Page 17

What is HIPAA/HITECH relation with IRB?................................. Page 18

What is Informed Consent and How is This Related to the IRB?.... Page 19

What is a Waiver or Alteration of Authorization and the IRB?....... Page 21


What is a Waiver of Authorization?.......................................... Page 21

. What is an Alteration of Authorization and How is This Different

From a Waiver of Authorization?.............................................. Page 22

What is a Data Use Agreement and How is This Connected With the IRB?....................................................................... Page 22

How is Confidentiality of Participant Information and the IRB

Related?.............................................................................. Page 22

Can There be Additional Requirements?................................... Page 23

What is a Certificates of Confidentiality (CoC) and its Relationship to the IRB?........................................................ Page 23

APPENDIX A – Exemption Categories………………………………………….. Page 25

APPENDIX B – Expedited Categories……………………………………….……. Page 27

Figure 1. IRB Process for Research Conducted at UA College of Medicine-Phoenix……………………………………………………………….……… Page 30

Figure 2. IRB Process……………………………………………………………….….. Page 31

Figure 3. IRB Process if Research is Conducted at an External

Institution – Requires a Deferral from the UA COM-P…………….…… Page 32


Introduction

Research provides an opportunity to discover new knowledge in an area of

medicine or science that an individual is passionate about. Basic and clinical faculty, as well as medical and graduate students who are considering

careers in academic medicine must become familiar with the regulatory issues related to human subject participation.

This handbook will review the Federal, State and University of Arizona

regulations and policies necessary to assist an investigator with the compliance issues related to the use of human subject participation. It is

important that in order to conduct research involving human subjects

requires not only the Principal Investigator but includes all members of a research project to take part in a human subject education and training

program. Education and training in human subject protection is a federal requirement.

University of Arizona Policies The University of Arizona (UA) is committed to protecting the rights and

welfare of subjects in human research investigations. The UA holds a Federalwide Assurance (FWA) issued by the Office of Human Research

Protections (OHRP). This is a written agreement between the government and the UA in which it describes the jurisdiction, composition, policies and

methods of procedure for human subject research conducted at a UA facility.

The UA’s Human Subject Protection Program (HSPP) located in Tucson is a

comprehensive system to ensure the protection of the rights and welfare of subjects in Human Research. The HSPP involves all individuals in the

organization including those UA employees in Phoenix, key individuals and committees fulfilling their roles and responsibilities as described in this

handbook.

The UA’s plan is to comply with all ethical and legal requirements for the conduct and oversight of Human Research. The President of the University of

Arizona has designated the University of Arizona’s Institutional Review Board (IRB) in Tucson as the independent review committee charged with the

protection of human research subjects. Therefore, any research conducted in Phoenix on the UA COM-P property involving human subjects must be

submitted to the Phoenix, Research Administration Office (RAO) Figure 1. The RAO will review the application for completeness before forwarding to

UA’s HSPP located at 1618 E. Helen Street Tucson, Arizona were it will be

evaluated and, if necessary, reviewed by the Institutional Review Board (IRB) Figure 2. Research involving human subjects can only begin if the


research is approved or exempt and the Principal Investigator has received a

written letter stating approval or exemption. In some cases the research may be considered non-human research. To determine whether a project is

considered non-human research an investigator can fill out Form 309 to assist the RAO with this decision. If the research is not subject to IRB

review the form 309 is signed and filed with the research protocol. The research project can commence only when this determination is made.

If one of our UA faculty members, medical or graduate students is engaged

in human research at an institution that is not part of the UA, the IRB located at that institution must review the research protocol. If that

institution’s IRB approves of the research, the UA faculty member, medical or graduate student must submit the IRB approval letter from that institution

along with the protocol to the Phoenix, RAO. The RAO will review the documents for completeness and send them to the Tucson HSPP for a

deferral, Figure 3. This requires the use of the UA Form 200 or 207. This

means that the oversight of the research remains with the Institution’s IRB where the research is taking place. Therefore, all communication regarding

the research project (ie., an amendment, continuing review, adverse event) must be conducted with that Institution’s IRB and not the Tucson UA IRB.

What is the Basis for the Ethical and Regulatory Compliance that is Mandated for Human Subject Research?

The principles mandating regulatory compliance concerning human subject research began with the Nuremberg Code, the Declaration of Helsinki and

the Belmont Report. Each of these documents defined the minimum codes/rules for conducting research with human beings. Recognition of the

need for guidelines dealing with human subjects in research emerged following the Nuremberg trials, where the medical experimentation abuses of

World War II Nazi doctors came to public attention. This led to the creation

of the Nuremberg Code in 1945, the first legal attempt to deal with ethical issues of modern research. As biomedical research efforts expanded, the

need for a more specific international code of ethics was formulated in the 1964 Declaration of Helsinki. In 1974 the United States Congress passed the

National Research Act, creating the National Commission for the Protection of Human Subjects in Biomedical and Behavioral Research. This commission

set the definitive standards of the Institutional Review board (IRB). In 1979 the National Commission published recommendations known as the Belmont

Report.

The Belmont Report outlines three general ethical principles that must govern human subjects’ research. They are:


Beneficence: To maximize benefits for science, humanity, and research

participants and to avoid or minimize risk or harm.

Respect: To protect the autonomy and privacy rights of participants.

Justice: To ensure the fair distribution among persons and groups of the costs and benefits of research.

These regulations, which set standards for review of human research

activities by IRBs, now apply to all activities involving human subjects within the University of Arizona.

