FAQs
Basics | Training | Protocol Management | Single IRB | Genomic Data Sharing | Good Clinical Practice | Cadavers or Deceased Individuals | Certificate of Confidentiality | GDPR | Other/Special Circumstances
Most Commonly Asked
- Human Subjects Training/CITI
- Does my project need IRB review?
- Consent
- Overview of the IRB Application (including definitions for Key Personnel)
- Protocol Management
- Single IRB
- eProtocol FAQ
Basics
- Who/What is the IRB? (video)
- Getting Started: What is Needed and eProtocol Basics (video)
- What are the panel meeting dates & deadlines?
- What is the eProtocol system?
- How do I use the eProtocol system?
- What is a protocol?
- What does STANFORD (all caps) signify?
- Research at non-Stanford facilities: Can Stanford human subject, animal subject or human stem cell studies be conducted at non-Stanford facilities?
- See below for Other/Special Circumstances
Human Subjects Training
- What training do I need?
- What is CITI?
- How do I transfer training from another institution?
- Why is my CITI training showing as incomplete in eProtocol?
Protocol Management
- How to Submit a New IRB Application (video)
- Before Submitting a Protocol
- Submitting a Protocol (questions the PD should consider)
- After Submitting a Protocol
- After a Protocol is Approved
- How to Submit a Continuing Review or Modification in eProtocol (video)
- Closing a protocol
- IRB Protocol Review Process and General Tips (video)
Single IRB (sIRB)
Genomic Data Sharing
- How do I obtain Institutional Certification so I can submit data to an NIH-supported genomic data repository (e.g., dbGaP)?
- What should I do if the initial consent forms are not consistent with submission of data to the NIH Repository, or if there was no informed consent obtained?
Good Clinical Practice
- What is Good Clinical Practice?
- What is covered in the Good Clinical Practice Guideline?
- What are some examples of Good Clinical Practice?
- What are some differences between Good Clinical Practice and FDA regulations?
- Where can I learn about Good Clinical Practice?
Research Involving Cadavers or Deceased Individuals
- Does the IRB require a protocol for research involving cadavers or deceased individuals?
- Does the IRB need to review research involving protected health information (PHI) about deceased individuals?
Certificate of Confidentiality
- What is a Certificate of Confidentiality (CoC)?
- CoC Assurance Letter Template
- If part of my cohort was recruited prior to issuance of the Certificate do I need to re-consent them?
- May identifiable, sensitive information protected by a Certificate of Confidentiality be placed in a subject’s medical record? If identifiable, sensitive information protected by a Certificate is placed in a subject’s medical record, is it still protected?
- Does the NIH Policy on Certificates of Confidentiality and subsection 301(d) of the Public Health Service Act (42 U.S.C. 241(d)) permit HHS auditing and other regulatory compliance monitoring of NIH-funded projects?
- As with many pragmatic trials, my study is fully integrated with clinical care, such that for research purposes we will extract information from the medical records and for clinical care we intend to incorporate research data into the medical records. Must we have the participants’ consent to put research data in the medical records?
European Union General Data Protection Regulation (GDPR)
Other/Special Circumstances
Other Education Resources
Basics
What is the eProtocol system?
eProtocol is an online application used at Stanford to submit, review and approve research.
How do I use the eProtocol system?
See the webpage about how to get started and eProtocol FAQs.
What is a protocol?
A protocol is a detailed plan for conducting research.
What does STANFORD (all caps) signify?
This denotes the five STANFORD affiliated organizations:
- Stanford University (SU)
- Stanford Medicine Health Care (SMHC)
- Stanford Medicine Children’s Health (SMCH)
- Veterans Affairs Palo Alto Health Care System (VAPAHCS)
- Palo Alto Veterans Institute for Research (PAVIR)
Human Subjects Training
What training do I need?
Completion of human subject research training by all staff working on a research project (all investigators and other study personnel, including all persons who are responsible for the design, conduct, data analysis or reporting) is one of the requirements for protocol approval by the IRB.
See CITI (Tutorial) for more information.
What is CITI?
Stanford provides access to the required training through the interactive online Collaborative IRB Training Initiative (CITI) Course: The Protection of Human Research Subjects.
How do I transfer training from another institution?
- Transfer CITI training completed at another institution:
- Login to the CITI website directly with your CITI or prior institution's login credentials.
