UConn Health’s HSPP Reaccreditation from the

Association for Accreditation of Human Research Protection Program (AAHRPP)

 

On March 27-28, 2024, UConn Health Human Subjects Protection Program (HSPP) underwent a Site Visit evaluation as part of the process of reaccreditation by the Association for Accreditation of Human Research Protection Programs (AAHRPP).  After the HSPP responds to the Site Visit report the application will be reviewed by the AAHRPP Council in June 2024.  This process required team work from many stakeholders. The Director of the Human Subjects Protection Program and the Associate Vice President for Research Integrity & Compliance extend their gratitude to the faculty, staff, IRB members and members of the Scientific Review and Conflicts of Interest Committees, Office of Clinical and Translational Research Services, Sponsored Program Services, Research Pharmacy and Research Safety, and many others who committed their time to the Site Visit and who ensure that we have an outstanding human subjects program every day.

 

 

FDA Regulated Research

Overview of Human Subjects Research with Devices

 

The U.S. Food and Drug Administration (FDA) regulates drugs, biologics, and devices used in the diagnosis, mitigation, treatment, or prevention of diseases.

 Investigators who will be conducting clinical investigations in which the purpose of the study is to obtain data about a medical device (e.g., data on its safety and effectiveness), should become familiar with the information provided below to determine whether: (a) the device is exempt from an investigational device application (IDE), (b) the device fulfills the requirements for an abbreviated IDE, or (c) the device needs an IDE issued by the FDA.

Investigators should only think about these determinations when research participants of a clinical investigation will become part of the group in which a medical device will be used or part of the control group, and the device is the object of the investigation/research study.

Unless the sponsor of the device has made the determination that the device is exempt from the requirements of Part 812.2 (c), the study may be conducted under an abbreviated IDE or the investigator must submit an IDE application to FDA. See Table 1 below.

An investigational device exemption (IDE) is a regulatory status granted by the FDA that allows researchers to conduct clinical investigations on medical devices that have not yet received FDA approval. However, not all device studies are required to submit an IDE application to the FDA.  If a device is determined to be a non-significant device (NSR) in concurrence with the IRB, then an IDE is not necessary.

An IRB may determine that a device is a non-significant device because it does not meet the definition for a significant risk device (SR) (see definition of SR below) and does not present a potential for serious risk to the health, safety, or welfare of participants.

The sections below explains when and how an investigator makes a determination that a device could be used in a clinical investigation under an abbreviated IDE or under an Investigational Device Exemption (IDE).

Abbreviated Investigational Device Exemption

The sponsor makes the initial determination of SR or NSR for the device. However, it is important to note the IRB will make the final determination for NSR devices. If the research study is investigator initiated, then the investigator is also acting as the sponsor.

NSR device studies may not require submission to the FDA providing they comply with the abbreviated requirements of the regulations described in the IRB Policy 2011-021.0.pdf – Investigational Device Studies 

The FDA considers an investigation of a non-significant risk device to have an approved IDE (Abbreviated Investigational Device Exemption) when an IRB concurs with the initial non-significant risk determination of the sponsor or investigator and approves the study. See Table 1 below.

 

Investigational Device Exemption (IDE)

If either the investigator or the IRB has made a determination that the device is a significant risk device an IDE application is to be submitted to the FDA.

To obtain an IDE approval by the FDA, the sponsor or manufacturer of the device must properly fill out an IDE application. This application should be submitted proposing a human clinical researcher to study an unapproved significant risk device or a cleared or approved device for use other than its approved indication or intent.

The application should provide information about the investigational device, including its design, manufacturing process, and intended use. A clinical investigational protocol that outlines study objectives, methodology, patient population, and end points should also be included.  In addition, the sponsor must demonstrate in the application that there is reason to believe that the risks to human subjects from the proposed investigation are outweighed by the anticipated benefits to subjects, the importance of the knowledge to be gained, that the investigation is scientifically sound, and that there is reason to believe that the device as proposed for use will be effective.

An IDE application can be considered approved 30 days after it has been reviewed by the FDA, unless otherwise indicated. The FDA may inform the sponsor of approval, approval with conditions, or disapproval prior to 30 calendar days from the date of receipt.

Once FDA approval is granted, and the IRB has approved the study the sponsor and/or investigator may proceed with the clinical investigation. See Table 1 below.

The FDA grants permission so a device that otherwise would be required to comply with a performance standard or to have premarket approval can be shipped lawfully for the purpose of conducting investigations of that device. This FDA permission is evidenced by the assignment of an IDE number.

Additional Points to Consider About Research Studies with Medical Devices

• Studies of SR Devices require review of the convened IRB.
• NSR device studies generally will require full board review but may be approved through the expedited review procedure if the study falls within a designated approvable category and is minimal risk.
• IRB approval must be obtained before any clinical investigation can begin, and for studies with a SR Device, both FDA and IRB approval must be obtained before any subject can be enrolled.

 

Definitions-

 Clinical investigation means any experiment that involves a test article and one or more human subjects and that either is subject to requirements for prior submission to the Food and Drug Administration under section 505(i) or 520(g) of the act, or is not subject to requirements for prior submission to the Food and Drug Administration under these sections of the act, but the results of which are intended to be submitted later to, or held for inspection by, the Food and Drug Administration as part of an application for a research or marketing permit. The term does not include experiments that are subject to the provisions of part 58 of this chapter, regarding nonclinical laboratory studies.

Significant Risk (SR) Device: A device that presents a potential for serious risk to the health, safety, or welfare of a subject and 1) is intended as an implant, or 2) is used in supporting or sustaining human life, or 3) is of substantial importance in diagnosing, curing, mitigating or treating a disease, or otherwise prevents impairment of human health, or 4) otherwise presents a potential for serious risk to the health, safety, or welfare of a subject.          

