IRB Guidance

University of Pittsburgh IRB Guidance on Research Limited to Retrospective Medical Record Reviews

 http://medical-record.blogspot.com/

Research studies involving the retrospective review, collection and analysis of medical record information are descriptive studies that ordinarily seek to evaluate relationships between one or more biomedical, treatment, and/or demographic variables and one or more outcome measures in patients.  Data may include a wide range of information from the medical record (e.g., results of lab tests, nursing and physician notes, summary reports – including intake and discharge summaries and consultant reports, raw data from electrophysiological or imaging tests, etc.).  Because this is research, University IRB oversight is required, in accordance with the Federal Policy regulations (45 CFR Part 46) governing human subject protections.  Further, because the research involves medical records, compliance with the HIPAA Privacy Rule (46 CFR Part 160; Part 164 (subparts A,E) ) is required.  Regarding the latter, the University IRB also serves as the HIPAA privacy board for UPMC.



There are several different approaches to the conduct of retrospective medical record research studies that can be approved by the University IRB.



A.  Recording of Medical Information, Without Identifiers, By or Under the Oversight Of a Principal Investigator Who Would Normally Have Access to this Information by Virtue of His/Her Patient Care Responsibilities:



An investigator may personally review medical records and abstract relevant data from the medical records if ALL of the following conditions are met:



1. All medical records to be accessed for study are currently in existence at the time of the IRB submission.



2. The desired medical record data is recorded by the investigator in such a way that the respective patients cannot be identified (i.e., by the investigator or others) either directly, or indirectly via linkage codes assigned to the data.  This means that the investigator cannot record names, social security numbers, or any other patient identifiers and link this information to the data set.  As a consequence, the resulting research data set is necessarily completely anonymous.  For that reason, once the information has been extracted from the medical record, it will not be possible for the investigator to go back to the medical record and add other patient-specific information to this research dataset.



3.  The principal investigator (P.I.) of the research study has legitimate access to the desired medical information insofar as he or she is a UPMC staff member and/or has been granted UPMC privileges and provides related care (i.e., related to the information desired) to the patients, or is in the position to provide related care (including treatment, and/or diagnostic services) to the patients.  For example, any health professional providing patient care to a particular set of patients (e.g., all patients treated in the Emergency Department; all patients with aphasia; all patients undergoing CT scans), would ordinarily have access to the related medical record information of those patients  as part of his or her current or future job responsibilities, and hence would be in a position to serve as the P.I. of a research study involving a retrospective review of those medical records (regardless of whether he or she actually provided direct care to those particular patients).  For example, if the research study is directed at obtaining neurological information and the P.I. is a cardiologist, the research submission to the IRB must address the relationship of the information desired to the normal patient care responsibilities of this cardiologist-P.I.  Note that the University IRB will not approve a retrospective medical record research study if the medical record information desired is not in some way related to the patient care responsibilities of the listed P.I.  That type of study would require the use of a UPMC certified honest broker (see section B).



It is recognized that health care professional students (including medical students, residents and fellows) may be required to perform a research project and that many of these projects will involve retrospective medical record reviews.  It is further recognized that these students may have had limited or transient involvement in the care of these patients.  Thus, if the researcher is a health care professional student, the P.I. for the retrospective medical record research study must be a UPMC staff member or UPMC-privileged professional who provides related care, or is in the position to provide related care, to the particular patient population to be studied by the student.  In this example, the P.I. on the IRB submission will be the faculty member, and the student will be listed as a co-investigator (or as a Co-Principal Investigator).  Please note that in this situation the student could be the first author on any publication resulting from this retrospective research study.



It is further recognized that investigators often employ research staff members (e.g., nurse coordinators, research assistants or associates) who may be involved in accessing and recording the medical record information as part of their ordinary job responsibilities.  UPMC policies specify that these research staff members are considered members of the UPMC to the extent that they are performing services for P.I.s who are UPMC staff members or who have been granted UPMC privileges.   Thus, research coordinators or other research staff may have access to, and may record, medical record information, provided that the P.I. of the research study is a UPMC staff member or UPMC privileged professional who provides related care, or is in the position to provide related care, to the respective patient population.



Regardless of who is involved in accessing and recording the medical information, the P.I. of the research study is responsible, and will be held accountable, for ensuring the confidentiality of the patients’ medical record information.



