Frequently Asked Questions (FAQs)

Click on each question to reveal the answer.

New Studies

1) What needs to be reviewed by the IRB?

Any research conducted on or by faculty, staff, or students at Tufts Medical Center or Tufts University Health Sciences (TUHS), or their affiliates that involves human subjects, or human subjects’ records, requires IRB review. This is true regardless of the funding source or area of research.

Any human research that is conducted at another institution or in foreign countries by Tufts Medical Center or TUHS faculty, staff, or students must be reviewed by the IRB.

2) How do I know whether my study will go to the convened IRB?

Under the laws and regulations governing human subject research, research that presents greater than minimal risk to subjects or does not meet one of the categories for expedited review must be reviewed by a convened IRB. This determination is made in the IRB office. Please contact the IRB office for any questions about whether your study may require review at a convened IRB meeting.

3) How do I know whether my study qualifies for expedited review, exemption, or if it is not Human Subject Research?

The IRB makes the final determination as to whether a study qualifies for expedited review, exemption, or if it is not Human Subject Research. Projects that fall into one of these three categories are reviewed in the IRB office on a rolling basis. These studies are not reviewed at a convened meeting of the IRB; therefore, there are no submission deadlines.

In order to know which documents to submit for your study, please carefully review the information on the three categories listed on our website. Please also feel free to call the IRB office with any questions.

4) What about medical chart reviews?

Medical chart reviews may be reviewed by expedited procedures or be eligible for exemption, based on what identifiers will be viewed and recorded. This determination is made in the IRB office.

The IRB has developed the Form VII specifically for retrospective chart reviews. When submitting a chart review study to the IRB, please submit the Form VII, and conflict of interest form for the Principal Investigator. At that point, the IRB may determine that further information or documentation is needed, or may approve the study with these two documents alone.

5) What about a prospective medical chart reviews?

Under the regulations, prospective medical chart reviews may require consent to be obtained from subjects. The IRB will consider whether obtaining consent is appropriate based on the regulations and institutional policies.

6) What if I am doing a case report?

Under the regulations, case reports are not considered to be research. Please see the IRB’s case report policy.

7) What do I need to submit if I think my study qualifies for expedited review?

If you think your study qualifies for expedited review, please submit the following:

Additional items as applicable:

  • Site Specific Appendix (if this is a multi-site study)
  • Form II for drug, substance, or biologic and request supporting documentation
  • Form III for device and requested supporting documentation
  • Form VI for tissue banking along with tissue bank policies
  • Grant documentation

8) What do I need to submit if I think my study qualifies for exemption?

If you think your study qualifies for exemption, please submit the following:

  1. Request for Exemption form
  2. Any additional documents to be used with study subjects (e.g. surveys, advertisements, interview guides, tests or other measurement tools)

9) What do I need to submit if I think my project is not human subject research?

Please carefully review the section of our website that details what should be submitted for not human subject research, as documents to be submitted will differ depending on the type of project.

10) What is the approval time for a new exempt study?

Provided the submission is complete, a new exempt study is generally reviewed in 10 business days. However, we aim to turn around studies as quickly as possible, and will review it in a shorter time frame if possible. Please alert us to any pressing deadlines in a submitted cover letter, and we will do what we can to accommodate your time frame.

Please note: if your submission is not complete or there are issues with the submission, the review may take longer than 10 days.

11) What is the approval time for a new expedited review study?

Provided the submission is complete, a new expedited study is generally reviewed in 10 business days. However, we aim to turn around studies as quickly as possible, and will review it in a shorter time frame if possible. Please alert us to any pressing deadlines in a submitted cover letter, and we will do what we can to accommodate your time frame.

12) What is the approval time for a Not Human Subject Research (NHSR) study?

Provided the submission is complete, an NHSR study is generally reviewed in 10 business days. However, we aim to turn around studies as quickly as possible, and will review it in a shorter time frame if possible. Please alert us to any pressing deadlines in a submitted cover letter, and we will do what we can to accommodate your time frame.

Please note: if your submission is not complete or there are issues with the submission, the review may take longer than 10 days.

13 ) What is the approval time for a study reviewed by the convened IRB?

If a study requires SRC review, that must happen first. Once a study is approved by the SRC to proceed to the IRB, or if SRC review is not required, it will be pre-reviewed by the IRB Office. If the submission is complete (all necessary documents present and complete, including required signatures and supporting documents) it is forwarded to the next possible IRB meeting agenda. After the convened IRB meeting, letters of review comments are sent to the Principal Investigator within 2 weeks of IRB review.