 

     Table 1

	Categories of Research Studies with Medical Devices
	IDE Exempt	Non-Significant Risk (NSR)	Significant Risk (SR)
Risk	Lowest Level of  Risk	Low Risk	High risk
FDA Approval	Exempt from 21 CFR Part 812	Must comply with an Abbreviated Investigational Device Exemption in 21 CFR Part 812.2 (b)	Must follow ALL IDE Regulations in 21 CFR Part 812-Investigational Device Exemption (IDE) Application
IRB Review Approval	YES	YES	YES

 

Resources for investigators:
ReGARDD – Regulatory Guidance for Academic Research of Drugs and Devices

Device Advice: Comprehensive Regulatory Assistance | FDA

 

UConn Health IRB Forms and Polices Revisions

&

Educational Resources

 

 

The following forms have been updated:

• Instructions for Requesting Reliance Upon Advarra IRB.docx(2/13/2024, updated contacts at Advarra and consent template injury language section)
• Request for UConn Health as a Recruitment Site -Without Engagement(*new form as of 3/20/24)

 

The following policy has been updated:

• 2011-008.2.pdf– Informed Consent – Waivers and Alterations (1/22/2024) (including the FDA final rule that allows IRBs to approve an informed consent procedure that does not include or that alters certain informed consent elements, or to waive the requirement to obtain informed consent, for certain minimal risk clinical investigations).

The following links were added to the IRB website under online resources for investigators:

• Regulatory Guidance for Academic Research of Drug and Devices 
• Is my Device Study Exempt from Investigational Device Exemption (IDE) Regulations?

 

 

Upcoming Changes in at the HSPP/IRB

 

Education & Development Specialist of HSPP:  As of 4/5/2024, Mayra Cagganello has transferred to a new position within UConn Health.  Mayra has worked for the HSPP for almost 13 years and her dedication and support to the HSPP and research community will be missed!

Investigators who need education, guidance on IRB submission and/or training with the IRIS submission system should contact the IRB at irb@uchc.edu

We wish Mayra the best in her new role!

 

 

 Bibliography

 2011-007.0.pdf – Definitions Applied to Policies

2011-021.0.pdf – Investigational Device Studies

Frequently Asked Questions about Medical Devices

OCTOBER, NOVEMBER, DECEMBER, 2023 – HSPP NEWSLETTER

 

The HIPAA Privacy Rule & Human Subjects Research – Overview

 

The HIPAA Privacy Rule (the “Privacy Rule”) may impose additional requirements to the federal human subjects protection regulations applied to all human subjects research.

 The purpose of this overview is to clarify concepts and apply them to commonly seen human subjects research activities/studies. Specifically, the sections below highlight some of the main provisions of the Privacy Rule as they relate to human subjects research.

A series of questions and answers explain the scope of the Privacy Rule, the difference between an Authorization, a Waiver of HIPAA Authorization and an Alteration of HIPAA Authorization.  In addition, several sections explain how to address the Privacy Rule in recruitment activities, and when using specimens for research studies.  Examples of research activities and the appropriate HIPAA forms are included in some of those sections.

 

Section A- Questions related to the Privacy Rule and Human Subjects Research

 

The Privacy Rule regulates the way certain organizations called covered entities under the Rule handle protected health information (PHI). Since UConn Health is a covered entity, investigators conducting research with UConn Health PHI need to address HIPAA.

 

Question: How do I know if I need to address the Privacy Rule in my research study?

Answer: The Privacy Rule affects research and researchers when either:

Research creates or generates PHI, or research requires access to and/or use of PHI.

If your study involves the use of PHI you must address the Privacy Rule within your application for approval. PHI means individually identifiable health information transmitted or maintained in any form (electronic means, on paper, or through oral communication) that relates to the past, present or future physical or mental health or condition of an individual. Health information is not considered PHI if it has been de-identified in accordance with the Privacy Rule (i.e., by expert analysis or by removing all identifiers specified in the Privacy Rule of the individual or of relatives, employers, or household members of the individual).

Examples of research studies for which the HIPAA regulations apply are:

• Studies using individually identifiable health information that is generated as part of a health care service.
• Studies gathering individually identifiable health information that is entered into a medical record.
• Studies gathering individually identifiable health information that is used to make treatment decisions.
• Retrospective or Prospective research studies involving the review of medical records.
• Research studies involving surveys, questionnaires or focus groups, which obtain PHI from patients receiving treatment.

 

 Question: When does the Privacy Rule not apply to research?

Answer: Research studies that do not use, disclose or create PHI are not subject to HIPAA regulations.

Examples of studies that are not subject to HIPAA:

• Studies that use tests that do not go into the medical record because they are part of a basic research study and the results will not be disclosed to the subject.
• Studies that review de-identified health information.
• Studies that obtain data from records open to the public.

• Interviews, focus groups, and surveys studies that collect information that is not considered health information (e.g., opinions, beliefs, wants/preferences, etc.)

 

 Question: What is the difference between HIPAA “Authorization” and Informed Consent?

Answer: An informed consent is the individual’s volunteer permission to participate in the research. The requirement to obtain the legally effective informed consent of individuals before involving them in research is one of the central protections provided for under the HHS regulations at 45 CFR part 46 ( AKA as the Common Rule).  The Common Rule’s focus is in protecting the safety of the individuals, their privacy, and confidentiality. To do so, the investigators need to include in the consent forms the applicable elements /information described in the Main Consent Form Checklist.doc .

The Privacy Rule, a different regulation, focuses on protecting the privacy and security of PHI. The Privacy Rule generally requires subjects to give written Authorization before a covered entity may use or disclose patients’ PHI for research. A signed HIPAA Authorization represents an individual’s agreement to the use and disclosure of the individual’s PHI for the specified research purpose.

An authorization must contain several required elements and statements, including but not limited to a description of the PHI to be used and disclosed, the person authorized to make the use or disclosure, the  researcher may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed.

