Conducting Research with Human Subjects: The IRB and HIPAA

Acknowledgements

	The following sources contributed immeasurably to the compilation of this information:
		IRB Guidebook, Department of Health and Human Services, 1991
		The Office for Human Research Protections, U.S. Department of Health and Human Services, http://ohrp.osophs.dhhs.gov/irb
		Introduction to Good Clinical Practices Course Workbook, Office of Clinical Trials, Columbia University, New York Presbyterian Hospital, 1998
		The Columbia University Good Clinical Practices and HIPAA Training Courses

Session Objectives

	Provide a brief overview of the principles and concepts of the Institutional Review Board (IRB) and Health Insurance Portability and Accountability Act (HIPAA)
	Provide a practical guide to students whose thesis research may require IRB approval/HIPAA compliance
	Facilitate completion of the two certification requirements of the Master’s Thesis I class
		Good clinical practices (GCP) certification (required)
		HIPAA certification (required)
		Conflict of interest statement (optional)

What is an IRB?

		An Institutional Review Board (IRB) is a ‘group formally appointed by an institution to review and approve biomedical research involving human subjects’
		Charged with administering Federally mandated regulations for Protection of Human Subjects
		A typical IRB must have at least five members with varying expertise and perspectives
		Membership of IRB is federally mandated to achieve the following:
			Necessary expertise
			Independence
			Balanced representation of multiple interests

Columbia University's IRB
Definition of a Human Subject

	Living individual about whom an investigator obtains data through:
		Interventions or interaction with the individual
		Other sources of private identifiable information

Purpose and Responsibilities of the IRB

	Represent the best interests of the patients or healthy volunteers who serve as research subjects
	The responsibilities of the IRB include:
		Review research and evaluate potential benefits and  risks to participants
		Ensure that the rights and welfare of subjects are safeguarded, including the fairness of selection procedures and proper management during the conduct of the study
		Ensure that all appropriate steps needed for true informed consent are planned and carried out

IRB Review Criteria for
Clinical Research Studies

		When reviewing any study known to involve risk, the IRB applies these criteria:
			Does the study design use methods that avoid all unnecessary risks and make use of accepted procedures for treating the illness or condition?
			Are risks to subjects reasonable in relation to anticipated benefits, if any, and the importance of the knowledge that may be expected to result?
			Is the method of subject selection equitable and appropriate given the purpose of the study?

IRB Review Criteria (continued)

		Will informed consent be obtained from each subject and documented when required by federal regulations?
		Is data collection monitored to ensure prompt recognition of trends pertinent to the safety of study subjects?
		Is there adequate provision to protect the economically or educationally disadvantaged and those who may be vulnerable for other reasons to coercion or undue influence?

IRB Review Criteria (continued)

		Will the privacy of individual subjects and the confidentiality of data obtained be safeguarded?
			Differentiates exempt from expedited review categories
		Is informed consent needed or indicated?
		Is data collection monitored to ensure prompt recognition of trends pertinent to the safety of study subjects?

Research or Therapy

	The IRB reviews clinical research but not therapeutic interventions outside a research setting

The Columbia University IRB
Definition of Research

	A systematic investigation, including research and development, testing and evaluation, designed to develop or contribute to generalizable knowledge.
	Activities which meet the definition whether or not they are conducted under a program which is considered research for other purposes; for example, demonstration and service programs may include research and evaluation activities
	Copyright 2000 Columbia University, Source: Good Clinical Practices Course 2002

"The distinction between research and therapy is often blurred" (DHHS 1991)

	Practice is defined as interventions
	“designed solely to enhance the well-being of an individual patient/client
	that have a reasonable expectation of success
	to provide diagnosis, preventive treatment, or therapy to particular individuals"
	Research is an Activity designed
	to test an hypothesis or draw conclusions
	to develop or contribute to generalizable knowledge
	"Experimental" procedures do not necessarily constitute research

Research Involving Human Subjects is Regulated Under Federal Authority

	Individual decisions are local, but under a federal mandate with minimal national standards (and proposed international standards)
		Code of Federal Regulations (CFR 21 and 45)
		Code of Federal Regulations (CFR 61) contains regulations proposing world standards for IRB type activities

Research Guidelines for Vulnerable Subjects

	DHHS regulations allow IRBs to approve research for children and vulnerable populations which is categorized as:
		Minimal risk
		Having a direct benefit to subjects
	Investigations that involve more than minimal risk without direct benefit may require:
		Approval of DHHS
		Greater scrutiny by panel of experts
	Exemptions from review of research involving adults (45 CFR 46.406) may not apply to research involving children or “vulnerable subjects”

 Categories of Vulnerable Subjects

	Pregnant women
	Infants, children and minors
	Cognitively impaired persons
	Prisoners
	Traumatized and comatose patients
	Terminally ill patients
	Elderly/aged persons
	Economically/educationally disadvantaged

"All studies must continue to..."