14) How many copies do I need to submit for a new study?

Submit ONE (1) original paper submission application to the IRB office (Box 817 or 15 Kneeland St, 1st floor). Original signatures are required on the paper submission. Please also submit all documents electronically (e.g., on a flash drive or CD; flash drives will be returned) for all studies being considered for a convened committee review or an expedited review. The original application will consist of the following, as needed: IRB forms, protocol, site-specific appendix (for a multi-site study), grant, and all supporting documents, as applicable (e.g. surveys, advertisements, interview guides, tests or other measurement tools).

15) Do students’ academic research projects require IRB approval?

Yes. All student projects must be submitted to the IRB prior to initiation. Student research that involves human subjects, whether of a biomedical or social-scientific nature, requires approval or granting of exemption by the IRB. Please note: student researchers are required to have a faculty sponsor for each research project. The faculty sponsor should be listed as the principal investigator on the study proposal.

16) Do I need to submit a copy of the grant that funds (or will fund) this study?

Yes. If the grant is a federal grant, you need only include the methods section of the grant as well as the face page. However, if your study is being funded by a subcontract or sub-award of a grant, a copy of the grant does not need to be submitted. Please note, sub-contract may also include sub recipient and cooperating institution. Please call the IRB office with any specific questions pertaining to the funding information that needs to be submitted for your study.

17) Does my study need to be reviewed by the SRC?

The SRC routinely reviews greater than minimal risk protocols submitted for review by the convened IRB. The basic requisite for requiring SRC review is that a protocol has not previously undergone an independent, scientific peer review process. The types of protocols that often fall under this category are investigator initiated studies, single-site pharmaceutical company sponsored studies, or early phase clinical trials. Please click here to see if your study requires SRC review.

18) Who do I call with questions about the SRC?

You can call the IRB office at (617) 636-7512 and the SRC Coordinator or a member of the IRB office staff will help you.

19) Who needs to fulfill education requirements?

Completion of the education modules is mandatory for each research team member. The research team includes those responsible for the design, conduct, or reporting of the research, such as the PI and Co-Is, research nurses and coordinators, project managers, etc.

Research team members engaged in research that is granted an exemption are not required to complete the institutional, mandatory human subject research education requirements. If a project is granted exemption, that determination will be sent to the Principal Investigator in writing.

20) What constitutes tissue banking?

If any specimen (blood, tissue, sera, urine, stool, saliva, etc.) will be stored for future use, Form VI and the corresponding optional tissue banking informed consent form are to be submitted to the IRB for review. Please consult the institutional tissue banking guidelines for guidance.

21) What is the status of my submission?

All submissions are reviewed in the order of receipt unless a patient is identified for a treatment intervention study and is eligible and interested in participating in the study. Responses are sent via interdepartmental mail to the PI. If the submission was to be reviewed by expedited review procedures, please allow at least 10 business days before contacting the IRB office regarding the status of the submission.

22) What do I need to keep for my research records?

The PI is responsible for safe maintenance of all documents related to a given research study. The PI is to retain all original correspondence from the IRB and a copy of all correspondence submitted to the IRB.

23) Can I fax or email a submission to the IRB?

No. At this time, the IRB only accepts hard copies of documents with a cover letter/form signed by the Principal Investigator, or, under special circumstances, a Co-Investigator.

24) I’m working on a project with faculty from another institution. If my co-investigators receive IRB approval from their university, do I still need approval from this institution?

Yes, if Tufts MC/TUHS is engaged in research. Each institution develops its own policies and procedures regarding the use of human subjects in research. As a result, our institution's policies and procedures may differ from the other institution. You need to submit the required forms for our institutions and should include a copy of the other institution's IRB approval, including their approved protocol and informed consent form (ICF), if applicable. Please also refer to OHRP’s guidance on engagement in research for more information: http://www.hhs.gov/ohrp/policy/engage08.html.

25) What if I only have a draft of my questionnaire, instrument, etc., or a portion of it (i.e., the consent form or a survey)?

Submit your draft as a "DRAFT" instrument. This will allow the IRB to review what you are proposing to do. Be certain to provide information regarding your plans to finalize the instrument and a timeline for completion. The instrument may only be used after the final version receives IRB approval.

26) What does risk mean?

Risk is defined by the federal regulation as the probability of harm or injury (harm can be physical, psychological, social, or financial) occurring as a result of participation in a research study. Both the probability and magnitude of possible harm may vary from minimal to significant.

27) Is the IRB considering electronic submission of IRB documents?