If the protocol, study procedures, and the P.I. meet all three of these criteria, a medical record research exempt review form must be completed and submitted to the University IRB in advance of accessing medical record information for this retrospective research study.  This exempt submission is necessary so as to obtain institutional concurrence that the proposed research meets the criteria for exemption from the Federal Policy regulations as specified under 45 CFR Part 46.101.b.4.



To ensure compliance with provisions of the HIPAA Privacy Rule, a new University IRB exempt application form for retrospective medical record research studies (limited to investigators with relevant patient care responsibilities) has been developed that includes a request for a waiver of HIPAA authorization.



The HIPAA Privacy Rule (46 CFR Part 160; Part 164 (subparts A,E) requires that any request for a waiver of HIPAA authorization address three specific criteria.  Each criterion is listed below, along with examples of appropriate model justifications for each.



Criterion 1: “The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals based on (a) an adequate plan to protect the identifiers from improper use and disclosure; (b) an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research (unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law); and (c) adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by this subpart.”



Justification: This criterion is readily met by investigators insofar as the medical information will be recorded without patient identifiers (e.g., names, phone numbers, addresses, etc.) or linkage codes (e.g., social security numbers, medical record numbers, etc.).  Thus, there is no collection of protected health information (i.e., identifiable medical record information) or any possibility of subsequent disclosure of protected health information.  Furthermore, and consistent with this waiver request, the investigators who will access the protected health information also provide related care, or are in the position to provide that care, to these patients, thus minimizing privacy and confidentiality concerns.



Criterion 2:  “The research could not practicably be conducted without the waiver or alteration.”



Justification:  This criterion is met by investigators insofar as the patients, whose protected health information will be accessed under this waiver request, have not previously provided informed consent for this retrospective research activity and it is impractical to obtain consent from these individuals because they are no longer in the hospital and contacting them is precluded by the researcher’s inability to use patients’ identifiable contact information without their prior consent.  Thus, obtaining the HIPAA authorization of these patients for the research use of their health information is impracticable.



Criterion 3: “The research could not practicably be conducted without access to and use of the protected health information.”


Justification: This criterion is met by the overall scientific design of the study which focuses on identifying and/or evaluating inter-relationships among various medical variables.  Consistent with the “minimum necessary standard” of the HIPAA privacy rule, investigators will access and collect only the specific health information necessary to complete this research study.



The HIPAA Privacy Rule (45 CFR 164.512.i) gives individuals the right to receive an accounting of certain disclosures of protected health information made by a covered entity.  It also allows for a simplified accounting of disclosures of protected health information for research purposes, when at least 50 patient records are reviewed as part of the research activity.  Because this simplified accounting procedure permits covered entities to provide individuals with a list of all protocols for which the patient’s protected health information may have been disclosed, the IRB will provide UPMC with a listing of each IRB protocol approved with a waiver of HIPAA authorization.  This listing will include the title of the protocol, the researcher’s name, and the researcher’s contact information.



The following IRB Application Form, available on the Exempt Page of the IRB website (www.irb.pitt.edu) should be used:  “Medical Record Review by Investigator with Patient Care Responsibilities”


B.  Use of a Certified Honest Broker System



If the P.I. of the retrospective research study does not provide related care, or is not in the position to provide related care, to the patients whose medical records are being accessed, it is recommended that the investigator utilize the services of a University IRB certified honest broker system.  The honest broker system, by definition, involves an individual or individuals (e.g., clinical clerk, nurse, IT staff) who would normally have access to the desired medical record information by virtue of her or his hospital responsibilities, and who is not involved as a listed investigator on the respective research study.  The honest broker accesses the desired medical record information on behalf of the P.I. and provides the P.I. with an appropriately de-identified data set – either a completely de-identified data set (“HIPAA Safe-Harbor”) or a data set that includes patient-specific dates and/or geographical information (“Limited Data Set”).  Use of an IRB-certified honest broker system ensures compliance with both the Federal Policy and HIPAA Privacy Rule regulations since no identifiable medical record information is being obtained or used directly by the investigators. Hence a waiver of the requirement for informed consent and/or HIPAA authorization is not necessary, and there is no need for the UPMC to track the use, on a patient-by-patient basis, of medical record information for research studies using this system.  In addition, there is no requirement that all of the desired medical record information must be in existence at the time of IRB submission.  That is, the honest broker can assign a code number to the data given to the investigator provided that the investigator does not have access to the information linking this code number to the identities of the respective patients.   Using this code number, the investigator can request, through the honest broker, additional medical information corresponding to a given patient. From an IRB perspective, this type of application (where all data are not currently available for study) would meet criteria for ‘no human subjects’ involvement (45 CFR 46.102.f) because (a) the investigators have neither interacted nor intervened with these individuals for research purposes, and (b) the use of the honest broker ensures that the investigators will not obtain private identifiable information.