	All studies must continue to file annual renewals
	IRB Classification of Studies
		Exempt
			Exempt studies must have a letter stating in writing they are exempt
		Expedited or minimal risk
			Written consent may not be necessary
		Moderate or high risk
			Consent of patient is required
			Investigational drugs, devices, procedures
			Studies involving invasive procedures

Minimal Risk

	A "Minimal Risk" Study is defined as:
		“probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.”

Expedited Review May Be Available for Minimal Risk Studies

	Expedited review is available for studies that are considered “minimal risk”
	IRBs at different institutions may have differing views of minimal risk

Expedited Review

		An IRB may conduct an "Expedited Review" for certain types of studies that:
			entail only minimal risk
			minor changes in existing, approved protocols
		Either the IRB chairperson or a subcommittee reviews the study plan, acts for the entire IRB, notifying other IRB members of all approved changes

Components of an IRB Submission

	IRB protocols may be submitted on-line through RASCAL
	Current policy for student research is that students must have faculty-level Principal Investigator on their IRB studies
		Student work may be covered under existing protocol
		May qualify to be submitted as an amendment to an existing research protocol
		Approval times vary--Students should allow 30-60 days for approval of new protocols
	In addition to the IRB Protocol, an IRB submission to gain approval for research generally contains:
		Consent forms
			Except when waived
		Copies of all questionnaires, advertisements, recruitment materials, etc. in English and Spanish if Spanish speaking subjects are being enrolled

When Do I Submit an IRB?

	Committees meet to consider research proposals on a regular schedule; frequency is generally 1 to 2 times per month
	Most IRBs review and grant approval/denial within 2 months
		Review procedures and time to approval may vary with risk level of the research study
		Minimal risk studies may get quicker turn around
	Submit and wait for written approval prior to beginning any research that involves human subjects or use of their personal data

IRB Amendments

	Amendments should be filed when changes or additions are necessary between the required  annual renewals
	Amendments frequently take the form of a one-page letter submitted on line through RASCAL with the revised item: protocol, consent form, questionnaire, new study staff names attached
	Amendments that do not change the risk status of the protocol may qualify for expedited review

When to File an IRB Amendment

	When anything impacts potential risk status of study
	When any change in procedures is made to an old activity
		Revamp mode of recruitment into an existing activity
		Expand the age range being targeted for intervention
	When a new, but related activity is being initiated (for which research is planned) under an existing protocol
	BEFORE new materials are used :
			surveys/questionnaires
			advertising materials, brochures
	Before any change in study design or procedures

IRB Renewals

	IRB protocols, including exempt studies, must be renewed annually until study is concluded.
	In general, the analysis phase after completion of subject enrollment still requires IRB renewals and approvals
	Renewal process usually begins 10 months following the date of approval of previous year

Investigator Responsibilities

	Obtain and maintain up-to-date IRB approval
	Keep adequate records of IRB related activities including correspondence with the IRB
	Keep adequate records on study and research activities, including field staff, data managers, data analysts
	Record keeping on study and research activities is less burdensome, but not less important for minimal risk protocols
	Absence of a local IRB does not absolve investigators of responsibility of obtaining outside approval of their research

Activities that are Considered a Violation of Columbia IRB Policy

	Failure to file an IRB when doing even minimal risk research
	Failure to file amendments (a short letter) informing the IRB of new activities of research and evaluation or changes to questionnaires/surveys or recruitment procedures
	Failure to submit all advertising and questionnaires
	Failure to submit annual renewal applications for continuation of activities

Potential Penalties for Violating National Clinical Research Standards

	All research at an institution may be stopped until corrective action has been taken
	Approval granted by an IRB may be revoked by the IRB or by a court case; a state court in Maryland recently
		Called for a higher level of accountability for risks in research involving children than in that involving only adults
		Questioned the ethics and legality of nontherapeutic research protocols involving any risk to children without direct benefit

IRB Approval Does Not Offer Complete Immunity from Court Prosecution

	Local IRBs are guided by national regulations issued through the federal register
	Local IRBs are independent entities and may take different positions on a multi-institutional study
	Courts may override institutional IRB actions
	Courts have shown particular interest in research involving child subjects
	IRB approval and parental consent did not prevent a court from intervening on behalf of the welfare of child subjects in a Maryland IRB approved research project