Yes. The IRB office is exploring options to facilitate electronic submissions.

28) Is there a fee for review of research studies?

Yes. Research Administration recently updated its fee schedule for initial review ($2500) and an annual maintenance fee ($500) for all industry funded studies reviewed by the Tufts MC/TUHS IRB. Similarly, there is also a fee for use of the institutional investigational drug service (IDS) Pharmacy ($1500). An annual IDS Pharmacy fee also exists ($500). In addition, there is a charge of $750 for studies reviewed by WIRB, in addition to WIRB’s fee schedule. There is no fee for federal/foundation/internally funded studies. For additional detail, please see the Research Administration Policy Letter or contact the Office of Research Administration.

29) How long do I need to keep my research study records?

This answer varies widely based on the study. Per DHHS regulations, records must be kept for 3 years after completion of all research activities. Massachusetts General Laws guiding contract and tort claim require records be retained for 7 years. The FDA has specified recordkeeping and record retention requirements; generally, FDA regulated research records must be kept for 2 years after a marketing application is approved. HIPAA requires records to be retained for up to 6 years after the last subject has completed study activity.

30) The sponsor of my research study has requested a roster of the IRB. Is this information available?

No. The IRB roster is confidential. In lieu of a roster, you can print a memorandum of FWA verification which will provide the sponsor with an assurance that this IRB complies with all federal standards governing the conduct of an IRB.

31) Can I still submit regulatory documents to the IRB if my research study has been Closed?

No. Once a research study has been closed, your regulatory requirement has been fulfilled and the IRB will no longer accept submissions for the study. It is strongly suggested that you consult the sponsor before closing a sponsored research study.

32) I want to designate the Tufts Medical Center/TUHS IRB, or another IRB, as the single reviewing body with an IRB Authorization Agreement (IAA). How do I execute an IAA?

A request for an IAA must be submitted to the IRB office, attention Andreas K. Klein, MD, IRB Chair. Each IAA request must be presented in a detailed cover letter, which identifies the research study the IAA pertains to, and the exact duties this IRB, or another IRB, will be required to fulfill. The IRB Executive Committee or designee will consider the IAA request. If the IAA request is approved, the IAA will be signed by the IRB Institutional Official of your institution.

33) Can I use a commercial IRB?

Western IRB (WIRB) is an option at Tufts Medical Center and TUHS for select studies. To be eligible for WIRB review, studies must meet the following criteria:

  • Phase II (IIa, IIb, or II), Phase III, or Phase IV (or the equivalent device phases) studies
  • Industry (for-profit) sponsored or non-federally funded foundation sponsored
  • Multi-center
  • Sponsor/foundation initiated (defined as sponsor created, designed, and developed).

A Principal Investigator (PI) may choose to submit such a study to either the Tufts MC/TUHS IRB or WIRB. An eligible research study may only be submitted to and reviewed by the Tufts MC/TUHS IRB or WIRB, not both. For more information, please see the WIRB webpage on the IRB website.

34) I have an appointment at another institution that has an IRB. Do I have to submit research I do at that institution to this IRB?

Yes, only if you are engaging our institution in research. Researchers affiliated with Tufts Medical Center and/or TUHS must submit for IRB review any human research project they will be involved in if it is conducted at Tufts Medical Center and/or TUHS. Please also refer to OHRP’s guidance on engagement in research for more information: http://www.hhs.gov/ohrp/policy/engage08.html.

35) What happens if I conduct human research without IRB approval?

You will place the Institutions out of compliance with Federal requirements that regulate human subjects research. This can result in Federal or IRB actions that will prevent you, your Department/Division, or the Institution from conducting human subjects research. It will also jeopardize the Institutions’ human research certification with the Office for Human Research Protections (the Federal Wide Assurance).

back to top

Continuing Review

1) How many copies do I need to submit for continuing review?

Submit ONE (1) original paper submission application to the IRB office (Box 817 or 15 Kneeland St, 1st floor). Original signatures are required on the paper submission. Please also submit all documents electronically (e.g., on a flash drive or CD; flash drives will be returned). The original application will consist of the following, as needed: IRB forms, protocol, site-specific appendix, grant, and all supporting documents. Documents can be printed double-sided. Please see the section on continuing review.

2) Is it ok to close out my research study if I am only conducting data analysis?

No, federal guidance states that current IRB approval is required to conduct data analysis. However, if data collection for all sites is complete and the only remaining activity of a research project involves the analysis of aggregate data sets without individual subject identifiers and this has occurred for over year, the study may no longer require IRB review. Similarly, if the only activity is maintaining individually identifiable private information without using, studying, or analyzing such information, and this has occurred for over year, the study may no longer require IRB review.