Education and Training for Protection of Human Subjects As part of the agreement that the university has with the government all

personnel who participate in collecting or handling data from human subjects

as a systematic investigation must complete approved human subject training. While the National Institutes of Health (NIH) has an online training

program that students and faculty can take, the UA COM-P requires that all faculty and medical students engaged in human subjects research take the

CITI training as part of the required education in human subject protection. The website can be accessed from any computer with web access. The

website is http://www.citiprogram.org. One needs to register then login and look for the UA College of Medicine-Phoenix in the drop-down menu. Do not

select the University of Arizona – that is the Tucson site). You are required to take the following modules:

1. Biomedical Research Investigators: Basic Course

2. Health Information Privacy and Security 3. Bloodborne Pathogens – medical students only

When you have completed the modules you will be aware of the historical, social, and legal components of human subjects’ protection. A cumulative

passing grade of 80% is required. Upon completion of the modules the RAO will receive notice of completion that will allow us to track your training to

ensure compliance. You should print a copy of the completion certificate verifying the training for your files as you will be required to supply this

document with any human subject investigation. On the UA COM-P you will be required to take a refresher course in the fourth year following the initial

training. It is also important to understand that if a research project is conducted in another institution you may be required to take their training

as well as the training required by UA COM-P.

http://www.citiprogram.org/


What is the Purpose of the IRB? UA COM-P encourages and supports the scholarly activity of faculty, staff

and students. Scholarly activity often involves the use of human subjects for data collection and analysis. The University of Arizona IRB serves as the

University’s “protective eye” to ensure:

that the rights and welfare of human subjects are protected; that risks have been considered and minimized;

that the potential for benefit has been identified and maximized; that all human subjects only volunteer to participate in research after

being provided with legally effective informed consent; and that any research is conducted in an ethical manner and in compliance

with established standards, including handling all private information with confidentiality.

What are the Facts Often Misunderstood about the IRB?

1. Federal regulations for research involving human subjects is not limited to just drug or medical studies. There is sometimes a

misconception that if the subject is not undergoing medical procedures, the project is not covered by the regulations. Any project

where data on a human subject is obtained through intervention with, manipulation of, interviewing, communicating with, or observing

human subjects for the purposes of gathering data must be approved by the IRB, including the distribution of surveys for research purposes.

2. Certain types of projects are exempt from full IRB review. This does

not mean that these projects may be conducted without submitting them to the IRB for approval. An exempt protocol still requires IRB

approval. Exemption from IRB review must be documented. Many

journals now require proof of IRB review or exemption before accepting manuscript submissions. The explanation of projects which

may qualify for exempt status can be found in the APPENDIX A of this manual.

3. Vulnerable populations include: children, minors, prisoners, the

mentally impaired, inmates of mental institutions, the competency-impaired aged, the economically and educationally disadvantaged, or

any other person whose judgment when consenting to participation may be impaired. Research involving vulnerable subjects is never

exempt from IRB review and approval.


4. In Arizona a minor is an unmarried person who has not reached the

age of 18. Please note that this is a departure from a few states, such as Alabama where the age is 19. A person under age may not sign a

consent form to participate in research. A parent or guardian must give this consent. A child over the age of 10 who may reasonably

understand the nature, risks and benefits of the research may assent to participate, but this must still be confirmed by parental/guardian

consent.

5. IRB approval, or a letter of exemption, must be obtained before a project is started. This means you may not collect any data but you

can conduct a literature search.

6. The regulations regarding the content of any solicitation for subjects (advertisements, notices in newspapers, flyers, etc.) are explicit. All

advertisements and methods of recruitment must all be approved by

the IRB. If the research project is sponsored by a pharmaceutical any marketing most often requires the approval of that sponsor as well as

the IRB.

7. Risk to a subject is not limited to physical harm. Emotional, psychological, social, or financial damage is also possible and should

be considered.

What Functions does the IRB Perform?

The IRB is authorized to review, approve, require modifications in, or disapprove human subjects research activities conducted by or through the

University of Arizona. Information that is important to know about when conducting human research.

1. The Federal interpretation of what is “human subjects’ research” is expanding while compliance enforcement is tightening. Any individual

(inside or outside the university) who desires to conduct any systematic investigation that involves obtaining any information about

University of Arizona’s individuals (administrators, faculty, staff, or students) must obtain official University of Arizona IRB clearance.

2. Individuals seeking to conduct research may not solicit subject

participation or begin data collection until they have obtained clearance by the IRB of the institution they are conducting the

research at. If the study is conducted at UA COM-P the University of Arizona’s IRB (Tucson) must approve. If the research is conducted at

an institution other than the UA COM-P the IRB of that institution will


review the project and provide a decision. If the external institution

provides an approval the faculty member, medical or graduate student must file a Form 200 or 207 with the RAO Building 1, and Room 1272.

The staff will review the application before forwarding the document to the Tucson office. The Tucson office will review the application and

defer to the IRB of the institution where the research is being conducted. However, in research involving high risk the UA IRB

(Tucson) may want to review the application by a formal review process rather than defer. No research can begin until the UA

approval or deferral is received by the Principal Investigator in letter form.

3. The University of Arizona faculty medical or graduate student who

wishes to submit an application for Federal grant funds must have an IRB process in place to assure that proposals submitted are compliant

with Federal human subjects’ regulations.

4. More journals are requesting proof of IRB clearance as a condition of

publishing articles.

5. Human subjects’ research is a compliance matter. The IRB evaluates the risk to human subjects and must determine if the human subject

receives sufficient information to make an informed decision about participation in the study.

6. While it is true that the IRB process adds steps to the development of

research ideas, going through the process facilitates thorough planning.