 

Section B- Questions related to Waiver of HIPAA Authorization and Alteration of HIPAA Authorization

  

The IRB may approve a HIPAA authorization process which does not include, or which alters some or all of the elements of a valid written authorization, or waives the requirement for written HIPAA authorization if the IRB finds and documents that the use of the subjects’ PHI meets the criteria for a waiver.

In granting an alteration or waiver of HIPAA authorization, the IRB must determine that the alteration or waiver, in whole or in part satisfies each of the following criteria:

• The use or disclosure of PHI involves no more than minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
• an adequate plan to protect the identifiers from improper use and disclosure;
• an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
• adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted (i.e., under the HIPAA regulations).
• The research could not practicably be conducted without the waiver or alteration; and
• The research could not practicably be conducted without access to or use of the PHI.

 

  Question: What is the difference between a partial and complete Waiver of HIPAA Authorization?

 Answer: A waiver of HIPAA authorization is a determination that is made by the IRB.  An IRB can waive in full or in part the individual authorization required by the Privacy Rule to use and disclose PHI for research purposes.

Example of research study for which the IRB may grant a complete waiver of the Authorization:

• A research study limited to a retrospective review of medical records (HIPAA Waiver for the entire study).

Example of research study for which the IRB may grant a partial waiver of the Authorization:

• A research study collecting information during telephone screening (HIPAA Waiver for a portion of the study).

To request a waiver of HIPAA authorization the investigator must complete pages 1 and 2 of the HIPAA Request for Alteration or Waiver of Authorization.doc form and submit this document to the IRB for review and approval prior to using and/or disclosing PHI.

 

Question: Is it possible to get a HIPAA waiver to screen patient charts without having each patient first sign an Authorization form?

Answer: Yes. The Privacy Rule allows for certain activities regarding screening, recruiting or determining eligibility (e.g. chart reviews for determining eligibility) to occur without obtaining a HIPAA authorization.

The investigator must submit a HIPAA Request for Alteration or  Waiver of Authorization.doc . The waiver must be granted by the IRB before charts are screened.

 

Question: What is a HIPAA Alteration of the Required Elements and/or Statements?

Answer: A HIPAA Alteration of the Required Elements and/or Statements is a regulatory determination that is made by the IRB.  An IRB can approve to omit (waive), or change (alter) in part the individual authorization required by the Privacy Rule to use and disclose PHI for research purposes.

 

When investigators are planning to obtain an individual’s authorization to access their information, and they need to either remove (waive), or change (alter) some of the core elements or statements of an authorization, they must complete and submit Appendix A.  Appendix A is in the fourth page of the HIPAA Request for Alteration or Waiver of Authorization.doc form   The IRB must approve this request prior to the use and/or disclosure of PHI.

 

Example of an alteration of the authorization:

• An authorization that requires to remove (waive) the element that describes each purpose of the requested use or disclosure because providing the purpose of the study would affect the results of the study.

 

Examples of studies withholding information about the study purpose and/or reason for procedures, in order to prevent biasing the results:

• Subjects are asked to take a quiz for research but they are not told that the research question involves how background noise affects their ability to concentrate.
•  To further understanding of how representations of same sex couples depicted in commercials influence consumer behavior, subjects are exposed to advertisements featuring gay couples and straight couples while their heart rate, facial muscle movement, and sweat responses are recorded. Subjects are informed that their reactions to the commercials are being studied, but not that the researchers are examining if the sexual orientation of characters in commercials influences them.

 To request to alter the HIPAA authorization, the investigator needs to submit a HIPAA Request for Alteration or Waiver of Authorization.doc  and Appendix A.

 

 Example of research study that requires waiving documentation/signature of the authorization:

• Research on sensitive topics, such as domestic violence or illegal activities where the only link of a subject to the study is their signature on the authorization, and there is a risk of breach of confidentiality.

 To request a waiver of the participant’s signature on the HIPAA authorization, the investigator needs to submit a HIPAA Request for Alteration or Waiver of Authorization.doc  and Appendix A.

 

Section C- Questions Related to IRB Review and the Privacy Rule when Using Specimens for Research

 

Because the federal definition of human subjects research extends to people who are sources of biological specimens and identifiable private information, research with these materials often requires review and approval by the IRB. The level of IRB review  is based on the level of risk the study poses.

The risks of research with specimens potentially include one or both of the following:

• The risk of harm from procedures used to obtain specimens, and/or
• The risk associated with the loss of privacy and confidentiality due to personally identifiable information that may be associated with specimens.

Common questions involving research using human specimens are summarized below.

 

Question:  What type of IRB review is required for a research project using existing specimens? What HIPAA form do I need to submit?

  Answer: It depends on whether the existing specimens are identifiable. Existing specimens means the  specimens were collected for clinical purposes or for research studies other than the proposed research study.

If the existing specimens are not identifiable, and if the investigator will make no effort to re-identify the specimens, the specimens do not meet the definition of a human subject and IRB review would not be required.

On the other hand, if the specimens are identifiable, or efforts will be made to re-identify the samples, IRB review is required.

Research that only involves the use of existing identifiable specimens may qualify for exemption if one of the following is true:

• the specimens are publicly available
• Information is recorded in such a manner that the identity of the human subject cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects. In this case, the research may qualify for exempt status under Category 4.ii.

To address HIPAA submit a HIPAA Certification of De-Identification.doc

On the other hand, research involving previously collected specimens that have identifiers associated most likely qualifies for expedited review under category 5.  Use of specimen-associated identifiers must be restricted and privacy protection measures must be in place.

To address HIPAA submit HIPAA Request for Alteration or  Waiver of Authorization.doc

 

Question:  What type of IRB review is required for a research project using specimens that will be collected for research purposes by noninvasive means? What HIPAA form do I need to submit?