- Click on the link 'Associate With Another Institution' and choose Stanford.
- Your completed modules will be recorded in Stanford's database.
- If issues in transferring: Report the issues to CITI support center
- Once the transfer is completed successfully, your CITI trainings will reflect in your account when you login using SUNetID.
- Stanford users without a SUNetID: Request a SUNetID from your Stanford department, before starting the transfer of CITI training.
- Transfer non-CITI training completed at another institution:
- Contact IRB Education (650-724-7141) to see if your past training can be transferred. Generally, Stanford University will accept comparable Humans Subjects training from other institutions. You will need to provide the IRB your most recent training completion report.
- When your training expires, register at CITI with Stanford University as your affiliate institution to take the Refresher course.
- See CITI (Tutorial) for more information.
Why is my CITI training showing as incomplete in eProtocol?
If you have completed your training but it is not showing as completed in eProtocol, please contact the eProtocol helpdesk for assistance here.
Protocol Management
Before Submitting a Protocol
- Do I have to submit a protocol to the IRB?
- Scientific and Scholarly Validity (SSV) reveiw requirements
- Academic Sponsor review of Scientific and Scholarly Validity and Oversight
- IRB Review Fees
- What qualifies as a pilot study?
- Quality Assessment & Quality Improvement (QA/QI) - different to research?
- Can Stanford students conduct Human Subject research?
- How do I get information about Stanford students for my study?
- Who oversees student research?
Submitting a Protocol (questions the PD should consider)
- Should I submit a medical or non-medical protocol?
- Review Type: What is it and why do I need to know?
- Can I use the Chart Review Form?
- What should I consider when doing focus group research?
- Is there a guide to help me through the eProtocol system?
- Overview of the IRB Application
- IRB Medical Application Process
- IRB Non-Medical Application Process
- eProtocol Help & Hints:
- Consent
- My Academic Sponsor didn't get the financial disclosure email. What do I do?
- My name is not displaying correctly in eProtocol. What do I do?
After Submitting a Protocol
- What happens after I submit my protocol?
- What is the status of my protocol?
- When can I expect to get IRB approval?
- Can I begin working on my protocol before approval?
After a Protocol is Approved
- Changes to approved protocols
- Events that must be reported to the IRB
- Continuing IRB Approval
- What happens when a protocol approaches its expiration date?
- If a protocol expires
- Extended Approval Process (EAP)
Closing a protocol
Before Submitting a Protocol
Do I have to submit an application to the IRB?
Studies that meet the definition of Human Subject Research must be submitted to the IRB and must receive IRB approval before any study activities take place. This chart may assist you in determining whether your study meets the definition.
For additional information on certain student projects, pilot studies, oral history projects, or quality assessment/quality improvement projects, see:
- Use of Human Subjects in Student Projects, Pilot Studies, Oral Histories and QA/QI Projects
- FAQs about Quality Assessment & Quality Improvement (QA/QI)
If you want the IRB to determine whether your activity constitutes human subject research, complete this form and submit it through eProtocol to request a Human Subjects Research (HSR) Determination.
Scientific and Scholarly Validity (SSV) Review Requirements
All research (except Chart Review and Exempt protocols) requires a review of Scientific and Scholarly Validity. For research that does not otherwise undergo this type of review (i.e. federal agency grant review, FDA oversight of an IND/IDE, Clinical Research Unit (CRU), or review by the Cancer Center Scientific Review Committee (SRC)), the researcher's Division Chief, Department Chair, or their designee must provide this review for the proposed research. Provide the link found in the 'Attachments' section of your application to the appropriate person to complete this review. If the Department Chair is a researcher on the protocol, submit the protocol and the IRB Manager will request this review as appropriate.
For research where Clinical Research Unit or Cancer Center Scientific Review Committee (SRC) review was completed, please attach documentation in the ‘Attachments’ section of your protocol application.
Academic Sponsor Review Requirements
If the Protocol Director is a student, Resident, Fellow or Post-Doc and requires and Academic Sponsor to be listed on the protocol, the Academic Sponsor must complete a review of scientific and scholarly validity and protocol oversight. Provide the link found in the 'Attachments' section of your application to the Academic Sponsor to complete this review.
IRB Review Fees
Initial and continuing review Industry Sponsored Clinical Trials IRB Review Fees.