In situations where a faculty member or student joins a research project

after it has already been reviewed by an institution’s IRB and that faculty

member or student will have direct interaction or intervention with patients in this study the Principal Investigator will need to submit an amendment to

the IRB of record listing the addition of the faculty member medical or graduate student as a new associate with supporting documentation as to

the training of that individual. All researchers must complete appropriate NIH human subjects training although most universities are now going to

CITI training as the first line of education for human subject research. This is generally followed by additional education in the form of lectures,

seminars, and workshops. Copies of the completed/updated training certificate(s) are required from the all individuals participating in the

investigation as well as any documentation that may be required by the non-university institution. A Principal Investigator’s CV is required and kept with

each individual research protocol application. Therefore, an updated CV of


the Principal Investigator may be requested when submitting an amendment

at some later date. Generally a CV is required only of the Principal Investigator although the IRB can request CV’s on any member of the team

to determine their expertise for their part of the investigation. Different institutions will have different requirements. Faculty and students

conducting research at institutions that are not UA facilities should seek information from the Research Administration Office of that institution as to

their requirements.

Who serves on the IRB? Can I Become and IRB Member?

The IRB is composed of at least 5 members with varying backgrounds to promote complete and adequate review of research activities commonly

conducted at an institution. The membership includes individuals with the necessary experience and expertise and knowledge of the local research

context to review the scope of biomedical and behavioral research

conducted. Members include both men and women and members of minority groups. Designated alternates may be used. The membership

includes: Physicians;

Scientists; Nurses;

Pharmacists; Federal regulations require at least one of these five members be

unaffiliated with the institution. This person cannot be a part of the immediate family of a person who is affiliated with the institution; and

At least one member whose primary concerns are in nonscientific areas, such as lawyers, ethicists, and clergy.

Most IRBs have some twenty or more members to ensure the breath of

expertise needed in reviewing the human subject research protocols. The

membership roster and IRB registration information are updated as needed when membership changes. The revised IRB registration is submitted to the

Office for Human Research Protections (OHRP) as required by the institution’s FWA.

The membership of the IRB is reviewed at least annually to determine if the

membership includes individuals with varying backgrounds and the experience and expertise needed to review the scope of biomedical and

behavioral research conducted as well as other competencies necessary to interpret regulations, relevant law, ethical conduct, risk:benefit and

volunteerism.


Faculty, medical and graduate students can become a member of the IRB.

However, this is a time consuming role and therefore most institutions who wish to make the IRB a part of medical education have a three month

rotation that students participate in as an observer. The students are given protocols under IRB review and asked to evaluate them against a checklist.

Their opinion will be solicited as regards the ethics or appropriateness of the study.

When Must the University of Arizona Institutional Review Board (IRB) Review a project that is not conducted at a UA Facility?

University of Arizona (UA) has assured the Federal government that it will comply with the Department of Health and Human Services (DHHS)

regulations for the protection of research participants, 45 CFR 46. UA has agreed that research activities involving human participants, regardless of

sponsorship, will be reviewed by the UAs IRB when one or more of the

following apply: the research is sponsored by this University of Arizona, or

the research is conducted by or under the direction of any employee or agent of this University of Arizona in connection with his or her

institutional responsibilities, or the research is conducted by or under the direction of any employee or

agent of this University of Arizona using any property or facility of this institution, or

the research involves the use of University of Arizona’s non-public information to identify or contact human research participants or

prospective participants.

What are the Steps I Must Take to Prepare for IRB Review?

1. Complete the online training program described above.

(www.citiprogram.org).

2. Complete Form 309 "Human Research Determination" if you are unsure whether your investigation/project requires IRB review. The

UA COM-P RAO staff will help with any questions.

3. If the RAO determines your Investigation/project is human research that requires IRB review you will need to:

a. Determine the site/institution where the research will take place. b. Determine if an external institution has an IRB.

i. If this institution does not have an IRB the UA COM-P will accept the Western Institutional Review Board’s (WIRB)

review.

http://www.citiprogram.org/


ii. External Institutional IRB – go to their IRB office (generally

referred to as Research Administration) and request an application. Determine what documents are required in

addition to the protocol when submitting to the IRB.

4. The UA COM-P, RAO staff will assist you in filling out the application if necessary.

5. Complete the application and be sure to include in the application any

and all necessary supporting documents required such as: a. Human subject training

b. Protocol for human subject research c. Informed consent if applicable

d. Funding source if applicable e. Research instruments such as:

i. Copy of any survey, questionnaire, and/or interview

questions that are to be used. ii. Published materials can be incorporated by providing a full

citation to the materials. iii. Graphical and verbal stimuli, if not completely described on

the IRB application form, should be attached or a complete citation provided.

f. Debriefing – if applicable. Whenever deception is involved as part of the research or information is withheld from a participant

prior to or during the research, this information must be disclosed to the participant at the close of the research either

verbally or in writing. A copy of this statement must be attached and fully describe the process to be used in the protocol.

g. Advertisements - If participants will be obtained through advertisements, attach a copy of the ad.

h. Certificates of Confidentiality - When data are being collected

about sensitive issues (such as illegal behavior, or alcohol or drug use), the Principal Investigator/mentor may consider

applying for a Certificate of Confidentiality. http://grants.nih.gov/grants/policy/coc/background.htm.

i. Under Federal law, researchers can obtain an advance grant of confidentiality that will provide protections against a subpoena

for research data [Public Health Service Act 30l(d)]. Protection will be granted sparingly and only when the research is of a

sensitive nature and where the protection is judged necessary to achieve the research objectives.