Interpretation of IRB Regulations

	Scope of what requires IRB review and IRB policies have changed over time:
		Regulations or their interpretations are periodically updated
		Court cases influence the interpretations of the regulations
		New HIPAA regulations have begun to impact IRB decisions regarding patient privacy
		HIPAA may influence IRB rulings on patient privacy issues and use of administrative data with patient identifiers

Safeguarding Patient Privacy

	Each patient in an IRB approved study should be assigned a unique study ID
	This study ID is used to identify the patient in data files that contain clinical information
	Commonly used personal identifiers such as names and Social Security Numbers should not be kept in files with clinical data
	IRBs are requiring studies be HIPAA compliant

HIPAA, “The Privacy Rule”

	Federal regulation under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (amended in 2002 before it took effect)
	Applies only to “covered entities” which are health plans, health care providers, including hospitals, business associates of covered entities using PHI data, health care clearinghouses (i.e., public or private organizations that handle billing or management of health care delivery data), Rule was implemented for most parties on April 14, 2003
	The privacy rule also known as Standards for Privacy of Individually Identifiable Health Information
		Code of Federal Regulations Title 45, Part 160 and 164
		Full text available at the Federal HIPAA Privacy Website http://www.hhs.gov/ocr/hipaa

HIPAA Compliance and Protected Health Information (PHI)

	HIPAA may impact availability of certain data, but does not govern research using data per se
	Applies to protected health information (identifiable information) generated only from covered entities
	De-identified health information is not covered by the Privacy rule
	PHI may be used and disclosed for research if individual gave written permission
	PHI may be used and disclosed under a waiver, as a limited data set with a data use agreement, preparatory to research, and for research on deceased individuals
	Privacy not covered by the Privacy rule may be covered by other rules, e.g. the “Common Rule”
	Further information is available in the Columbia University HIPAA training module

Getting GCP Certified

	Go to Columbia website https://www.rascal.columbia.edu/
	Access requires a Columbia UNI and password
	Review the on-line study materials and/or obtain a GCP book prior to sitting for the on-line exam
	If you encounter difficulties entering the site send an e-mail to the address listed on the website or call the phone number
		Staff will trouble shoot
		Grant you permission to take the test
		Permission is usually granted same day/within 24 hours
	GCP certification is required for all staff (including students) working on federal and privately funded research involving human subjects at Columbia

Getting GCP Certified (Cont’d)

	There are two different tests--a clinical and nonclinically oriented one
	You should take the clinically oriented test which prepares you for patient/subject contact, i. e. allows you to interview subjects or administer questionnaires
	Test is 40 multiple choice questions and it is timed
	You can take it as many times as necessary to pass
	Upon passing, print a copy of your certificate and turn it in to Dr. Jacobson as proof of your certification

Getting HIPAA Certified

	Go to Columbia website https://www.rascal.columbia.edu/
	Access requires a Columbia UNI and password
	Review the on-line PowerPoint slide show and study materials. These can be printed for study off screen
	If you encounter website difficulties, e-mail the address listed on the website or phone
	HIPAA certification is required for all staff (including students) working on federal and privately funded research involving human subjects at Columbia
	Test is 15 questions, timed, and may be taken multiple times
	Print your certificate after passing and turn it into Dr. Jacobson as proof that you are HIPAA certified
	Retain a copy for your records

Conflicts of Interest

	Columbia requires that non-student investigators file annual COI statements
	Must declare any financial compensation or other interests in companies or boards of corporations, or consulting income remotely related to one’s research
	If you decide to publish your thesis, medical journals generally require you and your coauthors to make a statement that you had no conflict of interest or to declare openly any potential conflict/financial interest that you may have related to the study

Rascal Testing Center

	You can do on-line training, testing, and print certificates from the Rascal website (https://www.rascal.columbia.edu/)
	Select one of the following:
		Human subjects (IRB)
		HIPAA
		Conflict of Interest
	At bottom of page in fine print select “Testing Center” for IRB or HIPAA online course training and testing site or directly enter website address for Rascal testing center https://www.rascal.columbia.edu/servlet/edu.columbia.rascal.tc.servlets.TCMainServlet
	To print certificate at any time after taking test select
		View Certified Test History
		Contains record of your HIPAA and GCP successfully passed tests
		Print to printer

Columbia University Monthly IRB Seminars: Conducting International Research and Research at Non-Columbia Sites

	September meeting is Conducting International Research and Research at Non-Columbia Sites
	This session will provide information on:
	Regulatory Requirements
	Ethical Considerations
	Overview of International Standards
	Effective Negotiation Strategies for Regulatory Differences
	The meeting is scheduled for:
	Tuesday, September 14, 2004
	3:30 to 4:30 p.m.
	Alumni Auditorium