What qualifies as a pilot study?
A pilot study is a preliminary investigation of the feasibility of the study which would not contribute to generalizable knowledge and therefore is not considered research. However, if the researcher plans to use the pilot data for research purposes, IRB review is required. More information on pilot studies is found here.
Can Stanford students conduct Human Subject research?
Stanford University supports a wide range of both undergraduate and graduate student research projects using human subjects – from course-related research exercises to Ph.D. dissertation studies. More information is found here.
How do I get information about Stanford students for my study?
If you plan to request email addresses, or biographic, demographic or academic data on Stanford students from the Registrar's Office as part of your research, email the Director of Institutional Research regarding the process to obtain these data before you submit your protocol to the IRB.
Who oversees student research?
Student protocols must have the Academic Sponsor review and fill out the form for scientific and scholarly validity, and oversight.
Submitting a Protocol (questions the PD should consider)
Should I submit a medical or non-medical protocol?
Type of Protocols | Description |
---|---|
Medical Protocols | Conducted by personnel within, or conducted through, the School of Medicine (SOM), the Veterans Affairs Palo Alto Health Care System (VAPAHCS), the Palo Alto Veterans Institute for Research (PAVIR), or otherwise involving any medical procedure or use of personally identifiable health information are submitted on the Medical protocol application |
Social & Behavioral (Non-medical) Protocols | Human subjects research studies conducted by personnel within, or conducted through, Schools of Business, Education, Engineering, Humanities & Sciences, Law, and Psychology (except MRI studies) are submitted to the IRB on the Non-medical eProtocol application. |
Review Type: What is it and why do I need to know?
Before starting an eProtocol application, investigators must identify the appropriate Review Type. eProtocol then generates the appropriate form type for that review. There are six forms:
Select a Form Type below to create the eProtocol application for IRB review. Learn more about different form typee or contact IRBeducation@stanford.edu or (650) 724-7141 if you have questions. “Minimal Risk” means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests. | |
---|---|
Regular | For greater than minimal risk studies |
Expedited | Minimal risk studies meeting specific criteria |
Exempt | Studies meeting specific criteria |
Chart Review | Chart review studies that only involve the analysis of STAnford Research Repository (STARR) data or other Stanford/ Veterans Affairs Palo Alto Health Care System (VAPAHCS) medical records. Minimal risk studies only. |
Single IRB (sIRB) | Studies where Stanford IRB is being asked to rely on an external IRB. |
Human Subjects Research (HSR) Determination | Projects that don't clearly qualify as human subjects research. Include the HSR Determination form in your submission. |
Single Patient IND | Single patient treatment where the PD must obtain an IND from the FDA. Include FDA Form 3926 in your submission with 10(b) “Request for Authorization to Use the Alternative IRB Review Procedures” selected and you will be required to fill out an abbreviated Single-Patient form. If this box is not selected, you will be required to fill out the full/regular application. |
Humanitarian Use Device (HUD) | Treatment using a device with a Humanitarian Device Exemption (HDE) issued by FDA. |
Can I Use the Chart Review Form?
Use of the Chart Review Form type is limited to research involving analysis of STARR data or Stanford/VAPAHCS medical records that have been collected for non-research purposes.
The Expedited or Regular application should be used if the research:
- involves evaluating the safety and effectiveness of a drug or device;
- includes receipt of records from outside of Stanford and/or VAPAHCS;
- includes data collection targeting prisoners or abortuses;
- involves machine learning, or algorithm development or validation;
- involves over 10,000 records;
- obtains or analyzes specimens;
- is creating a data repository or database;
- involves prospective collection of data; or
- includes collaborating sites.
What should I consider when doing focus group research?
While researchers generally keep participant’s information confidential, this cannot be guaranteed in groups. Researchers should inform participants of confidentiality limitations in group settings, while still encouraging participants not to repeat what is said outside of the group. Focus groups with adults where shared information is not sensitive (e.g., no harm to reputation, employment, student status; no protected health information, etc.) may qualify for exempt review. Studies with minors and/or with potential to share sensitive information will require expedited or full review. For questions contact IRB Education for medical research or IRB Non-med for social behavioral research.
Is there a guide to help me through the eProtocol system?