Answer: Research that involves the collection of specimens for research purposes by noninvasive means may qualify for Expedited review- under Category 3.

Examples of these noninvasive collections of specimens are:

1. Hair and nail clippings in a non-disfiguring manner
2. Deciduous teeth at time of exfoliation or if routine patient care indicates a need for extraction
3. Permanent teeth if routine patient care indicates a need for extraction
4. Excreta and external secretions (including sweat)
5. Un cannulated saliva collected either in an unstimulated fashion or stimulated by chewing gum base or wax or by applying a dilute citric solution to the tongue
6. Placenta removed at delivery
7. Amniotic fluid obtained at the time of rupture of the membrane prior to or during labor
8. Supra‑ and subgingival dental plaque and calculus, provided the collection procedure is not more invasive than routine prophylactic scaling of the teeth and the process is accomplished in accordance with accepted prophylactic techniques
9. Mucosal and skin cells collected by buccal scraping or swab, skin swab, or mouth washings
10. Sputum collected after saline mist nebulization.

 

You will need to submit a HIPAA Authorization to Use and Disclose PHI for Research Purposes.doc

Question:  What type of IRB review is required for a research project using specimens collected for research purposes by invasive means? What HIPAA form do I need to submit?

Research that involves the collection of specimens for research purposes by invasive means/using procedures that pose greater than minimal risk to participants must undergo full committee review by the IRB.

Examples of these invasive collections of specimens are:

• Collection of specimens through  a skin Biopsy
• Collection of specimen through a bronchoscopy, amniocentesis or colonoscopy.

 

You will need to submit a HIPAA Authorization to Use and Disclose PHI for Research Purposes.doc

Question: My research study involves collecting sputum and lung aspirates from clinical procedures involving chronic smokers that are otherwise going to be thrown away.  The specimens will be provided by the pathology department without identifiers. The pathologist will not be involved in the research.  Do I have to get IRB review?  If so, what HIPAA form do I need to submit?

 Answer: You do not need to submit an application for IRB review nor you need to submit a HIPAA form. Your research is considered secondary research that is not human subjects research because: (a) the specimens were originally collected for clinical care and not specifically for the purpose of the investigator’s current research, (b) the specimens do not come with individually identifiable information, and (c) there is no interaction or intervention done specifically for the research.

  

Section D- Questions related to the Privacy Rule & Recruitment Activities

 

The IRB may approve a research proposal in which an investigator will obtain information for the purpose of screening, recruitment or determining the eligibility of prospective subjects without the prospective subject’s HIPAA authorization, however the following conditions must be met:

• The investigator will obtain information related to screening, recruiting or determining eligibility through oral or written communication with the prospective subject.
• The investigator will obtain identifiable information or identifiable biospecimens for screening, recruiting or determining eligibility by accessing records or stored identifiable biospecimens.
• In order to access records or specimens for such purposes, there must be an established relationship between the investigator and the individuals whose records /specimens will be reviewed.  The investigator may delegate the review to designated UConn Health research staff.

 

Question: At what point in recruitment may we gather information about a potential participant (e.g., if a potential participant calls our office after seeing a flyer, may we screen that person/ ask them about their history, or do we need the person to complete a written HIPAA Authorization prior to screening)?

Answer: If the IRB has approved your recruitment plan, including a partial waiver of Authorization to permit you to collect PHI for screening without written Authorization, you may take the person’s contact and screening information.  Investigators must also submit to the IRB a phone script using the Sample Phone Script for Screening Prior to Consent.doc . The IRB must approve the script prior to collecting information from potential participants over the phone.

The potential participant should know that in order to evaluate whether he or she is a candidate for the research, the researcher will need to share the caller’s information, and the caller may need to share information, with a limited number of others who staff the study.  If the person is deemed qualified for the study, then he/she will be asked to come in to sign an informed consent and a HIPAA Authorization. To protect the privacy of the potential participant all the information they provide will be kept only if he/she qualifies to proceed and decides to participate in the study.

 

Section E- Questions Related to HIPAA Identifiers and Coded Data/Specimens

 

  Question: HIPAA specifies18 identifiers that must be removed to “de-identify” health information.  Is any one of these identifiers, all by itself, PHI?

 Answer: Not necessarily. PHI is information, including demographic information, which relates to (i) the individual’s past, present, or future physical or mental health or condition; (ii) the provision of health care to the individual; or (iii) the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual.  If the only identifier you have is a DOB and that DOB is not linked to any other health information and could not be sourced to a provider (e.g., UConn Health), the DOB alone would not be PHI.  However, if the DOB is coupled with other information, such as “a patient at UConn Health,” or “was one of 15 enrollees in a particular study,” this combination would be PHI.

 

 Question: What coded information or coded specimens means?

The Office of Human Research Protections (OHRP) has defined coded as:

•  identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code);

and

• a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.

 

 OHRP considers the term investigator to include anyone involved in conducting the research. OHRP does not consider the act of solely providing coded private information or specimens (for example, by a tissue repository) to constitute involvement in the conduct of the research. Note that if the individuals who provide coded information or specimens collaborate on other activities related to the conduct of this research with the investigators who receive such information or specimens, then OHRP would consider such additional activities to constitute involvement in the conduct of the research.

Examples of such additional activities include, but are not limited to:

(1) The study, interpretation, or analysis of the data resulting from the coded information or specimens; and

(2) Authorship of presentations or manuscripts related to the research.

   

Question: Is coded information identifiable?

 Answer: The Privacy Rule considers coded information to be de-identified if the 18 specific identifiers of the individual or of relatives, employers, or household members of the individual, listed below are coded and the person cannot reasonably be identified.

However, that code needs to be assigned by someone other than the investigator.  The code cannot be derived from any identifiable piece of information or combination of pieces of identifiable information.  The key to the code cannot be accessible to the investigator or research personnel using the de-identified data.