6. The research proposal and IRB forms should be submitted in both hard

copy and electronic (e-mail) format to the RAO.

http://grants.nih.gov/grants/policy/coc/background.htm


What is the IRB Review Process?

As soon as a research proposal is submitted to an Tucson HSPP office, it is assigned a protocol number. Each submission is referred to as a “protocol”

and the HSPP staff will refer to the protocol number when communicating about the submission. The protocol number helps HSPP keep track of

submission(s) related to the protocol and communicate about them without revealing confidential information during the review process. Once the

protocol is assigned a number by the HSPP, a determination will be made as to the appropriate type of review to be conducted. Consistent with U.S. legal

standards regarding IRB reviews, the HSPP will first determine if the proposed activities constitute research as defined by federal regulations. If

the proposed activities do not fit the criteria for research, the HSPP will issue a formal letter to the Principal Investigator/ mentor who will inform the

Principal Investigator indicating that the proposal needs no review by the

IRB. If the proposal fits the criteria for research activities, there are three levels of review that can be conducted for an initial research proposal. These

are:

Exempt - Certain kinds of research involving minimal risk or less than minimal risk may be “exempt” from continuing IRB review when the

activities fall into one or more of the Exempt categories of research. Investigators must submit proposed exempt research to the IRB for

exempt determination. An example of an Exempt research project is a “chart review”, or an anonymous survey. APPENDIX A

Minimal risk means that the probability and magnitude of harm or

discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the

performance of routine physical or psychological examinations or tests.

Expedited - The Expedited category is used for certain kinds of

research involving no more than minimal risk and for minor changes in already approved research. An Expedited review is performed by the

IRB chair or a designated voting member rather than by the entire convened IRB. APPEDIX B

Full Board Review - Research involving greater than minimal risk must

be reviewed at a fully convened IRB meeting at which a quorum of IRB members is present. Biomedical research and some social/behavioral

research with vulnerable subjects, e.g. pregnant women, prisoners, or with children may require Full Board review. For the research to be

approved, it must receive the approval of a majority of IRB members.


The HSPP staff will read the submitted research proposal on Form 200 or 207 and determine which level of review is needed. The only legally

authorized entity at UA that can determine what is or is not research (as defined in 45 C.F.R. §46.102 (2005)), for purposes of regulatory compliance

and human subjects protection, is the UA’s IRB or a person or persons designated by the UA IRB. Several of the UA Colleges in Tucson have

designated people within their departments that can make this determination. No other person, group, or department with UA IRB

designation, or entity has the legal authority to make such a determination.

Research that involves minimal risk to human subjects and meets certain regulatory guidelines may be exempt from additional review and such

exemptions are granted by the HSPP. Other research that also includes minimal risk to the subjects may, however, require an expedited review.

Expedited reviews include review by both HSPP staff and one or more IRB

members. Research that involves greater than minimal risk to the subjects and/or includes certain protected subjects such as prisoners may require full

review by the IRB. A summary of the levels of review for research proposals involving human subjects can be found on the Tucson HSPP website at:

http://orcr.vpr.arizona.edu. Once the IRB determines what type of review is needed the proposal is sent on to the parties who will conduct the review.

The Principal Investigator will be notified of the type of review to be conducted. Approximate time frames for completion of reviews, depending

on the level of review can be gotten from the IRB website, which lists the dates of meetings of the IRB.

How is the Principal Investigator notified of the Results of an IRB Review?

The review is conducted according to the requirements set forth in relevant

federal and state laws and UA Policies, Procedures, and Guidance for Human Subjects Research. The reviewer, or the entire IRB if a full board review, will

consider the features of the proposed study and whether they meet the federal requirements. In some cases, a reviewer may request additional

information prior to completing the review. When necessary, the HSPP will contact the Principal Investigator who will contact the research team to

request specific information about the research proposal; the Principal Investigator is responsible for obtaining the requested information and

submitting it to the HSPP in order for the review to be completed.

After the level of review has been determined (i.e., Not Human Subject Research, Exempt, Expedited, or Full Board) and the review process has

been completed, there are three types of decisions that can result. The HSPP

http://orcr.vpr.arizona.edu/


staff will notify the Principal Investigator who will notify the research team of

the results of the review. The three potential decisions are:

Approved as Written Approved with Conditions

Not Approved

If a proposal is approved as written, then the Principal Investigator can notify the research team of the decision. The research can begin according

to the planned time frame if the research is being conducted at the University of Arizona.

If the research is to be conducted at an external institution the approval of

that external institution’s IRB must be followed by the Principal Investigator and the research team applying for a deferral from the UA IRB. This is done

by completing either Form 200 or 207 (discussed above) and submitting

with all the requested documents. Research can only begin when the UA IRB provides a deferral approval.

Approvals are given for no more than 12 month time periods. If a proposal is

approved with conditions, then the research can begin only after the stated conditions are met. If a proposal is not approved, then none of the research

can be conducted. In such cases, the Principal Investigator should meet with the research team and discuss revising the proposal to meet IRB

requirements. If the Principal Investigator and research team decide to re-submit a proposal, the process would include the same steps as the initial

research proposal.

Can my Research Begin?

Only after a proposal has been approved by the IRB can a research project

begin. Research initiated prior to IRB approval is subject to potential termination by the IRB. Any data collected before or after the time period

approved by the IRB is subject to potential confiscation by the IRB. Both the Principal Investigator and research team, who engage in research activities

that have not been approved by the IRB, are subject to applicable UA and/or federal penalties.

The steps in the IRB review process for human subject research are depicted

in a flow chart, Figure 1.


