Which Projects Must be Submitted to the IRB - UPDATE
September 2020 Issue
Author(s):
PRINT
Introduction
Any project that meets the definition of research with human subjects and/or that is subject to FDA regulations must be submitted to the IRB for approval or for an exemption determination prior to conducting any research activities. Projects that do not meet the definition of human subjects research, known as “Not Human Subjects Research,” generally do not need to be submitted to the IRB.
However, this article describes a new requirement, effective October 1, 2020, that submission to the IRB is required for projects that use publicly-available information. It also briefly clarifies the circumstances under which submission to the IRB is required solely to meet HIPAA requirements (please consult this link for a more complete discussion of HIPAA). If you have any questions about whether submission is required, please contact the IRB at medirb@bu.edu.
Decision Algorithm for Submitting to the IRB
1. Is the project “research” (as defined by the Common Rule)?
RESEARCH means a systematic investigation (including research development, testing, and evaluation) designed to develop or contribute to generalizable knowledge.
Examples of projects that do not constitute research are case series involving three or fewer patients and quality improvement projects.
⇒ If the project does not meet the definition of research, no IRB submission is required (although investigators may submit to request a determination letter from the IRB that the project is not research).
⇒ If the project does meet the definition of research, continue to question 2.
2. Does the research involve “human subjects” (as defined by the Common Rule)?
HUMAN SUBJECT is defined as a living individual:
- About whom a researcher obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or
- About whom a researcher obtains, uses, studies, analyzes, or generates identifiable private information about the individual or identifiable biospecimens.
Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record).
Identifiable private information is private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information).
⇒ If the research does meet the definition of involving human subjects, then IRB submission is required (using the review path appropriate to the research: ceded, exempt, chart review, or non-exempt).
⇒ If the research does not meet this definition, continue to question 3.
3. Does the research use “Health Information” (as defined by HIPAA)?
HEALTH INFORMATION is information that relates to the individual’s past, present, or future physical or mental health or condition; the provision of health care to the individual; or the past, present, or future payment for the provision of health care to the individual. The health information that is potentially protected by HIPAA (if it is individually identifiable, see below) is health information that is held or transmitted by a HIPAA-covered entity. Note: BMC is a HIPAA-covered entity, but only certain designated components of Boston University are covered by HIPAA (see BU’s HIPAA covered components).
In this algorithm for submitting to the IRB, this question would only need to be asked if the research uses information that is not identifiable under the Common Rule. However, HIPAA has a broader definition:
Individually identifiable health information means that the information identifies the individual or there is a reasonable basis to believe it can be used to identify the individual. Health information can be de-identified if all of the following identifiers are removed (of the individual or of relatives, employers, or household members of the individual):
- Names
- Geographic subdivisions smaller than a state, except the initial three digits of the ZIP code are not an identifier if encompassing more than 20,000 people
- All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date (and ages over 89 unless aggregated into a single category of age 90 or older)
- Telephone numbers
- Fax numbers
- Email addresses
- Social security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers and serial numbers, including license plate numbers
- Device identifiers and serial numbers
- Web Universal Resource Locators (URLs)
- Internet Protocol (IP) addresses
- Biometric identifiers, including finger and voice prints
- Full-face photographs and any comparable images
- Any other unique identifying number, characteristic, or code, including any code that includes or is derived from any of the identifiers on this list.
A study could, therefore, involve health information that is “individually identifiable” (under HIPAA) but not “readily ascertainable” (under the Common Rule). For example, if the data identified people only by their record numbers assigned in a clinical trial (and the researchers had no access to the corresponding names), this would generally not be considered identifiable under the Common Rule, but would be considered identifiable under HIPAA category 18 above.
⇒ If the research does use health information from a covered entity, IRB submission is required (using the Not Human Subjects Research review path if the identities are not “readily ascertainable”). The IRB will determine whether this study requires an authorization, a designation as involving a Limited Data Set, or a waiver of authorization.
⇒ If the research does not use health information from a covered entity, continue to question 4.
4. Does the research use publicly-available information? - NEW
PUBLICLY-AVAILABLE INFORMATION means information that is readily accessible to everyone and does NOT meet the definition of private information:
Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record).
Examples of such research include observation of public behavior and analysis of public social media postings.
Because of ever-evolving accessibility provisions and privacy expectations, the BMC and BU Medical Campus Human Research Protection Program made the decision to require the review of projects using publicly-available information by someone other than the investigator. The IRB’s review, with potential assistance from the relevant communications department and/or department chair or section chief, will assess whether the information being used qualifies as publicly available and whether any additional safeguards are needed.
⇒ If the research involves the use of publicly-available information, then IRB submission is required (using the Not Human Subjects Research review path if the only project activities are analysis of publicly-available information).
⇒ If the research does not use publicly-available information and does not otherwise qualify as research with human subjects (e.g., analysis of non-health information that is anonymous or coded with the investigator having no access to the code), no IRB submission is required (although investigators may submit to request a determination letter from the IRB that the project is Not Human Subjects Research).
When in Doubt…
Investigators who are unsure about whether their project conforms to any of the definitions in this article (research, quality improvement, intervention or interaction, covered entity, health information, identifiable, etc.) should contact the IRB at medirb@bu.edu. It's always better to err on the side of checking whenever there's a chance that submission is required. |