Exempt Criteria 45 CFR 46.104(d)(4)
Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met:
(i) The identifiable private information or identifiable biospecimens are publicly available;
(ii) Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;
(iii) The research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of ‘‘health care operations’’ or ‘‘research’’ as those terms are defined at 45 CFR 164.501 or for ‘‘public health activities and purposes’’ as described under 45 CFR 164.512(b); or
(iv) The research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected information obtained for non-research activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the identifiable private information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.
Important information regarding regulatory criteria:
Criterion i - Publicly available data/specimens:
Publicly available refers to data and/or specimens that are accessible to anyone in the general public, without the need for special permissions or privileges. In these cases, the subjects do not have a reasonable expectation of privacy of their data/specimens. Examples include data/specimens available for purchase, searchable online, or available at a library. Researchers may be subject to an agreement with the entity releasing data/specimens.
Criterion ii - Non-public data:
Non-public data and/or specimens which may or may not contain identifiers but are not clinical data subject to HIPAA regulations. Study team members may access identifiable private information and/or identifiable specimens but cannot record / obtain it in a way in which it could be linked back to identifiers, even temporarily. Any individuals accessing the identifiable data and/or identifiable specimens must already have access to these materials (e.g. by means of their involvement with the original collection). The data/specimens will not be able to be linked to the identity of the subjects at any time.
Criterion iii - Data subject to HIPAA regulations:
Two acceptable strategies for collection of these data include:
- Honest broker provides data: The de-identification of data is carried out by a person who is independent of the research (i.e., an independent "honest broker") and who has been identified by name in the protocol, and has completed the "honest broker" certification form. Information linking the assigned code numbers to the subjects’ identity (if applicable) is maintained solely by the independent “honest broker”.
- A certified honest broker is typically required. These are individuals listed on an HRPO-approved honest broker system, which will have an official title and a system number (e.g. HB###).
- The honest broker accesses the desired data on behalf of the PI and provides the PI with a data set - either a completely de-identified data set ("HIPAA Safe-Harbor") or a data set that includes patient-specific dates and/or geographical information ("Limited Data Set"). [See the HIPAA guidance]
- The honest broker can assign a code number to the data given to the investigator, provided that the research investigator does not have access to the information linking this code number to the identities of the respective patients. Using this code number, the investigator can request, through the honest broker, additional data corresponding to a given patient.
- Direct access to identifiable medical records by the researcher team / Waiver of HIPAA Authorization is required: Identifiable data can be recorded and a waiver of the requirement to obtain signed HIPAA Authorization is requested and sufficiently justified.
- Note that it must be accurately stated in the protocol that the only individuals who will access identifiable data are those who already have access to the identifiable data, related to their job responsibilities, granted by the privacy office.
- The University IRB will not approve a waiver of HIPAA Authorization if the data desired are not in some way related to the patient care responsibilities of the listed PI.
- Although it is no longer required that data be “retrospective” as of the date the protocol was submitted, the waiver justifications must pertain to all subject populations, dates, and variables that are to be collected.
Criterion iv – Research conducted on behalf of Federal Agencies:
Option iv pertains to research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected data obtained for non-research activities. The study team must demonstrate compliance with the policies detailed in the regulation, specified above.
Additional Requirements for all secondary analysis studies:
- The data and/or specimens have been or will be collected for purposes unrelated to the proposed study (e.g. “secondary” analysis).
- Specimens can only be included in the first or second exempt option only. However, a “no human subjects” determination can be made for studies involving specimens if criteria are met.
- Note that as of January 19th, 2018, it is no longer a requirement that all data/specimens be retrospective (previously collected as of the date the protocol is submitted).
- "Source" of data/specimens refers to the entity (research study, data/specimen bank, lab, external entity, etc.) from which data/specimens will be directly obtained for this study.
Privacy & Confidentiality:
- Anonymous means that no one can identify the subject at any time.
- Recorded Anonymously means that recorded data are not linked to the identity of the individual subjects in any way. If there are linkage codes, data is not anonymous.
- Coded means that identifiers are recorded, but data are labeled with a code without identifiers. Linkage information is kept in a separate, secure location.
- Data should typically be recorded anonymously or at least coded.
- When identifiers are recorded, and information is of a sensitive nature, exempt review may not be appropriate. (“Sensitive” information is information that has the potential to damage participants’ reputation, employability, financial standing, educational advancement, place them at risk for criminal or civil liability, etc.).
Exempt Form: Secondary Research with Data or Specimens [word]
1/24/2022