What IRB Forms Must I be Familiar with at UA or UA COM-P?

Faculty and medical students should be aware that there are a number of different forms that the IRB uses for research proposal submissions. Use

either Form 200 or 207 for initial application. If your project has been approved by the UA IRB (Tucson) as an expedited or full board review you

will be required to submit a continuing review progress report before that one year. Failure to submit that continuing review on time will immediately

terminate the project which means you may not collect any additional information. If more data is to be collected you will have to resubmit Form

200 or 207 just as if this is a new application.

The Principal Investigator will be notified that a continuing review is required. It is the responsibility of the Principal Investigator to submit this

at least 45 days prior to the due date to ensure continuance of the project.

Below are the names of important IRB forms that investigators interested in

submitting an application to the Tucson IRB will need. These forms can be obtained directly from the RAO web site: www.orca.vpr.arizona.edu/irb

Application for Human Research – Form 200

Application for COM-Phoenix Scholarly Project – Form 207 Continuing Review Progress Report – Form 212

Modification of Approved Human Research – Form 213

How does Health Insurance Portability and Accountability Act

Regulations (HIPAA) and Personal Health Information (PHI) and the IRB Interface?

PHI (Protected Health Information) means individually identifiable health information that is created or received by a health care provider, health

plan, employer, or health care clearinghouse and that relates to the mental

or physical health of the Individual, the provision of health care to the Individual, or payment for the provision of health care to the Individual.

In order to be de-identified, health information must be stripped of all of the

following elements: 1. Names;

2. Social Security numbers; 3. Telephone numbers;

4. All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent

geocodes, except for the initial three digits of a zip code, if, according to the current publicly available data from the Bureau of the Census:

http://www.orca.vpr.arizona.edu/irb


a. The geographic unit formed by combining all zip codes with the

same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic

units containing 20,000 or fewer people is changed to 000; 5. All elements of dates (except year) for dates directly related to an

individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year)

indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

6. Fax numbers; 7. Electronic mail addresses;

8. Medical record numbers; 9. Health plan beneficiary numbers;

10. Account numbers; 11. Certificate/license numbers;

12. Vehicle identifiers and serial numbers, including license plate

numbers; 13. Device identifiers and serial numbers;

14. Web Universal Resource Locators (URLs); 15. Internet Protocol (IP) address numbers;

16. Biometric identifiers, including finger and voice prints; 17. Full face photographic images and any comparable images; and

18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to

code the research data) A limited data set is described as health information that excludes the direct identifiers listed above, except

that may include city; state; ZIP Code; elements of date; and other numbers, characteristics, or codes not listed as direct identifiers. A

data use agreement is needed to obtain satisfactory assurances that the recipient of the limited data set will use or disclose the PHI in the

data set only for specified purposes.

How is HIPAA Privacy and the IRB Related? The Privacy Rule, at 45 CFR parts 160 and 164, establishes a category of

health information, defined as protected health information (PHI), which a covered entity may only use or disclose to others in certain circumstances

and under certain conditions. In general, the Privacy Rule requires an individual to provide signed permission, known as an Authorization under

section 164.508 of the Privacy Rule, before a covered entity can use or disclose the individual's PHI for research purposes. Under certain

circumstances, however, the Privacy Rule permits a covered entity to use or disclose PHI for research without an individual's Authorization. One way a

covered entity can use or disclose PHI for research without an Authorization


is by obtaining proper documentation of a Waiver of Authorization

requirement that is granted by the institution’s IRB or a new type of review committee called a Privacy Board.

To approve research, the IRB must determine that, where appropriate, there

are adequate provisions to protect the privacy interests of potential or current participants, from the screening and recruitment through all phases

of research. If the protocol does not include adequate provisions to protect the privacy interests of the participants, the IRB may not approve the

protocol as written.

The Principal Investigator must describe in the Protocol Application the provisions for protecting the privacy of participants during screening, data

collection and other interactions. The IRB assesses the information during the review process and at convened meetings. As necessary, the IRB will

ask for additional details during its review. Provisions for protecting the

privacy interests of participants or participants should include: 1. Ensuring that the conditions under which information will be collected

(e.g., physical locations, telephone contact, mail or email solicitations) afford protections against interactions with participants being

witnessed, overheard or inadvertently intercepted or viewed. For example, a potential or current participant may feel uncomfortable:

a. Being seen entering a place that they feel might stigmatize them, such as a pregnancy counseling center;

b. Having physical measurements recorded in a non-private setting;

c. Discussing private medical information in a setting with other than a health care provider or in other than a private clinical

setting; d. Answering sensitive questions by telephone while at home or

work.

2. Limiting the information being collected to only the minimum amount of data necessary to accomplish the research purposes.

What is HIPAA/HITECH relation with IRB? The Health Information Technology for Economic and Clinical Health

(HITECH) Act, is designed to modify the HIPAA Privacy, Security, and Enforcement Rules in order to strengthen the privacy and security

protections for health information.

The proposed modifications to the HIPAA Rules include provisions extending the applicability of certain Privacy and Security Rule requirements to the

business associates of covered entities. HITECH establishes new limitations


on the use and disclosure of protected health information for marketing and

fundraising purposes, prohibiting the sale of protected health information, and expanding individuals’ rights to access their information and to obtain

restrictions on certain disclosures of protected health information to health plans. In addition, the proposed rule adopts provisions designed to

strengthen and expand HIPAA’s enforcement provisions.