On the right side of your eProtocol homepage, there is a help section. Following are sections which may be useful to you:
Section | Description |
---|---|
Getting Started | A Summary for New Users |
eProtocol Training | eProtocol Basics Video and Information on Group Training |
eProtocol FAQs | Getting Started, Managing Protocols, Troubleshooting |
HELPSU and Contact Us | For eProtocol Assistance |
When is a Data Risk Assessment (DRA) needed?
A DRA is needed when Moderate or High Risk data is being transferred to a non-Stanford entity during the course of a research study.
For more information, see Stanford University IT’s Getting started with DRAs. For questions or assistance, contact the DRA team at dra_review@lists.stanford.edu.
Consent
Documenting Consent
- Consent Form Do's & Don'ts (a practical guide)
Can consent requirements be waived?
The IRB may approve a
• Waiver/Alteration of consent or a
• Waiver of Documentation (signature requirement)
if the research meets regulatory criteria.
What if there are non-English speaking participants?
Investigators are encouraged to recruit and include all segments of the community in research, including individuals whose primary language is not English. A general requirement for informed consent is that the 'information that is given to the subject or the representative shall be in a language understandable to the subject or the representative' [45 CFR 46.116 21; CFR 50.20].
Where can I get a consent form translated?
It is important that consent forms be translated accurately. Procedures for ensuring accurate translation should be described in the protocol application. For more information, contact Translation Services (Stanford Medicine Health Care) at (650) 724-8735.
When can I use the short form consent process?
When all of the participants in a study (i.e., the target population) are anticipated to be non-English speaking, a full translated consent is strongly encouraged. Use of the short form consent process and documents requires prior IRB approval.
Does the IRB provide translated short form consent documents?
There are short form templates in many languages.
Does my research require an assent form?
Generally, a child 7 - 17 years old should sign an assent form.
My Academic Sponsor didn't get the financial interest disclosure email. What do I do?
Have them go to their OPACS Dashboard, locate the protocol, and click the red "Enter Response" button. They can answer the questions there.
My name is not displaying correctly in eProtocol. What do I do?
The user should go to StanfordWho, then click "Maintain your directory and AlertSU emergency contact information" and update the Preferred name. The name will then import to eProtocol.
After Submitting a Protocol
What happens after I submit my protocol?
Your protocol will be assigned to an IRB panel and meeting date. Be sure to watch for IRB comments. IRB staff may contact you by email or phone to obtain further information or to inform you of IRB questions/comments that require you to submit a response.
Please check your email daily for IRB comments during the month your protocol is being reviewed. Approval of your project may be delayed if responses to comments are not received promptly.
What is the status of my application?
eProtocol is the system of record and the My Dashboard page should be used to access information on protocol status:
- Action Items - Protocols needing action by the research team
- In Process - Protocols undergoing review by the IRB
- Active Protocols - Ongoing
- Non-Active Protocols - Closed or expired
When can I expect to get IRB approval?
- Regular - Generally, protocols are approved at the meeting date to which they are assigned.
- Expedited, Exempt, Chart Review - Generally, studies are reviewed in the order in which they are received. The actual approval date may be prior to the meeting date to which it is assigned.
Can I begin working on my protocol before I receive IRB approval?
NO. WAIT for IRB Approval. You may not begin your project until you have been notified of the IRB's approval. The IRB process takes about a month to review a new protocol, depending on the review type. Be sure to allow time for the IRB to review and approve your protocol before you begin your research.
Under no circumstances should you interpret a lack of communication from the IRB as an approval. You can view your protocol status in the eProtocol home page.
After a Protocol is Approved
Protocol Directors must maintain appropriate study oversight, as described in HRPP Policy Manual Ch. 15.3 Research Oversight.
Changes to approved protocols
All proposed changes to approved research must be prospectively reviewed and approved by the IRB, (except where necessary to eliminate apparent immediate hazards to subjects – see Events and Information that Require Prompt Reporting to the IRB.)
Events that must be reported to the IRB
Certain events and circumstances (for non-Exempt human subject research) must be promptly reported to the IRB. See Events and Information that Require Prompt Reporting to the IRB.
Continuing IRB Approval
When applicable, the Protocol Director is responsible for ensuring that protocols are submitted for continuing review and approval by the IRB prior to the study’s expiration date, and in sufficient time to ensure their non-interruption.