3) When should I submit the continuing review for my study?

As a general rule, you should submit your continuing review six weeks to two months prior to your study’s expiration date.  Use your initial or continuing review approval letter to track your anniversary date (Microsoft Outlook reminders may be useful for this).  Please note, the anniversary date of your study will not change.

4) How is the IRB due date for my continuing review determined?

Your continuing review submission is due the last business day of the month that is two months before the anniversary date of the initial IRB approval for your study. For example, if your approval/anniversary date is any day in November, your Continuing Review submission due date is the last business day of September.

5) Will I receive a notice that my study is due for continuing review?

Continuing review notices are sent out on the 1st business day of the month your continuing review is due and submissions will be due by the last business day of the same month, providing at least 4 weeks to prepare a submission. These notices are sent by hard copy and by email to the Principal Investigator.

A “second notice” will be sent out one week before the due date for studies that have not yet submitted a continuing review. These notices are sent by email only to the Principal Investigator.

6) Can the IRB send the continuing review notices to my study coordinator as well?

Currently, the IRB can only send continuing review notices to the Principal Investigator, it is not possible to also send these notices to other research team members.  However, the Principal Investigator can forward the notices to their study coordinator and to any other research team members as needed.

7) What documents do I need to submit with my continuing review?

    • Unless your study has been in data analysis only for more than one year, complete all sections of the Form V.
    • If your study has been conducting data analysis only for over a year, with no problems to report, you may complete only Sections A) Demographics, B) Current Funding Sources, C) Conflict of Interest (COI), and D) Study Current Status and submit a Research COI form for the Principal Investigator. No other documentation is required.
  • Cover Letter and all other relevant Continuing Review IRB forms
    • As a general rule, you must submit all documents that were submitted with your initial IRB submission (except for Form I, which is only required for new study submissions).
    • Submit the most recently approved version of each document.
    • Always include version dates on all documents, and use the same file name and title as used on the initially-submitted document. Please note, the version dates should not be updated unless you are submitting a revision to the document.
    • If your study has closed subject enrollment, documents such as Informed Consent Forms (ICFs) and recruitment materials that are no longer being used do not need to be submitted.
    • Follow the Tufts MC/TUHS IRB SAE and unanticipated problem reporting policy throughout the year and then provide a summary report of all severe adverse events and clinically-significant adverse events with your continuing review submission. You should also submit any Data and Safety Monitoring Board (DSMB) reports or study status summary reports you have them available.

8) I want to amend my study, and the continuing review for my study is due. Can I submit an amendment with my continuing review?

Yes, you can submit amendments such as revisions to protocols, ICFs, etc. with the continuing review submission. Please note though, that amendments will be reviewed at the time of continuing review (which can be as much as one month later than the time of submission). Please track all changes in revised documents when you submit an amendment with the continuing review.

9) I forgot to submit my continuing review and the IRB approval of my study has expired. Can I still conduct research activity on my study?

If your IRB approval does expire, you are no longer approved to conduct any research activity on your study. If you do have to conduct research due to a subject safety issue for example, then let the IRB know as soon as possible.

10) What kind of review will I get with my continuing review submission?

If the study went to the convened IRB for its prior review (initial or continuing), it will probably go to the convened IRB again unless one of the following conditions applies:

  1. There has been no subject enrollment to date and there are no additional risks identified in the study.
  2. The study has transitioned to long-term follow-up and only minimal-risk procedures are involved.
  3. The study has transitioned into the data-analysis-only phase.
  4. The convened IRB determined that the study qualified for expedited review.

Studies that were initially reviewed via expedited procedures (in the IRB office and not by the convened IRB), or convened IRB studies that fit one of the above conditions will undergo expedited IRB review.

back to top

Amendments

1) I want to amend my study, and the continuing review for my study is due. Can I submit an amendment with my continuing review?

Yes, you can submit amendments such as revisions to protocols, ICFs, etc. with the continuing review submission. Please note though, that amendments will be reviewed at the time of continuing review (which can be as much as one month later than the time of submission). Please track all changes in revised documents when you submit an amendment with the continuing review.

2) What is the turnaround time for review of a protocol amendment?

If the amendment requires convened IRB review, it will be placed on the next available IRB agenda. If the amendment may be reviewed by expedited review procedures, it will be reviewed in the order of receipt. Depending on the number of submissions received and the quality of the submission, an amendment submission is generally reviewed within 7 to 10 business days of receipt.