The following IRB Application Form, available on the Exempt Page of the IRB website (www.irb.pitt.edu) should be used:  “Medical Record Review with Honest Broker”



C.  Request for IRB Approval of a Waiver of Informed Consent/HIPAA Authorization



It is recognized that there may be situations in which investigators conducting retrospective medical record research need to collect information that includes patient identifiers (e.g., to link patient information obtained from multiple databases; to link existing patient information with new patient information) and do not have access to, or wish to use, an IRB-certified honest broker system.  In accordance with the Federal Policy regulations and HIPAA Privacy Rule, the acquisition or use of identifiable medical record information for research requires both the written informed consent and HIPAA authorization of the involved patients, or University IRB approval of a waiver of both of these requirements.


The Federal Policy criteria (45 CFR 46.116.d) that must be addressed and justified (i.e., in the corresponding research protocol) in order for the University IRB to grant a waiver of informed consent are as follows:



(1)      The research involves no more than minimal risk to the subjects

(2)      The waiver of consent will not adversely affect the rights and welfare of the subjects

(3)      The research could not practicably be carried out without the waiver


Regarding the second of these criteria, the University IRB has minimal concerns that the privacy and confidentiality rights of the involved patients are being adversely affected if the P.I. of the research study is a UPMC staff member and/or has been granted UPMC privileges and provides related care to these patients, or is in the position to provide related care to these patients.  That is, by virtue of his or her patient care responsibilities, the P.I. would already be permitted to access the patients’ medical care information.  As outlined above, the University IRB would also permit health professional students and research coordinators to access and obtain identifiable medical record information under the oversight and responsibility of such a P.I.  The corresponding IRB application must address, and provide justifications for, each of the Federal Policy and HIPAA Privacy Rule criteria for granting a waiver of informed consent/HIPAA authorization.  The University IRB web-site (HIPAA Page) currently incorporates a “Model Request for a Waiver of the Requirements to Obtain Informed Consent/HIPAA Authorization to Access, Record, and Use Protected Health Information/Identifiable Medical Record Information for a Retrospective Research Study:  Principal Investigator Provides Care to the Respective Patients” (http://www.irb.pitt.edu/hipaa/waiver_835.pdf)  Applicable P.I.s of retrospective medical record research studies need to simply incorporate the waiver criteria and model justifications into their IRB application.  Since the University IRB has pre-approved the model justifications for the waiver criteria under this circumstance (i.e., the P.I. provides care to the respective patients), the application can be reviewed administratively (i.e., “expedited” review) and does not require consideration at a convened meeting of an IRB committee.

 If the P.I. of the retrospective medical record research study does not provide related care to the respective patients, there are obvious concerns that investigator access to, and the recording of, patients’ identifiable medical record information may adversely affect the patients’ rights to privacy and confidentiality of this information.  Thus, in this situation, the P.I. must address, in the corresponding IRB application, each of the Federal Policy and HIPAA (see above) criteria for granting a waiver of informed consent/ HIPAA authorization and must provide clear and thorough justifications regarding the applicability of these criteria to the proposed research.  Since the University IRB holds informed consent as a primary principle governing the ethical conduct of human subject research, all such requestshttp://medical-record.blogspot.com/ for a waiver of informed consent/HIPAA authorization will require review and approval by a convened IRB committee (i.e., “full board” IRB review).


This guidance was prepared under the direction of Christopher Ryan, working closely with IRB staff, and was approved by the University of Pittsburgh IRB Executive Committee on 18. February 2005.  Please note that the focus of this guidance is limited solely to retrospective medical record reviews for research purposes.

Comments (0)

Posting Komentar