• Names;
• Address (including street address, city, county, zip code). The initial three digits of a zip code may be used if, according to the current publicly available data from the Bureau of Census: 1) the area formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and 2) the initial three digits of a zip code for a region containing 20,000 or fewer people is changed to 000;
• All elements of dates (except year) for dates directly related to an individual (birth
• date, admission date, discharge date, date of death), and all ages over 89 and all elements of dates (including year) indicative of such age, except that ages and  elements may be aggregated into a single category of age 90 or older;
• Telephone numbers;
• Fax numbers;
• Electronic mail addresses;
• Social Security numbers;
• Medical record numbers;
• Health plan beneficiary numbers;
• Account numbers (bank, retirement, credit card, etc.);
• Certificate/license numbers;
• Vehicle identifiers and serial numbers, including license plate numbers;
• Device identifiers and serial numbers;
• Web Universal Resource Locators (URLs);
• Internet Protocol (IP) address numbers;
• Biometric identifiers, including finger and voice prints;
• Full face photographic images and comparable images; and
• Any other unique identifying number, characteristic or code.

 

REFERENCES

 HIPAA Privacy Rule and Its Impacts on Research (nih.gov)

• Coded Private Information or Specimens Use in Research, Guidance (2008)

• 2011-014.0.pdf– Health Insurance Portability and Accountability Act (HIPAA) in Research 

• Use and Disclosure of Protected Health Information.pdf

 

 

 

The Association for Accreditation of Human Research Protection Programs
UConn Health Human Subjects Protection Programs Preparation for Reaccreditation

The Association for Accreditation of Human Research Protection Programs (AAHRPP) is an independent, non-profit accrediting body that works to protect the rights and welfare of research participants and promotes high-quality research through an accreditation process.

AAHRPP’s accreditation standards meet or exceed U.S. federal regulatory requirements and the International Committee on Harmonisation –Good Clinical Practice (E6) guideline for protection, and are reasonable, attainable, and representative of current best practices.

UConn Health’s Human Subjects Protection Program (HSPP) achieved AAHRPP accreditation in 2006. As an accredited organization, our HSPP must periodically apply for re-accreditation every five years. This is a two-step process.

Step 1, consists of a self-evaluation of our program, followed by an AAHRPP review of our policies and procedures to ensure they meet regulatory and accreditation standards.

Step 2 is an onsite visit by AAHRP representatives to ensure that our policies and procedures are followed. Once our HSPP is scheduled for the reaccreditation visit an announcement will be sent to the research community.

To complete the reaccreditation step 1, the HSPP has revised multiple IRB policies to reflect our current practices, add required information and standards for accreditation.

In the tables below is a list of the IRB polices and forms that have been revised along with a short summary of the revisions.

If you have questions regarding those changes please send an email to either irb@uchc.edu or contact the Education Specialist at cagganello@uchc.edu , 860-679-8802.

2009-001.0.pdf – Reporting Unanticipated Problems to the Institutional Review Board: Edited section under “Self-Reporting” to clarify that the Principal investigators are to report to the IRB any noncompliance with the protocol or directives of the IRB that was within the control of the research team within 5 business days of becoming aware of the event.

2009-003.0.pdf – Imposing and Lifting Suspensions of IRB Approval or Imposing Terminations of IRB approval: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2009-005.0.pdf – Monitoring of IRB Approved Studies: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-006.1.pdf – Additional Protections – Pregnant Women, Fetuses or Neonates: Minor grammar changes.

2011-006.4.pdf – Additional Protections – Other Vulnerable Groups: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-006.5.pdf – Additional Protections – Fetal Tissue Transplants: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-007.0.pdf – Definitions Applied to Policies: Added definition of benign behavioral intervention. Edits to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their).  Included revised common rule.

2011-008.1.pdf – Informed Consent – Process The general section was revised to request information about the informed consent methods and documentation and to alert the investigator that prospective IRB approval is required for any subsequent modifications made to the methods of obtaining consent or documentation of informed consent whether they are done by hard copy or electronically.

• Changes to the process of obtaining consent by Phone / Fax to include that the individual obtaining consent must be approved by the IRB to consent and that such individual should have sufficient knowledge of the study to conduct the conversation and to answer any questions,; and the consent conversation should include an in-depth review of the consent document allowing sufficient time for questions to be asked and answered.
• The process for obtaining consent via videoconference (e.g., WebEx, Zoom) was added with an explanation of how this process must be conducted.
• A section about obtaining electronic documentation of consent was added with details of compliance expectations and acceptable methods and processes to obtain electronic signatures.
• A section about electronic informed consent process when consent is not witnessed by study personnel was added to alert researchers that the investigator planning to use this method should discuss this plan with the IRB prior to submitting this method for approval to ensure this method is appropriate for the research (e.g., in compliance with applicable regulations).
• Edits to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their).

2011-008.5.pdf – Informed Consent – Providing and Obtaining Informed Consent: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-009.0.pdf– Institutional Review Board – Membership: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-009.11.pdf – Institutional Review Board – Studies Conducted in Foreign Locations: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-009.14.pdf – Institutional Review Board – Human Subject Research Determinations: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-009.2.pdf – Institutional Review Board – Exemptions: Policy was edited to remove language related to pending adoption of the revised common rule and revisions to applicability of exemption 4(iii) at UConn Health.

2011-009.3.pdf – Institutional Review Board – Expedited Reviews : Policy was revised to include a complete list of the criteria for approval when conducting initial or continuing review for expedited submissions. In addition, when submissions are returned to the investigators with a status of “Approved Contingent,” the IRB reviewer can now add a deadline for the investigator to respond to the contingencies sent in a Response form.

2011-009.4.pdf – Institutional Review Board – Convened Meeting Operations: Policy was revised to add that when virtual IRB meetings are conducted the agenda item (inclusive of supporting documents) are shared on the screen in the videoconference.

