VCOM Institutional Policy and Procedure Manual

VCOM Policy and Procedure

Policy #R004

14.6. Record Retention As with all protocol related materials, a copy of the approved consent documents (not the signed consent forms themselves) shall be retained by the IRB for a minimum of three (3) years following the end of the study. For a definition of “Protected Health Information” see the Section 3. Definitions . Protocol records including the signed informed consent forms must be kept for at least 3 years (6 years if PHI), after which the signed informed consent forms must be effectively destroyed and therefore no longer accessible to anyone. The VCOM IRB does not retain signed informed consent forms for investigators. These requirements are the responsibility of the principal investigator and must be considered at all times. A copy of the signed consent form must be provided to the person giving consent. 15. HIPAA & IRB REVIEW HIPAA is the Health Insurance Portability and Accountability Act of 1996, which includes regulations that specifically address the use of “protected health information” in research. For a definition of “Protected Health Information” see the Section 3. Definitions . HIPAA information privacy requirements are additional to ethical and regulatory protections for human research subjects and do not supersede them. The HIPAA Privacy regulations are focused on privacy and security protections for individuals’ health care information that is termed protected health information (PHI). If a research study either uses or creates protected health information, HIPAA documentation requirements apply to those research uses of protected health information in addition to relevant privacy and confidentiality protections that are required by ethics and federal regulation for human research subject protection. The VCOM IRB will perform the following HIPAA review and approval responsibilities within the larger context of its responsibilities for the protection of human research participants that include review of privacy and confidentiality issues broader than those covered by HIPAA: • Review and approval of all authorization documents used by VCOM researchers in the informed consent process for VCOM research. • Review and approval of all waivers of authorization, included limited waivers of authorization, for access, use and/or disclosure of PHI for VCOM research purposes. 15.1. HIPAA Authorization and Informed Consent For VCOM research that includes the creation or use of PHI, in addition to following the informed consent procedures described in Section 8. Record Keeping , researchers generally must also obtain authorization for use of PHI from the human subjects whose PHI will be included in the study. The authorization document must include all elements defined in HIPAA. An authorization for access, use or disclosure of Psychotherapy Notes for research may not be combined with any other authorization except another authorization for access, disclosure or use of the Psychotherapy Notes. The VCOM IRB provides an authorization template that complies with HIPAA requirements. The researcher must customize the authorization template for the specific study he or she intends to perform and submit this customized form to the IRB for its prior review and approval.

VCOM Institutional Review Board Policies and Procedures

Page 30 of 40