3) What is the turnaround time for review of an advertisement?

Generally an advertisement is reviewed within 7 to 10 business days, depending on the number of submissions received in the IRB office.

Please note: if your submission is not complete or there are issues with the submission, the review may take longer than 10 days.

4) Do advertisements and recruitment material need IRB approval?

Yes, any material given to subjects or used in recruitment of study subjects must be reviewed and approved by the IRB office prior to use.

5) I reached my enrollment limit for my study. Can I request an increase in enrollment?

Yes, you can ask for an increase in enrollment at continuing review or as amendment at any time during the study. However, make sure you submit your request before you reach your enrollment limit so that you do not over-enroll in your study. All increases in enrollment must be approved by the IRB.

6) I received validated informed consent forms (ICFs) back from the IRB with my approval letter. Are these the ICFs that I need to use to consent subjects to my study?

Yes, only validated ICFs should be used to consent subjects (these are the ICFs with the IRB validation dates.)

7) Can I have a Co-Investigator sign the cover letter or IRB forms for my study?

As a general rule, the Principal Investigator must sign the cover letter and all IRB forms. If the Principal Investigator will not be available to sign completed forms because s/he is traveling, s/he should designate a Co-Investigator as his/her signatory in advance. In order to do that, the PI should submit a letter to the IRB formally designating a Co-Investigator to sign in the PI’s absence, while s/he is away. This should be done before the PI becomes unavailable.

8) Are there times when I can just drop in at the IRB Office and get help with my study?

Yes, the IRB has the drop in hours every Tuesday 2 – 4 PM. The Tufts MC/TUHS IRB office is located on the 1st floor of 15 Kneeland Street (Tupper Building). If you do not have a pass card to open the door, call the Tufts MC/TUHS IRB office at (617) 636-7512 and staff can let you in.

9) When should I submit an amendment for my study?

Any change to a research study must receive IRB approval before the change can be implemented. Examples include revisions to the payment plan, revisions to the study procedures, a change in recruitment materials, addition of a study team member, etc.

10) What should I submit for an amendment for my study?

  1. Cover letter stating rationale for the amendment
  2. Tracked copies of the revised protocol and/or other revised documents reflecting the amendment changes.
  3. Clean copies of the revised protocol and/or other revised documents.
  4. Please update the version date of all revised documents as applicable.
  5. Submit one (1) original of all documents by hard copy to the IRB office (Box 817).  The documents can be double-sided printed.

11) I am adding and/or removing a research team member to/from my study. What do I need to submit to do this?

  1. Cover letter stating the following:

    1. Change in personnel (removal or addition)

    2. Confirmation that the new research team member(s) have completed the mandatory CITI educational requirements and that a copy of their CITI certificate of completion is retained in the study files (addition only)

    3. Confirmation that the new research team member(s) have submitted a Research Conflict of Interest (COI) form for the study and that they have reported no financial conflicts with this study. If they do, please submit a copy of the form to the IRB for review (addition only)

  2. Any revised document reflecting the addition and/or removal of research team member as applicable. Please update the version date of all revised documents as applicable.

back to top

SAES/AES

1) Can I fax or email an adverse event (AE) report to the IRB?

No. Each AE report form must contain an original ink signature of the Principal Investigator. If the event must be reported to the IRB immediately call the IRB office at (617) 636-7512 and make an initial verbal report. A verbal report is not a substitute for a written report. Please do not submit routine AE reports via email.

2) I have numerous IND safety reports to submit. Can I submit them with one Adverse Effect Report cover sheet?

No, each serious adverse events must be submitted per institutional policy and on the appropriate form.

back to top

HIPAA

1) What are the basics of HIPAA compliance for a researcher?

Depending on the type of study you have, you may utilize the following means to comply with HIPAA (all forms and templates are available here):

  1. Obtain authorization for the use or disclosure of protected health information (PHI) from subjects using the following:
    1. A combined ICF/Research Authorization Form (RAF)
    2. A Research Authorization Form (RAF). This is only applicable for all studies approved prior to 01 April 2012.
  2. Obtain a waiver of research authorization (certain restrictions apply)
  3. Use a limited data set and put in place a data use agreement (certain restrictions apply
  4. Use PHI from deceased subjects (please complete the Research on Decedent form)
  5. Use a completely de-identified dataset

You also have limited ability to access PHI in "a review preparatory to research". Please complete the Review Preparatory to Research form.

For more information concerning HIPAA and case reports, please refer to the case report policy.

2) What is “Minimum Necessary” under the HIPAA Privacy Rule?