2011-009.7.pdf – Institutional Review Board – Assignment of Status Codes: Policy was revised to clarify the IRB will assign the study status code “Closed by PI” to a study under oversight of an external IRB when the external IRB grants the request.  Under the status code title: “Inactive-Administratively Closed” the following was added: the IRB Administrator will assign this status code to exempt research after the anticipated completion date has passed.

2011-009.8.pdf – Institutional Review Board – Appeals Process: Policy was revised to indicate that when a principal investigator (PI) submits an initial appeal letter, it can be completed through a written correspondence (i.e., not limited to IRIS response).  Also, the letter sent by the IRB in response to the appeal made by the PI will contain a wet-ink or electronic signature of the IRB Chair.  In addition some edits were made to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their).

2011-009.10.pdf – Institutional Review Board – More Frequent Review: Policy Appendix -A was revised to remove Panel 3 and CICATS.

2011-009.12.pdf – Institutional Review Board – Criteria for Approval: Policy was revised to clarify that students can be considered subjects who are likely to be vulnerable to coercion or undue influence.  In addition, policy revised to remove language indicating ‘if’ the revised common rule is implemented (see section describing limited IRB review).

2011-009.13.pdf – Institutional Review Board – Lapse in IRB Approval: Policy was revised to describe that investigator are notified either by email or iRIS correspondence about the need to submit a request for extension of the anticipated completion date or close the study.

2011-009.15.a.pdf – Institutional Review Board – Reliance on UConn Health as IRB of Record: Policy was revised to indicate SMART IRB template may be used to execute reliance agreements. The Office of Human Research Protection reliance agreement template was removed as it not preferred since it does not meet AAHRPP standards.

2011-009.15.b.pdf – Institutional Review Board – Reliance on External IRB: Trinity Health was added as an institution with which UCONN Health has an established collaborative agreement for minimal risk studies conducted by a student, fellow or resident. Also, policy now contains that when requesting reliance on an external IRB for a student/resident/fellow project, UCONN Health IRB may request the original approval letter to ensure the research is minimal risk.

2011-011.0.pdf – Research Personnel: Policy revised to include principal investigator (PI) responsibility to ensure the confidentiality and security of research records and data as described to the IRB in the submission materials, and to cooperate with all aspects of internal or external audits and inspections.

2011-012.0.pdf – Conflict of Interest – Research Personnel: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-012.1.pdf – Conflict of Interest – IRB Members: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-015.0.pdf – Recruitment and Payment:  Policy was revised to indicate that external researchers looking to advertise recruitment in UConn Health broadcast (e.g., Lifeline) messages do not need HSPP/IRB permission. Also revised to include procedure to use UConn Health as a recruitment site when UConn Health is not engaged.   Added edits to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their).

2011-016.0.pdf – Scientific Review: Policy was revised to include the Clinical Research Center and funding foundation as acceptable entities who may have conducted the scientific review of studies submitted for full board review.

2011-020.0.pdf – Humanitarian Use Device: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-022.0.pdf – Study Drug – General: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-022.2.pdf – Investigational Drug/Biologic – Expanded Access for Treatment Use, Including Single Emergency Use: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-023.0.pdf – Educational Requirements: Updated to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their) and minor punctuation and grammar changes.

2011-025.0.pdf – HSPP Evaluation / Institutional Support: Policy was revised to include minor updates to title of HSPP manager, and removing executive committee.

2014-034.0.pdf – Additional Requirements – Department of Education (Federal): Policy was revised to include that an email confirming with all of the information included in the FERPA verification form may be acceptable, provided the email is from the person at the school with the authority to grant the permission and sent from that individual’s institutional email address.  Added edits to reflect current guidance on diversity, equity and inclusion (change he/she to they, his/her to their).

Application Checklist for Initial Exempt Application  .doc: Exempt submission checklist Added the following requirements:  When submitting for Exempt determination under Exempt category 4.iii a confirmation that the data will remain protected under HIPAA for 4.iii is required.   If the protocol involves sharing data with indirect identifiers such as sharing a Limited Data Set with an external investigator the UConn Health investigators should provide confirmation they have in place a Data Use Agreement.    If the protocol involves sharing coded data the UConn Health investigators should provide confirmation they have a Don’t Ask /Don’t Tell agreement in place.

Application Checklist for Initial and Continuing Review Expedited .doc : Expedited submission checklist Added the following requirement:
When using electronic informed consent (eIC) (confirmation of part 11 compliance, hard copies of materials, access to eIC platform)
Application Checklist for Initial and Continuing Review Full Board.docx

Application Checklist for Initial and Continuing Review Full Board.docx : Added the following requirement : When using electronic informed consent (eIC) (confirmation of part 11 compliance, hard copies of materials, access to eIC platform).

Request for Exemption Form .doc: Request for Exemption Category 4.iii. was revised to be less restrictive but still ensure HIPAA protection for review as required under the exemption.

 

Guidance on Closure of Human Subject Research Studies

 

A research study should be closed by the Principal Investigator (PI) once all human research activities are completed regardless of whether a study is subject to the continuing review requirement. To do so, a closure form should be submitted to the IRB through the iRIS submission system for each non-exempt human research study (e.g., studies approved under Expedited review or Full Board review). The closure form should be submitted before the expiration of IRB approval, however, the PI can also submit a closure form after they have received a notice of lapse of approval.

If the study is an exempt study, the PI may allow the IRB approval to expire. When approval of an exempt study expires, the IRB will administratively close the study, but this does not invalidate the exemption. The research, as proposed to the IRB, may continue; it is not necessary to keep the exemption actively registered with the IRB.

A closure form allows the IRB to have a summary of the following information:
• the findings of the study
• the final enrollment data
• whether the study met the recruitment goals, and
• whether any of the following events occurred since the last approval (initial or continuing review):
o subject complaints
o unanticipated problems involving risk to subjects or others,
o unexpected profile of adverse events in terms of frequency and/or severity,
o non-compliance with or deviation from the approved protocol or procedures,
o audits, inspections or monitoring visits by internal or external personnel.
o any publications, presentations, trademarks, patents, etc. related to the study.