What happens when a protocol approaches its expiration date?
Studies with an expiration date must be reviewed by the IRB prior to the study’s expiration. The expiration date is the last day that the protocol is approved (that is, the investigator may conduct research on the expiration date itself, but may not on the next day unless the IRB has approved renewal of the protocol following continuing review).
Researchers are alerted about an expiring protocol two months in advance by an eProtocol-generated notice, with a second reminder approximately one month later.
If no continuing review application has been received prior to an expiration date, an expiration notice is sent out within three business days of the protocol expiration; to keep the protocol active, a continuing review application must be submitted immediately.
If a protocol expires
Expired protocols appear in red type on the investigator’s eProtocol Home Page under “Non-Active Protocols”. They are not automatically closed due to non-response by the Protocol Director; once expired, the PD may ask the IRB staff to perform an ‘administrative close’, or may contact the IRB to discuss options available.
Extended Approval Process (EAP)
Some minimal risk studies do not require annual review.
- IRB Approval letters and consent forms (when applicable) will document that the study qualifies for extended approval and will not expire.
- With extended approval, modifications must still be submitted for IRB approval prior to implementing changes, and events that meet prompt reporting criteria must be reported to the IRB.
- Extended approval does not apply for some minimal risk research (e.g. FDA-regulated research, prisoner studies, stem cell research, etc.
Protocols that receive an extended approval should still be closed with the IRB when the research is completed. Every three years, researchers are asked to confirm the study is active.
Closing a protocol
When and how to close a protocol
Protocols should be closed in eProtocol when the study has been completed, or when the only remaining activity is analysis of de-identified data. The Protocol director is responsible for reporting the completion of the protocol to the IRB within 30 days.
A protocol is completed when all participants have been enrolled; all participants have completed all research-related interventions, including any protocol required follow-up; all analysis of identifiable data is completed; and all funding and contracting issues have been completed/cleared. See the HIPAA and PHI guidance for more information on de-identification.
Protocols are closed via eProtocol, either by submitting a Final Report to the IRB (required for certain protocols – see below), or by changing the protocol status in eProtocol (see eProtocol instructions.)
When is a Final Report required?
A Final Report must be submitted to the IRB for:
Final Reports are required for:
• Research that was subject to regular review
Final Reports are not required for:
• Research subject to expedited* or exempt review
The Final Report should be submitted to the IRB within 30 days of the study completion.
*All Expedited FDA-regulated protocols must be closed by the Protocol Director.
Record retention
All data, including all signed consent form documents, must be retained for a minimum of three years past the completion of the research. Additional requirements may be imposed by the funding agency, your department, or other entities (e.g. 7 years for studies conducted under HIPAA). (See also Research Policy Handbook RPH 1.9 - Retention of and Access to Research Data)
Genomic Data Sharing
See:
- Stanford HRPP guidance on Genomic Data Sharing
- NIH Genomic Data Sharing (GDS) website
- RMG website
- genetics v. genomics - see Lay Language Glossary definitions
How do I obtain Institutional Certification so I can submit data to an NIH-supported genomic data repository (e.g., dbGaP)?
To request Extramural Institutional Certification, submit the following to IRB Education:
- A blank copy of each consent form used to collect samples from which data were/will be generated.
- If the dataset includes data from samples obtained at another institution, including commercial vendors such as ATCC, the Stanford IRB will review each of those consents as well.
- Submit “each consent,” version across studies, and across time. Essentially EACH IRB-approved consent document used to collect samples represented in the dataset.
- A completed Genomic Data Sharing Checklist for each consent.
- A completed PD-signed Extramural Institutional Certification form that correlates with the dates samples were collected from participants. Once the IRB confirms the data can be submitted to an NIH-supported genomic data repository, the IRB will obtain the Authorized Institutional Official‘s signature and return the signed form to whomever requested the extramural certification.
What should I do if the initial consent forms are not consistent with submission of data to the NIH Repository, or if there was no informed consent obtained?
- For data from specimens collected before 1/25/2015, the IRB will assess whether the data submission is consistent with the informed consent given by the participant. NIH will accept data derived from de-identified cell lines or clinical specimens lacking consent for research that were created or collected before 1/25/15.
- For studies initiated after 1/25/15, NIH expects researchers to obtain participants’ consent for their data to be shared broadly for future research.