The HIPAA Privacy Rule requires that the amount of PHI used or disclosed be limited to the "minimum necessary" for the purpose.

3) Who are the HIPAA Privacy Officers for Research?

Andrew Finkelstein is the HIPAA Privacy Officer for Research at Tufts Medical Center. He can be contacted by email at afinkelstein@tuftsmedicalcenter.org or by telephone at (617) 636-9229.

Akiyo Fujii is the HIPAA Privacy Officer for Research at Tufts University. She can be contacted by email at Akiyo.Fujii@tufts.edu  or by telephone at (617) 627-3336.

Erin Grealy is the HIPAA Privacy Officer for Research at Tufts University School of Dental Medicine. She can be contacted by email at Erin.Grealy@tufts.edu or by telephone at (617) 636-6688.

4) What responsibilities do clinical researchers have under the HIPAA Privacy Rule?

The HIPAA Privacy Rule requires:

  1. Providing mandated information to research subjects about their privacy rights and how PHI can be used.
  2. Informing subjects about the right to access and amend their PHI.
  3. Adopting clear and systematic privacy and database security procedures.
  4. Designating an individual to be responsible for seeing that the privacy procedures are adopted and followed.
  5. Maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of PHI.

5) What information is required in a HIPAA Research Authorization?

A valid authorization must include all of the following:

  1. Description of the information to be used or disclosed
  2. Identification of the person(s) authorized to make or use or disclose the protected health information
  3. A description of each purpose of the use or disclosure
  4. An expiration date or event ("no expiration date" may be used)
  5. The subject's signature and the date
  6. A legally authorized representative must describe their authority to act for the individual
  7. A statement that the subject may revoke the authorization in writing
  8. A statement that the health information may no longer be protected by the Privacy Rule once it is disclosed.

Please refer to the ICF/RAF templates for more information on creating a valid HIPAA authorization.

6) What do I have to do if I get a waiver?

If you are granted a research authorization waiver, you must fulfill the accounting requirements.  A waiver of research authorization tracking form is available to help with these requirements. If you access 50 or fewer records, you must record the names of the persons. If you access 51 or more records, you may create a profile of the study population (e.g., men over age 70 with glaucoma and a history of hypertension). In either case, it is the responsibility of the Principal Investigator to report the names or profile to his/her institution's HIPAA Privacy Officer for Research.

7) Are HIPAA Research Authorizations or Waivers required for databases I maintain containing PHI that are for future research?

Databases where PHI is placed, processed and stored that are resources for future research are Research for HIPAA purposes and require HIPAA Research Authorization or Waiver. Since the definition of Research is the same under HIPAA and the Common Rule these databases also require IRB approval.

8) Are HIPAA Research Authorizations or Waiver required for databases containing PHI on my patients that I keep on my computer?

Investigators should review existing internal databases to determine whether the data serves clinical or departmental operations or are also for research purposes. Databases for research purposes require HIPAA Research Authorization or Waiver.

9) Coded information is used for my study; does the HIPAA Privacy Rule apply?

The HIPAA Privacy Rule does not apply if all 18 HIPAA identifiers are removed from this information. The HIPAA Privacy Rule does apply to the code that allows re-identification of the PHI. But, the Common Rule considers coded information to be indirectly identifiable.

10) What is the Data Use Agreement required under the HIPAA Privacy Rule if a Limited Data Set is given to another party?

Data Use Agreement is required to include the following elements:

  1. Establish the permitted uses and disclosures of the limited data set by the recipient, consistent with the purposes of the research.
  2. Limits who can use or receive the data
  3. Requires appropriate safeguards to prevent the use or disclosure of the information other than as provided for in the data use agreement
  4. Requires reporting of unauthorized uses or disclosures to the HIPAA Privacy Officer. This information should also be reported to the IRB.
  5. Prohibits contacting subjects or identifying information of subjects

11) What is my responsibility for obtaining authorization under HIPAA to use Decedent PHI for my research?

Decedent PHI may be accessed for research without a HIPAA Research Authorization as long as:

  1. The PHI accessed is solely for research of the PHI on the decedent.
  2. The PHI accessed is necessary for research.
  3. Documentation of death is available upon request.

Please complete the Research on Decedent Form if you plan to conduct any research on decedents.

12) What is my responsibility when PHI is required to determine the feasibility of my study proposal, but it is impracticable to contact every potential subject?

The HIPAA Privacy Rule permits accessing PHI without a HIPAA Research Authorization for purposes preparatory to research (assessing feasibility or formulating hypothesis) as long as:

  1. The use of the PHI is solely for purposes preparatory to research.
  2. The review is necessary for preparation.
  3. No PHI is removed.