This guidance explains the circumstances in which a non-exempt human research study may be closed from IRB oversight, as well as ongoing researcher responsibilities that apply to closed studies.

Things to Consider before Closing Research Studies

• Investigators should honor wishes of the sponsor or funding source to keep the study open or to close the study. Some funding entities require IRB approval for the duration of the funding, even if human research activities are complete, or they may not allow the study to close without the sponsor’s permission. It is the PI’s responsibility to be aware of, and comply with, those requirements.

• Sponsors, contract research organizations (CROs), or coordinating center personnel may need to verify or monitor individually identifiable study data at a specific site where human subjects activities have been completed. The study team should verify whether these organizations require the studies to be open when conducting their monitoring visits. IRB approval must be maintained while these activities are occurring.

• Whenever possible, prior to closing a study, data should be permanently de-identified.

When to Close a Study

• For studies requiring continuing review (e.g., some Expedited studies and all full board studies ) a requests for closure should be submitted at the time the next continuation application is due or within 30 days after the completion of all study activity involving the use of private identifiable information or biospecimens, whichever comes first.

• Moreover, a closure form should be submitted to the IRB if the if the research study was not conducted or was canceled, or if each of the following conditions exist:
o The research is permanently closed to the enrollment of subjects
o The subjects have completed all research-related interventions
o The research is no longer active for long-term follow up of subjects
o Data has been de-identified.

• When a Principal Investigator terminates employment with UConn Health, the PI may submit a closure form to the IRB. Alternatively, the PI may submit a modification form requesting transfer of the study to another eligible Principal Investigator.
Retired investigators with Emeritus status at UConn Health may be permitted to keep the study open and continue as the PI with approval from the HSPP Director.

• When a student-led project is completed, the study should be closed with the IRB. This should occur prior to the student’s departure / graduation.

IRB Process of Expired studies, Lapsed Studies and Closure Forms

• Expired studies: If approval for continuation of non-exempt research is not sought, or a request to extend the expected completion date has not been received within a reasonable time frame (e.g., 30 days), IRB staff will administratively close the study and send a written notification to the Principal Investigator of the administrative closure. The research activity may not continue and a new application may be required to resume research activity.

• Lapsed studies: If approval of the study has lapsed due to lack of a response to contingencies or a request for continuing approval or to extend the completion date has not been received the study may administratively be closed. The IRB will send a written notification to the PI. Prior to closure the IRB will issue a final request for response by email to the PI and study contacts and the PI will be given a reasonable period within which to respond (e.g. one or two weeks).

• Closure forms: When a closure form is submitted, the IRB will review any new information provided in the closure form and determine whether any additional action is required on the part of the IRB or the investigator. Upon review of the closure form, the status of the study is changed in the iRIS system (e.g., “Closed by PI”) and an outcome letter is issued confirming the closure.

Principal Investigator Responsibilities with Closed Studies

The principal investigator (PI) continues to have responsibilities for a study even when IRB oversight of a study is no longer required. These responsibilities include:

• Verifying all research activities have been completed. The PI should ensure that all research-related activities, interventions or interactions with human subjects or individually identifiable data have been completed at the site(s) approved under the Principal Investigator’s IRB application at the time a closure form is submitted to the IRB or at the time of approval expiration, whichever occurs first.

If after a study is closed, the PI wishes to engage in an activity such that the criteria for closure listed above would no longer be met, the Principal Investigator must submit a new application for IRB review and approval for the use of the previously collected data.

• Record Retention Research data from the completed study should be stored and protected in the manner approved by the IRB and consented to by the research participant so as to maintain the privacy and confidentiality of the participants.

Per HSPP Policy 2011-024.0.pdf – File Requirements & Record Retention Requirements , investigators must maintain research records for three years beyond the completion/termination of the study. Investigators should be aware that other laws and requirements (e.g., funding agency) may require a longer record retention period. Per the HIPAA regulation, investigators are to retain documents relating to uses and disclosures, authorization forms for 6 years from the date of creation or the date when it last was in effect, whichever is later.

Investigator should be familiar with the record retention format described in the UConn Health HSPP Policy 2015-024.1.pdf – Record Retention Format .

Investigators should ensure that any specific regulatory and/or sponsor requirements are met for record retention or submission of reports.

• Confidentiality and Data Security. If the PI is maintaining identifiable private data or specimens, the protections described in the IRB application and to subjects must be maintained for the time frame described. The PI must continue to honor any commitments made to participants as part of the approved research (e.g., providing information about study results; payment for research participation).

• HIPAA authorization. The PI may have obtained HIPAA authorization from subjects to access their medical records, with an expiration date that is far in the future. If the PI still has permission to access medical records at the time they want to close the study that permission expires upon study closure.

 

 

U.S. Department of Health and Human Services Food and Drug Administration
Common Inspection findings from 2017-2022

 

The Food and Drug Administration (FDA) has released their Bioresearch Monitoring (BIMO) Fiscal Year 2022 Metrics. Below is a partial description of the common inspection findings from 2017-2022. The full report can be found here: https://www.fda.gov/media/165853/download

Common Sponsor-Investigator Inspectional Observations:
• Failure to maintain and/or retain adequate records in accordance with 21 CFR 312.57; accountability for the investigational product; Investigator Statement (FDA 1572); Financial disclosures.
• Failure to select qualified investigators and/or monitors, ensure proper monitoring of the study and ensure the study is conducted in accordance with the protocol and/or investigational plan.
• Failure to submit an Investigational New Drug (IND) application.
• Inadequate subject protection; informed consent issues.
• Failure to notify FDA of termination of investigator.