The HITECH Act is committed to the cause of seeing that healthcare facilities and practitioners adopting electronic health records (EHR) methodologies do

so within the realm of the HIPAA Privacy Rule regulations aimed at maintaining the sanctity of PHI. The following are regulations are denoted

under the HITECT Act:

1. Defining Penalties imposed on healthcare professionals found guilty of Privacy Rule violations.

2. Ensuring that access to medical data in the form of Electronic Health

Records becomes a national standard for storing/accessing patient information.

3. Laying down accountability clauses and defining penalties incurred on HIPAA-violating Business Associates.

4. Introduction of strict standards like the need to issue Notifications for PHI breaches wherein informing the concerned patient whose PHI has

been compromised is stressed upon.

It is the role of the IRB that each proposal under review contains provisions that ensure protection of PHI maintained with EHR.

What is Informed Consent and How is This Related to the IRB? Obtaining written informed consent from a potential participant is more than

just a signature on a form.

The consent document is to be used as a guide for the verbal explanation of the study.

The consent document should be the basis for a meaningful exchange between the researcher and the participant.

The participant's signature provides documentation of agreement to participate in a study, but is only one part of the consent process.

The consent document must not serve as a substitute for discussion.

The entire informed consent process involves giving a participant the following:

1. adequate information concerning the study,


2. providing adequate opportunity for the participant to consider all

options, responding to the participant's questions, ensuring that the participant has comprehended this information,

3. obtaining the participant's voluntary agreement to participate, and continuing to provide information as the participant or situation

requires.

To be effective, the process should provide ample opportunity for the researcher and the participant to exchange information and ask questions.

In seeking informed consent, the following information must be provided to each subject:

1. A statement that the study involves research, an explanation of the purposes of the research and the expected duration of the subject's

participation, a description of the procedures to be followed, and identification of any products which are experimental.

2. A description of any reasonably foreseeable risks or discomforts to the

subject. 3. A description of any benefits to the subject or to others which may

reasonably be expected from the research. 4. A disclosure of appropriate alternative procedures or courses of

treatment, if any, that might be advantageous to the subject. 5. A statement describing the extent, if any, to which confidentiality of

records identifying the subject will be maintained and that notes the possibility that external regulatory agencies, such as the Food and

Drug Administration, may inspect the records. 6. For research involving more than minimal risk, an explanation as to

whether any compensation and/or medical treatments are available if injury occurs and, if so, what they consist of, or where further

information may be obtained. 7. A statement that participation is voluntary, that refusal to participate

will involve no penalty or loss of benefits to which the subject is

otherwise entitled, and that the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is

otherwise entitled.

Additional elements may include: 1. A statement that the particular treatment or procedure may involve

risks to the subject (or to the embryo or fetus, if the subject is or may become pregnant) which are currently unforeseeable.

2. Anticipated circumstances under which the subject's participation may be terminated by the investigator without regard to the subject's

consent. 3. Any additional costs to the subject that may result from participation

in the research.


4. The consequences of a subject's decision to withdraw from the

research and procedures for orderly termination of participation by the subject.

5. A statement that significant new findings developed during the course of the research which may relate to the subject's willingness to

continue participation will be provided to the subject. 6. The approximate number of subjects involved in the study.

It is the responsibility of the IRB to see that all these elements are included

within the consent form and that the language is appropriate for the patients being consented. It is always recommended that the consent form be in the

primary language of the human subject or that an official interpreter be present.

What is a Waiver or Alteration of Authorization and the IRB?

In order to access PHI under a waiver or alteration of authorization for research, the IRB must determine that the following criteria are met:

1. Use or disclosure involves no more than minimal risk to privacy for the individual based on:

a. a plan to protect patient identifiers from improper use and disclosure;

b. a plan to destroy patient identifiers at the earliest opportunity, and

c. adequate written assurances that protected health information will not be reused or disclosed to others except as required by

Law, for oversight of the research, or for other research that would be permitted by HIPAA.

2. The research could not practicably be conducted without the waiver; 3. The research could not practicably be conducted without access to

protected health information; and

4. A brief description of the PHI necessary to do the research (i.e., minimum necessary); and

5. The privacy risks are reasonable in relation to the anticipated benefits to the individuals and the importance of knowledge gained through

research.

What is a Waiver of Authorization?

Obtaining an authorization may not be practicable for some types of research. In these cases, HIPAA allows the IRB to grant a waiver of

authorization. The Waiver of Authorization can be granted for the entire study (i.e., retrospective chart reviews). Additionally, a Waiver of

Authorization (for Recruitment) may be granted to cover solely the


recruitment activities, but an authorization would be required when the

participant is enrolled.

What is an Alteration of Authorization and How is This Different

From a Waiver of Authorization? Under certain circumstances, the IRB may approve a request to omit one or

more of the required elements of authorization, for example, waiving the requirement to obtain a signature and date on HIPAA authorization when

conducting research by phone or via the Internet. While one element may be omitted all other elements must be included within the authorization.

What is a Data Use Agreement and How is This Connected With the IRB?

A Data Use Agreement (DUA) is a contractual document used for the

transfer of data that has been developed by nonprofit, government or private industry, where the data is nonpublic or is otherwise subject to some

restrictions on its use. Often these data are a necessary component of a research project, ie., a clinical trial, or a limited data set information as

defined in HIPAA.

The Privacy Rule of HIPAA requires a DUA must do the following: Establish what the data will be used for.

Establish who is permitted to use or receive the limited data set. Provide that the limited data set recipient will:

o Not use the information in a matter inconsistent with the DUA or other laws.

o Employ safeguards to ensure that this does not happen. o Report to the covered entity any use of the information that was

not stipulated in the DUA.

o Ensure that any other parties, including subcontractors, agree to the same conditions as the limited data set recipient in the DUA.

o Not identify the information or contact the individuals themselves.