Please complete a Review Preparatory to Research Form if you plan to access any PHI for purposes preparatory to research.

13) What is my responsibility under HIPAA for disclosing to subjects funding or other financial support when it is received from the sponsor?

The Privacy Rule does not require disclosure in the combined ICF/RAF or HIPAA RAF if direct or indirect remuneration is received in exchange for use or disclosure of the health information.

14) Informed Consent was obtained from participants in my study prior to April 14, 2003. Are these participants required to sign a HIPAA Research Authorization?

Consent, authorization or other legal permission obtained prior to the mandatory compliance date (April 14, 2003) allows the PHI to be used after April 14, 2003 for the research. If, after April 14, 2003, a revised informed consent is required for prior enrolled subjects, then HIPAA research authorization should be obtained from the prior enrolled subjects.

15) IRB Consent Waivers have been obtained for some of my research studies, what is the status of these studies under the HIPAA Privacy Rule?

Waivers of Informed Consent prior to April 14, 2003 by the IRB are "grandfathered" as a Waiver of HIPAA Research Authorization. After April 14, 2003 separate waivers must be obtained for Informed Consent under the Common Rule and Research Authorization under HIPAA.

16) Is a Limited Data Set considered PHI under the HIPAA Privacy Rule?

Limited Data Sets are PHI under the HIPAA Privacy Rule. Limited Data Sets are restricted to Research, Operations, and Public Health purposes.

17) Is the health information of normal healthy volunteers in my clinical research study considered PHI?

The HIPAA Privacy Rule does not protect the health information of healthy normal volunteers, but hospital registration for these participants creates a clinical record that is PHI.

18) How does the hospital Notice of Privacy Practice under the HIPAA Privacy Rule impact clinical research?

A research unit that is part of a Covered Entity may need to provide the Notice of Privacy Practices to a subject if participation in a clinical trial is the initial contact with the Covered Entity.

19) Does the HIPAA Privacy Rule allow access to PHI to assist in recruitment of study participants?

PHI may be used for recruitment of study participants with a HIPAA Waiver.

20) My research files contain PHI that has been authorized for use under a HIPAA Research Authorization. Does the HIPPA Privacy Rule have any other requirements for this data?

There are HIPAA Security Standards that require reasonable operational, technical and physical safeguards for PHI that:

  1. Ensure confidentiality and integrity of information
  2. Prevent unauthorized use or disclosure
  3. Protect against external threats and physical hazards

Contact your Information Technology office for more information about HIPAA security standards.

21) How will Revocation of Authorization by study participants permitted under the HIPAA Privacy Rule impact my studies?

A research subject has the right to revoke, in writing, his/her authorization at any time. However, research subjects cannot revoke authorization to the extent that the study is reliant on previously authorized information. You may continue to use data already collected to protect the integrity or accuracy of a study.

22) What are the penalties associated with failing to comply with HIPAA Privacy Rule regulations?

There are both civil and criminal penalties for improper use or disclosure of PHI. A person who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to 10 years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm.

23) Are we allowed to combine the HIPAA Research Authorization and Informed Consent that have to be reviewed and signed to enroll participants in a study?

Yes. As of April 1, 2012 all new studies must have the RAF language in the ICF. For existing studies, the PI has the option to keep the ICF and RAF separate or submit a combined document at continuing review.

24) When should subjects sign the Research Authorization Form (RAF)?

As of April 1, 2012 all new studies for which signed HIPAA authorization are required are to use the combined ICF/RAF document. A separate ICF and RAF will no longer be accepted for new studies. For existing studies, at continuing review investigators can convert to the combined ICF/RAF document or continue to use a separate ICF and RAF. Please see our updated template documents for more information.

Subjects are to sign the RAF at the same time they sign the consent form if separate documents exist. Otherwise the RAF language is in the ICF so only one signature is needed.

25) Does the HIPAA Privacy Rule apply to my studies if funding for the research does not come from either the FDA or the NIH?

The HIPAA Privacy Rule applies regardless of funding source and even if FDA and HHS regulations are not applicable.

26) Does the use of PHI for Quality Assurance projects require a HIPAA Research Authorization or Waiver?

Quality Assurance (QA) activities that are part of health care operations are permitted under the HIPAA Privacy Rule as "health care operations" so no separate authorization or waiver is required. QA activities that are research require HIPAA Research Authorization or Waiver.

