The IRB shall review, and base its study approval upon, strategies proposed by the principal investigator to ensure the privacy of research subjects. Privacy issues for IRB evaluation should include (as applicable):
- the time and place where information is provided by participants to investigators
- the nature of information provided by participants
- the nature of the experiences the participants will undergo as a result of the study
- who shall receive, access and use information provided by participants
- factors that may determine what is private to an individual such as gender, ethnicity, age, socio-economic class, education, ability level, social or verbal skill, health status, legal status, nationality, intelligence or personality
- the participant’s relationship to the investigator
- the presence of others (such as parents) during data gathering
Studies requesting the use of existing, identifiable subject information for research other than that contemplated by the originally approved research protocol require IRB examination of the risks involved. The IRB shall determine whether the new use is within the scope of the original consent or whether it is necessary to obtain additional consent.
For studies in which HIPAA regulations apply (see below), the principal investigator must obtain IRB approval and provide the privacy offices of UM and/or JHS and/or other covered entities with copies of:
- the IRB’s determination letter; AND
- the HIPAA Authorization forms; or documentation of a Waiver and/or Partial Waiver of HIPAA Authorization; OR
- the IRB determination letter approving the use of a Limited Data Set; OR
- documentation that the requirements for decedent research or research preparatory to a study have been met.
Note – when privacy offices of UM and/or JHS allow an investigator access to PHI to generate his/her limited data set, the investigator will be considered a Business Associate in performing this function and a business associate agreement shall be required with signature by an authorized signatory.
For all studies involving PHI (with the exception of those creating limited or de-identified data sets) the principal investigator must assure, for IRB approval, that only the minimum necessary information is being requested and that any PHI created for research will be entered into the medical record or Designated Record Set.