How is Confidentiality of Participant Information and the IRB Related?

As a condition of protocol approval, the IRB determines that there are adequate provisions to protect confidentiality of information related to

potential or current participants, throughout the research, including data analysis and retention. Principal Investigators are expected to design


studies to maximize confidentiality to avoid unintentional and unauthorized

release or other disclosures.

Can There be Additional Requirements?

Yes. Additional requirements might apply, depending on the source of support/funding (e.g., Department of Education (re: access to instructional

material used in a research or experimentation program), Department of Energy (such as a required checklist for DOE requirements), Department of

Justice: National Institute of Justice (NIJ) and research conducted with the Bureau of Prisons): see GUI-42 Other Federal Agencies - Additional

Requirements.

The Principal Investigator must describe the provisions to protect the confidentiality of data in the Protocol Application. The IRB assesses the

information provided in the application during the review process and at

convened meetings. As necessary, the IRB will ask for additional details during its review.

In reviewing confidentiality protections, the IRB considers the nature,

probability, and magnitude of harms that would be likely to result from an unauthorized release of the collected information. It evaluates the proposed

anonymizing techniques, (e.g., de-identification, coding), storage plans, access restrictions, data security methods (e.g., encryption) and other

relevant factors in making its final determination concerning the appropriateness and adequacy of confidentiality protections. For active

protocols, any changes in confidentiality protection measures must be described in either a modification of human research Form 213 or continuing

review Form 212.

What is a Certificates of Confidentiality (CoC) and its Relationship to the IRB?

Where a protocol involves the collection of some sensitive information (e.g., about illegal conduct), the IRB may determine that special steps are needed

to protect participants from the risks of external investigative or judicial processes (legally mandated release of information for use in federal, state,

or local civil, criminal, administrative, legislative, or other legal proceedings). In such situations, the IRB may require that the Principal Investigator obtain

a Department of Health and Human Services (DHHS) Certificate of Confidentiality (CoC) pursuant to Section 241(d) of Title 42 of the United

States Code. Funding through DHHS or other federal funding is not a requirement for obtaining a CoC.


When the Principal Investigator obtains a CoC, the IRB requires that

participants be informed about the protections and limitations under the CoC, through the consent document or HIPAA authorization. The consent

document must explain if the investigators will release information under any anticipated mandatory reporting or for internal or external audit

purposes (e.g., University of Arizona internal audit, DHHS, or FDA). In order that a participant may weigh the risk of such release of information and not

expect more confidentiality protection than is actually provided by the CoC, the IRB requires that the possibility of release for those purposes be stated

clearly and explicitly in both the protocol and the consent form. The IRB also requires that any participant enrolled after expiration or termination of a CoC

be informed that its protection will not apply to them, and that issuance of a CoC is not an endorsement of the research by the DHHS.


APPENDIX A

EXEMPTION CATEGORIES

The study is exempt based upon the following criteria:

1. Research conducted in established or commonly accepted educational settings, involving normal educational practices,

such as: a. research on regular and special education instructional

strategies, or b. research on the effectiveness of or the comparison among

instructional techniques, curricula, or classroom management methods.

2. Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures,

interview procedures or observation of public behavior, unless: a. information obtained is recorded in such a manner that human

subjects can be identified, directly or through identifiers linked to the subjects; and

b. any disclosure of the human subjects' responses outside the research could reasonably place the subjects at risk of criminal

or civil liability or be damaging to the subjects' financial standing, employability, or reputation.

3. Research involving the use of educational tests (cognitive,

diagnostic, aptitude, achievement), survey procedures, interview procedures, or observation of public behavior that is

not exempt under paragraph (b)(2) of this section, if:

a. the human subjects are elected or appointed public officials or candidates for public office; or

b. Federal statute(s) require(s) without exception that the confidentiality of the personally identifiable information will be

maintained throughout the research and thereafter.

4. Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic

specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner

that subjects cannot be identified, directly or through identifiers linked to the subjects.


5. Research and demonstration projects which are conducted by

or subject to the approval of Department or Agency heads, and which are designed to study, evaluate, or otherwise examine:

a. Public benefit or service programs; b. procedures for obtaining benefits or services under those

programs; c. possible changes in or alternatives to those programs or

procedures; or d. possible changes in methods or levels of payment for benefits or

services under those programs.

6. Taste and food quality evaluation and consumer acceptance studies:

a. if wholesome foods without additives are consumed or b. if a food is consumed that contains a food ingredient at or below

the level and for a use found to be safe, or agricultural chemical

or environmental contaminant at or below the level found to be safe, by the Food and Drug Administration or approved by the

Environmental Protection Agency or the Food Safety and Inspection Service of the U.S. Department of Agriculture.


APPENDIX B

Expedited Categories

45 CFR 46.110 Categories of Research That May Be Reviewed through an

Expedited Review Procedure

1) Clinical studies of drugs and medical devices only when condition (a)

or (b) is met. a) Research on drugs for which an investigational new drug application

(21 CFR Part 312) is not required. (Note: Research on marketed drugs that significantly increases the risks or decreases the acceptability of

the risks associated with the use of the product is not eligible for expedited review.)

b) Research on medical devices for which (i) an investigational device exemption application (21 CFR Part 812) is not required; or (ii) the

medical device is cleared/approved for marketing and the medical device is being used in accordance with its cleared/approved labeling.