27) Researchers working at the hospital are not the Covered Entity; the hospital is, so how does the HIPAA Privacy Rule apply to them?

The HIPAA Privacy Rule covers researchers within a Covered Entity because they generate PHI (e.g. in clinical trials) and receive, access, or use PHI.

28) Retrospective chart reviews are important to Research; do they require a signed HIPAA Research Authorization?

A retrospective chart review may be eligible for a HIPAA Waiver under the IRB/Privacy Board. This will be evaluated by the IRB upon submission.

back to top

CITI

1) How do I register for a CITI account?

Click here for step-by-step instructions:

  • Registering with CITI
  • Affiliating with Tufts University/Tufts Medical Center
  • Completing initial certification
  • Printing a completion report

2) I conduct both biomedical and SBE research, what learner group should I choose?

Choose whichever group is most closely related to the majority of your research activities:

  • Biomedical Researchers
  • Social-Behavioral-Educational Researchers

3) Will I lose credit for all of my previously completed work?

If you have completed a module that corresponds to a module within the new Basic Course (either SBE or Biomedical), you will receive credit for that module, no matter when it was completed. It will count towards overall completion of the Basic Course (Initial CITI certification).

4) What do we do between now and Jan. 1st to make sure that education is complete, if we’re submitting a new study or CR or adding a research team member?

Existing researchers have a grace period of 4 months to complete the new education requirement. During this interim period, their education will still be considered up to date as long as they have met the 2013 Continuing Education requirements. On Jan. 1, 2015, all existing researchers must be in compliance with the new education requirements.

New researchers must complete the revised educational requirements; they are not eligible for the grace period.

5) How do I fill out the Form I, V, VII, and Request for Exemption, if some members of the research team don’t have a CITI certification expiration date yet?

During the 4 month grace period (until Jan. 1, 2015):

  • Please enter an expiration date for those research team members who have completed the new education requirements and have a CITI certification expiration date.
  • Please enter the year of the most recently completed education requirements (e.g. 2013) for those research team members who have not yet completed the new education requirements.

On or after Jan. 1, 2015, all research team members must have an expiration date listed.

6) Why are Tufts MC and Tufts University making this change?

  • The institutions are revising the education requirements to align practices for Tufts Medical Center and both campuses of Tufts University. The requirements are now the same for all researchers.
  • For Health Sciences researchers, the requirements are now easier to understand, to comply with, and to document when they are complete.
  • The new structure of the learner groups allows investigators to easily access a CITI Completion Report that can be provided to sponsors and funding agencies.
  • With the new requirements, each researcher can easily tell if their education is current because their CITI certification will either be valid or expired, based on when the individual researcher last completed their certification.
  • CITI will provide automated alerts to each researcher when their certification is nearing expiration (90, 60, and 30 days prior to expiration, and 1 day after expiration).
  • The new education requirements are now more consistent with the requirements of peer institutions locally and nationally.
  • Although there are more modules to complete for initial certification, continuing education (re-certification) will now be required every 4 years, rather than annually.
  • The Biomedical Research Course and Social-Behavioral-Education Research Course structure provides more comprehensive education to safeguard the protection human subjects and help investigators maintain compliance with research regulations.

7) I work with community research partners and/or off-site collaborators. Do they have to complete our education requirements?

On a case-by-case basis, the Tufts Health Sciences IRB and Tufts SBER IRB may accept the completion of comparable education for community research partners or researchers employed by other institutions (e.g. PI provides tailored education to community research partners; a researcher from another institution provides documentation of completing educational requirements at their home institution).

back to top

Other

What do I do if I receive a request from the media to be interviewed about a research study (and/or for a participant to be interviewed)?

Most media requests do not constitute human subjects research, but the Principal Investigator must inform IRB so that a determination can be made.

Please provide a letter to the IRB that includes the following information:

  1. Reference the IRB #, Principal Investigator, and study title.
  2. Formally tell us that an interview will occur.

If a subject will be interviewed, please also address the following:

  1. Explain how you will choose a research study participant for the interview.
  2. Explain how you will contact the participant. (Please Note: To preserve study confidentiality, participants should not be contacted directly by the media, nor should their contact information be provided to the media, until they have consented to the interview.)
  3. Confirm that participation in the interview will be optional for the participant, and will not affect the participant’s care or research participation.
  4. State whether there is a form for the participant to complete from the hospital (for HIPAA, etc.).

Please also note that any media related request for Tufts Medical Center should be directed to the Public Affairs Office at (617) 636-0200, or to the Public Relations Office at (617) 627-3069 for Tufts University.

back to top