- For studies that prohibit sharing by using statements such as “Your data will never be shared outside of Stanford,” re-consenting may be possible. Any plan to re-consent should be submitted to the IRB as a modification to the protocol along with the modified consent form prior to implementation.
- See Related Non-Stanford Sites for additional NIH resources.
Good Clinical Practice
What is Good Clinical Practice?
The International Council for Harmonisation provides a Guideline for Good Clinical Practice ICH E6(R2). The guideline sets standards for clinical investigations based upon the Declaration of Helsinki ethical principles for medical research involving human subjects. It outlines how to design, conduct, monitor, analyze, audit, and report trials in ways that protect the rights and wellbeing of research participants and provide valid data.
What is covered in the Good Clinical Practice Guideline?
The Guideline for Good Clinical Practice ICH E6(R2) contains clinical trial principles, responsibilities for IRBs, clinical investigators, and sponsors, requirements for protocols, amendments, and investigator's brochures, and lists essential documents.
What are some examples of Good Clinical Practice?
The ICH GCP guideline states that studies should be scientifically sound, investigators should weigh risks against anticipated benefits, research personnel should have proper expertise and training, informed consent should be obtained, trials should be monitored, and data should be verifiable, among several other standards.
What are some differences between Good Clinical Practice and FDA regulations?
ICH GCP has essential document requirements, additional signature requirements, requirement of providing risks and benefits to alternative treatments, requires consent to have a participant responsibility section and explain the likelihood of being enrolled in either treatment or placebo arms of study, additional sponsor requirements, direct access to medical records for monitors, auditors, IRB, and regulatory authorities, among others.
Where can I learn about Good Clinical Practice?
If you plan to be involved in recruiting, consenting, conducting procedures, analyzing or reporting private identifiable data on a clinical trial at Stanford, you are required to take human subjects training that includes GCP content. Note also that NIH requires GCP training for NIH-supported clinical investigations. Other Stanford personnel not engaged in human subjects research may also opt to take the course for educational purposes.
Research involving cadavers or deceased individuals
Does the IRB require a protocol for research involving cadavers or deceased individuals?
Generally speaking, research involving cadavers or deceased individuals does not meet the definition of human subjects research. However, there may be circumstances where IRB oversight is needed, such as when obtaining CA State-produced death records or indices, or tissues/samples prospectively collected from individuals who were/are living at the time of sample collection. If in doubt, contact IRB Education.
Does the IRB need to review research involving protected health information (PHI) about deceased individuals?
HIPAA protections extend beyond an individual’s death. Please work with the Privacy Office to determine how best to obtain authorization to use and disclose PHI from deceased individuals.
Certificate of Confidentiality (CoC)
What is a Certificate of Confidentiality (CoC)?
CoCs protect the privacy of research participants by prohibiting disclosure of identifiable, sensitive research information to anyone not connected to the research except when the participant consents or in a few other specific situations. Effective October 1, 2017, all ongoing or new research funded by NIH as of December 13, 2016 that is collecting or using identifiable, sensitive information is automatically issued a CoC through a term and condition of award. Other federal agencies will continue to issue CoCs to researchers they fund via an application process. Research that is not federally funded can apply for a CoC to NIH or the FDA as appropriate. For more information on the NIH Policy.
If part of my cohort was recruited prior to issuance of the Certificate do I need to re-consent them?
Neither the NIH Policy on Certificates of Confidentiality nor subsection 301(d) expect participants consented prior to the change in authority, or prior to the issuance of a Certificate, to be notified that the protections afforded by the Certificate have changed, or that participants who were previously consented to be re-contacted and informed of the Certificate. However, IRBs may determine whether it is appropriate to inform participants. Go to the NIH CoC Kiosk for more FAQs
May identifiable, sensitive information protected by a Certificate of Confidentiality be placed in a subject’s medical record? If identifiable, sensitive information protected by a Certificate is placed in a subject’s medical record, is it still protected?
In general, placing research information protected by a Certificate of Confidentiality into a subject’s medical record would require the subject’s consent unless such disclosure is required by law. NIH encourages institutions and investigators who wish to include identifiable, sensitive information protected by a Certificate in a medical record, to work with their institutional counsel to determine how to do so in accordance with subsection 301(d) of the Public Health Service Act and other relevant laws.