2) Collection of blood samples by finger stick, heel stick, ear stick, or

venipuncture as follows: a) from healthy, nonpregnant adults who weigh at least 110 pounds. For

these subjects, the amounts drawn may not exceed 550 ml in an 8

week period and collection may not occur more frequently than 2 times per week; or b. from other adults and children, considering the

age, weight, and health of the subjects, the collection procedure, the amount of blood to be collected, and the frequency with which it will

be collected. For these subjects, the amount drawn may not exceed the lesser of 50 ml or 3 ml per kg in an 8 week period and collection

may not occur more frequently than 2 times per week.

3) Prospective collection of biological specimens for research purposes by noninvasive means.

Examples: o hair and nail clippings in a nondisfiguring manner;

o deciduous teeth at time of exfoliation or if routine patient care indicates a need for extraction;

o permanent teeth if routine patient care indicates a need for

extraction; o excreta and external secretions (including sweat);

o uncannulated saliva collected either in an unstimulated fashion or stimulated by chewing gumbase or wax or by applying a dilute

citric solution to the tongue; o placenta removed at delivery;


o amniotic fluid obtained at the time of rupture of the membrane

prior to or during labor; o supra- and subgingival dental plaque and calculus, provided the

collection procedure is not more invasive than routine prophylactic scaling of the teeth and the process is accomplished

in accordance with accepted prophylactic techniques; mucosal and skin cells collected by buccal scraping or swab, skin swab, or

mouth washings; o sputum collected after saline mist nebulization.

4) Collection of data through noninvasive procedures (not involving general anesthesia or sedation) routinely employed in clinical

practice, excluding procedures involving x-rays or microwaves. Where medical devices are employed, they must be cleared/approved for

marketing. (Studies intended to evaluate the safety and effectiveness of the medical device are not generally eligible for expedited review,

including studies of cleared medical devices for new indications.)

Examples: o physical sensors that are applied either to the surface of the

body or at a distance and do not involve input of significant amounts of energy into the subject or an invasion of the

subject's privacy; o weighing or testing sensory acuity;

o magnetic resonance imaging; o electrocardiography, electroencephalography, thermography,

detection of naturally occurring radioactivity, electroretinography, ultrasound, diagnostic infrared imaging,

doppler blood flow, and echocardiography; o moderate exercise, muscular strength testing, body composition

assessment, and flexibility testing where appropriate given the age, weight, and health of the individual.

5) Research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for

nonresearch purposes (such as medical treatment or diagnosis). (NOTE: Some research in this category may be exempt from the HHS

regulations for the protection of human subjects. 45 CFR 46.101(b)(4). This listing refers only to research that is not exempt.)

6) Collection of data from voice, video, digital, or image recordings

made for research purposes.

7) Research on individual or group characteristics or behavior (including, but not limited to, research on perception, cognition,

motivation, identity, language, communication, cultural beliefs or


practices, and social behavior) or research employing survey,

interview, oral history, focus group, program evaluation, human factors evaluation, or quality assurance methodologies. (NOTE:

Some research in this category may be exempt from the HHS regulations for the protection of human subjects. 45 CFR 46.101(b)(2) and (b)(3).

This listing refers only to research that is not exempt.)

8) Continuing review of research previously approved by the convened IRB as follows:

a) Where; b) the research is permanently closed to the enrollment of new

subjects; c) all subjects have completed all research-related interventions;

and the research remains active only for long-term follow-up of subjects; or

d) where no subjects have been enrolled and no additional risks

have been identified; or e) where the remaining research activities are limited to data analysis.

9) Continuing review of research, not conducted under an investigational

new drug application or investigational device exemption where categories two (2) through eight (8) do not apply but the IRB has

determined and documented at a convened meeting that the research involves no greater than minimal risk and no additional risks have

been identified.


IRB Process for Research Conducted at

UA College of Medicine-Phoenix

Bring protocol

To Research

Administration

Office

Determine if your

project is “research”

STEP 1

Does project

involve

Human

Subjects?

STEP 2

No IRB

review

needed -

you are

done

No

Yes

Determine

which review

process is

required

Exempt - your letter means

no further interactions

with IRB unless there is

a change in the protocol

Expedited – requires a

continuing review within

one year – failure to submit

will terminate the study

Full Board Review –

approval is for one year – a

continuing review will be

required – failure to submit

will terminate the study

No

Principal Investigator

is informed of the IRB

decision – approval

means research can

proceed with letter

STEP 3

Yes

Figure 1


Figure 2

Reviewed by IRB designee

and Res. Admin. Ofc. staff

Correspondence

is prepared for PI

Reviewed by IRB designee

and Res. Admi. Ofc. staff Correspondence

is prepared for PI

Reviewed at

IRB meeting

Exempt?

Expedited?

Full

Board

NO

NO

Yes

Yes

Yes

IRB

application

to Research

Administration

Office

Determine

type of

review

required IRB PROCESS

Disapprove Correspondence

is prepared for PI.

Yes No

Defer approval Correspondence

is prepared.

Investigator

responds to

issues.

Yes

No

Correspondence is prepared for PI.

Protocol is placed in active file. Full approval

Contingent

approval

Correspondence

is prepared.

Investigator

responds to

contingencies.

Response

is reviewed

Yes

Yes

No


IRB Process if Research is Conducted at an External

Institution – Requires a Deferral from the UA COM-P

External IRB

Research Approval

Proceed to RAO

with Form 207

and supporting

documents

Application is sent to Tucson

Office for Responsible

Conduct of Research

Application is Reviewed

A Deferral to the IRB of

Record is sent in letter form

To Principal Investigator

Research may

Begin when

Deferral is

received Figure 3

research compliance -...

Documents