VCOM Institutional Policy and Procedure Manual

as a listed investigator on the respective research study. The honest broker accesses the desired medical record information on behalf of the PI and provides the PI with an appropriately de-identified data set: either a completely de-identified data set (“HIPAA Safe-Harbor”) or a data set that includes patient specific dates and/or geographical information (“Limited Data Set”). Use of an IRB-certified honest broker system ensures compliance with both the Federal Policy and HIPAA Privacy Rule regulations since no identifiable medical record information is being obtained or used directly by the investigators. Hence a waiver of the requirement for informed consent and/or HIPAA authorization is not necessary and there is no need for the VCOM IRB to track the use, on a patient-by-patient basis, of medical record information for research studies using this system. In addition, there is no requirement that all of the desired medical record information must be in existence at the time of IRB submission. That is, the honest broker can assign a code number to the data given to the investigator provided that the investigator does not have access to the information linking this code number to the identities of the respective patients. Using this code number, the investigator can request, through the honest broker, additional medical information corresponding to a given patient. From an IRB perspective, this type of application (where all data are not currently available for study) would meet criteria for “no human subjects” involvement (45 CFR 46.102.f) because (a) the investigators have neither interacted nor intervened with these individuals for research purposes, and (b) the use of the honest broker ensures that the investigators will not obtain private identifiable information. It is recognized that there may be situations in which investigators conducting retrospective medical record research need to collect information that includes patient identifiers (e.g., to link patient information obtained from multiple databases; to link existing patient information with new patient information) and do not have access to, or wish to use, an IRB-certified honest broker system. In accordance with the Federal Policy regulations and HIPAA Privacy Rule, the acquisition or use of accordance with the Federal Policy regulations and HIPAA Privacy Rule, the acquisition or use of identifiable medical record information for research requires both the written informed consent and HIPAA authorization of the involved patients, or VCOM IRB approval of a waiver of both of these requirements. The Federal Policy criteria (45 CFR 46.116.d) that must be addressed and justified (i.e., in the corresponding research protocol) in order for the VCOM IRB to grant a waiver of informed consent are as follows: 1. The research involves no more than minimal risk to the subjects. 2. The waiver of consent will not adversely affect the rights and welfare of the subjects. 3. The research could not practicably be carried out without the waiver. Regarding the second of these criteria, the VCOM IRB had minimal concerns that the privacy and confidentiality rights of the involved patients are being adversely affected if the PI of the research study is a VCOM staff member and/or has been granted VCOM privileges and provides related care to these patients, or is in the position to provide related care to these patients. That is, by virtue of his/her patient care responsibilities, the PI would already be permitted to access the patients’ medical care information. As outlined above, the VCOM IRB would also permit health professional students and research coordinators to access and obtain identifiable medical record information under the oversight and responsibility of such a PI. 4. W AIVER OF I NFORMED C ONSENT /HIPAA A UTHORIZATION