Basic Exempt Criteria 45 CFR 46.101(b)(4)
Research studies involving the retrospective review, collection and analysis of medical record information are descriptive studies that ordinarily seek to evaluate relationships between one or more biomedical, treatment, and/or demographic variables and one or more outcome measures in patients. Data may include a wide range of information from the medical record (e.g., results of lab tests, nursing and physician notes, summary reports - including intake and discharge summaries and consultant reports, raw data from electrophysiological or imaging tests, etc.). Because this research involves medical records, compliance with the HIPAA Privacy Rule (46 CFR Part 160; Part 164 (subparts a,e) ) is required.
The University of Pittsburgh IRB recognizes three somewhat different pathways for conducting these studies, depending on (a) whether the investigator recording information has patient care responsibilities, and (b) whether identifiable information will be recorded. Note that in the latter case, investigators who wish to record identifiable information must request a waiver of informed consent/HIPAA authorization. This is NOT an exempt application.
A. Recording of Medical Information, Without Identifiers, By or Under the Oversight Of a Principal Investigator Who Would Normally Have Access to this Information by Virtue of His/Her Patient Care Responsibilities:
An investigator may personally review medical records and abstract relevant data from the medical records if ALL of the following conditions are met:
- All medical records to be accessed for study are currently in existence at the time of the IRB submission.
- The desired medical record data is recorded by the investigator in such a way that the patients cannot be identified (i.e., by the investigator or others) either directly, or indirectly via linkage codes assigned to the data. This means that the investigator cannot link names, social security numbers, or any other patient identifiers to the data set. As a consequence, the resulting research data set is necessarily completely anonymous. For that reason, once the information has been extracted from the medical record, it will not be possible for the investigator to go back to the medical record and add other patient-specific information to this research dataset.
- The principal investigator (PI) of the research study has legitimate access to the desired medical information insofar as he or she is a UPMC staff member and/or has been granted UPMC privileges and provides related care (i.e., related to the information desired) to the patients, or is in the position to provide related care (including treatment, and/or diagnostic services) to the patients. For example, any health professional providing patient care to a particular set of patients (e.g., all patients treated in the Emergency Department; all patients with aphasia; all patients undergoing CT scans), would ordinarily have access to the related medical record information of those patients as part of his or her current or future job responsibilities, and hence would be in a position to serve as the P.I. of a research study involving a retrospective review of those medical records (regardless of whether he or she actually provided direct care to those particular patients). Note that the University IRB will not approve a retrospective medical record research study if the medical record information desired is not in some way related to the patient care responsibilities of the listed PI.
This application also requires a request for a waiver of HIPAA authorization.
Exempt Form: Medical Record Review by Investigator with Patient Care Responsibilites
B. Recording of Medical Information, Without Identifiers, By a Principal Investigator Who Does Not have Patient Care Responsibilities
- If the PI the retrospective research study does not provide related care, or is not in the position to provide related care, to the patients whose medical records are being accessed, it is recommended that the investigator utilize the services of a University IRB certified honest broker system. The honest broker accesses the desired medical record information on behalf of the PI and provides the PI with an appropriately de-identified data set - either a completely de-identified data set ("HIPAA Safe-Harbor") or a data set that includes patient-specific dates and/or geographical information ("Limited Data Set").
Use of an IRB-certified honest broker system ensures compliance with both the Federal Policy and HIPAA Privacy Rule regulations since no identifiable medical record information is being obtained or used directly by the investigators. Hence a waiver of the requirement for informed consent and/or HIPAA authorization is not necessary.
In addition, there is no requirement that all of the desired medical record information must be in existence at the time of IRB submission. That is, the honest broker can assign a code number to the data given to the investigator provided that the investigator does not have access to the information linking this code number to the identities of the respective patients. Using this code number, the investigator can request, through the honest broker, additional medical information corresponding to a given patient. From an IRB perspective, this type of application (where all data are not currently available for study) would meet criteria for 'no human subjects' involvement (45 CFR 46.102(f)).
Exempt Form: Medical Record Review Using Certified Honest Broker