Common Sponsor/CRO Inspectional Observations:
• Failure to ensure proper monitoring of the study and ensure the study is conducted in accordance with the protocol and/or investigational plan.
• Failure to meet the abbreviated requirements for investigational device exemptions (IDEs).
• Failure to maintain and/or retain adequate records in accordance with 21 CFR 312.57; accountability for the investigational product; Investigator Statement (Form FDA 1572); Financial disclosures.
• Failure to submit an Investigational New Drug (IND) application; IND safety report.
• Failure to submit current list of all participating investigators to FDA at six-month interval after FDA approval of the study.

Common Clinical Investigator Inspectional Observations:
• Failure to comply with Form FDA 1572 requirements, protocol compliance
• Failure to follow the investigational plan; protocol deviations
• Inadequate and/or inaccurate case history records; inadequate study records
• Inadequate accountability and/or control of the investigational product
• Safety reporting; failure to report and/or record adverse events
• Inadequate subject protection; informed consent issues

 

Difference Between De-Identified Data Sets and Limited Data Sets
&
Limited Data Sets and Data Use Agreements

 

Under the Health Insurance Portability and Accountability Act (HIPAA) de-identified data is data from which all 18 HIPAA identifiers that could be used to identify an individual or the individual’s relatives, employers, or household members have been removed.

Unlike a de-identified data set, a limited data set is still considered Protected Health Information (PHI). As defined by HIPAA, limited data sets (LDS) are data sets stripped of certain direct identifiers that are specified in the Privacy Rule. They are not de-identified information under the Privacy Rule.

A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual: (1) names; (2) postal address information, other than town or city, State, and zip code; (3) telephone numbers; (4) fax numbers; (5) e-mail addresses; (6) social security numbers; (7) medical record numbers; (8) health plan beneficiary numbers; (9) account numbers; (10) certificate/license plate numbers; (11) vehicle identifiers and serial numbers; (12) device identifiers and serial numbers; (13) web URLs; (14) Internet Protocol (IP) address numbers; (15) biometric identifiers, including fingerprints and voiceprints; and (16) full-face photographic images and any comparable images.

Distinct from de-identified data, a limited data set contains protected health information that is associated with indirect identifiers as defined in the HIPAA privacy rule. Protected health information in limited data sets may include the following indirect identifiers: town, city, state and zip code, and dates directly related to an individual, including birth date, admission date, discharge date and date of death.

The table below describe in detail the HIPAA identifiers that must not be present in a de-identified data set or in a limited data set.

 

 

DATA ELEMENT	DE-IDENTIFIED DATA SET	LIMITED DATA SET
Names.	Remove	Remove
Postal address information.	Remove	Remove
Town, city, state and zip code.	Remove	Can retain city, town, state or full zip code.
All elements of dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older.	Remove	Remain
Telephone numbers, fax numbers; e-mail addresses, web URL addresses, IP addresses.	Remove	Remove
Social security number, medical record number, health plan beneficiary number, any account number, certificate or license number.	Remove	Remove
Vehicle identifiers and serial numbers, including license plate numbers, Device identifiers and serial numbers.	Remove	Remove
Full-face photographic images and any comparable images, Biometric identifiers, including fingerprints and voiceprints.	Remove	Remove
Any other unique identifying number, characteristic or code.	Remove	Remove

 

Limited Data Sets and Data Use Agreements

If indirect identifiers must be kept within a limited data set (LDS) in order to perform a research study and the information is to be disclosed outside of UConn Health, the principal investigator must enter into a Data Use Agreement (DUA) with the data recipient. A DUA may also be utilized when UConn Health is the  recipient of a LDS. Only after the agreement has been executed can the limited data set be used/disclosed.

This DUA is required under the HIPAA Privacy Rule. This agreement establishes the ways in which the information in the limited data set may be used, the purpose for which it was disclosed, and identifies who is permitted to use or receive the information.

Moreover, the DUA stipulates that the recipient will use appropriate safeguards to maintain the confidentiality and protect the data from further disclosures.

Since the data use agreements establish institutional obligations and bind the institution to the terms of the agreement, investigators are not authorized to execute research DUAs. UConn Health DUAs for research related activities are processed through the Office of Sponsored Programs Sponsored Program Services (SPS) or the Office of Clinical and Translational Research (OCTR). The specific contacts in these offices are listed below:

• If the DUA is related to a Clinical Trial contact: Donald Deyo, Contract Specialist (deyo@uchc.edu), or the OCTR main inbox (octrclinicaltrial@uchc.edu).

• If the DUA is unrelated to a Clinical Trial contact: Jennifer Pomales pomales@uchc.edu

The table below describes whether IRB review approval is required for a de-identified data set or for a limited data set, and when a Data Use Agreement is required.

 

	DE-IDENTIFIED DATA SET	LIMITED DATA SET
IRB Review/Approval	IRB and Investigator can determine the project /research is Not Human Subject research. May be used in any manner, not regulated under HIPAA.	If the data is not readily identifiable, IRB can determine Not Human Subject Research. IRB does not require HIPAA Authorization or Waiver.
Data Use Agreement	Not required.	Required. UConn Health DUAs for research related activities are processed through the Office of Sponsored Programs Sponsored Program Services (SPS) or the Office of Clinical and Translational Research (OCTR).

 

OHRP’s Common Rule Webinar

Join the introduction-level, webinar titled “Unlocking the Mysteries of the §46.111 Criteria for IRB Approval of Research.”

This presentation will explain the criteria for IRB approval of research and include case studies and interactive quizzes to demonstrate the way the criteria can be applied.
Date: Tuesday, July 11, 2023, 12:00 PM EDT
Spots are limited. Registration is required to attend and receive a certificate of attendance.

Register for this webinar at: https://www.zoomgov.com/webinar/register/WN_9RbRyAwjQY2N_kRxFPbT-w