Section 301(d) of the Public Health Services Act protects identifiable, sensitive information and all copies thereof. Accordingly, if identifiable, sensitive information protected by a Certificate is placed in a subject’s medical record, the protections of the Certificate and prohibitions on further disclosure of the information may apply. Investigators should also work with their institutional counsel to ensure that proper consent is obtained for all potential disclosures from medical records.
Note that a Certificate is not intended to limit the access of research participants to research information about themselves.
Does the NIH Policy on Certificates of Confidentiality and subsection 301(d) of the Public Health Service Act (42 U.S.C. 241(d)) permit HHS auditing and other regulatory compliance monitoring of NIH-funded projects?
Yes, NIH considers auditing and regulatory compliance monitoring to be activities connected with the research and thus does not consider disclosure of information to, for example, members of relevant Institutional Review Boards or individuals within the HHS Office of Inspector General to violate the statute or the Policy if used for HHS auditing or regulatory compliance.
As with many pragmatic trials, my study is fully integrated with clinical care, such that for research purposes we will extract information from the medical records and for clinical care we intend to incorporate research data into the medical records. Must we have the participants’ consent to put research data in the medical records?
The policies for handling research data and medical records can differ with each institution. For this reason, NIH suggests that investigators who intend to include research data in subjects’ medical records work with their own institutional counsel and IRB to ensure that all documents are handled appropriately and in line with the institution’s own policies.
European Union General Data Protection Regulation (GDPR)
What is GDPR?
Effective May 25, 2018, Stanford University is required to comply with the European Union General Data Protection Regulation (GDPR) which regulates the collection, processing, storage, transfer, and protection of personal information, including data collected for research. The GDPR is a comprehensive privacy law that governs any entity that collects or processes the personal data of any citizen of the member states of the European Economic Area (https://www.tripsavvy.com/countries-that-are-eea-countries-1626682).
What do researchers need to do?
For research that includes human subjects, language for the consent will be provided to you during IRB review. The language will inform participants about their study data regulated under the GDPR.
Find out more:
If you have specific questions about GDPR, please contact the University Privacy Office. You can also find additional information on GDPR at https://privacy.stanford.edu/policies/gdpr and DoResearch.
Expanded Access, Emergency Use, Humanitarian Use (HUD)
Expanded Access
- What is Expanded Access?
- What is Compassionate Use?
- Does Expanded Access require IRB approval?
- Does Expanded Access require FDA approval?
- What are Expanded Access reporting requirements to the FDA?
What is Expanded Access?
Expanded Access is when investigational drugs, biologics, or devices are made available, under certain circumstances, to treat patient(s) with a serious disease or condition who cannot participate in a clinical trial. Expanded Access can be permitted by the FDA for individuals, intermediate size groups or widespread treatment, each under specific criteria. [21 CFR 312.300 (Subpart I)]
See: Expanded Access Brochure; HRPP Policy Manual Chapter 5.8
What is Compassionate Use?
“Compassionate Use” has commonly been used to refer to expanded access. The term ‘Compassionate Use’ is used in the FDA guidance for Single Patient/Small Group Access to a device.
Does Expanded Access require IRB approval?
All Expanded Access, except Emergency Use (see GUI-6), requires prior IRB review and approval.
Does Expanded Access require FDA approval?
DRUGS
Prior approval from the FDA is required (either a new IND or a protocol amendment to an existing IND).
DEVICES
The sponsor should submit an IDE supplement to the FDA requesting approval for a protocol deviation.
What are Expanded Access reporting requirements to the FDA?
DRUGS
Submit IND safety reports promptly, and annual reports if the protocol continues for one year or longer.
DEVICES
Sponsor must submit semi-annual progress reports to the FDA until the filing of a marketing application. After filing, progress reports must be submitted annually [21 CFR 812.150(b)(5)].
Emergency Use
- What is Emergency Use?
- Is permission needed for Emergency Use?
- What are Emergency Use reporting requirements?
What is Emergency Use?
Use of an investigational article on a human subject in a life-threatening situation in which no standard acceptable treatment is available, and in which there is not sufficient time to obtain IRB approval [21 CFR 56.102(d)].
Is permission needed for Emergency Use?
Contact sponsor to obtain permission to use and obtain test article.
Contact FDA for DRUGS – Emergency use may be requested by telephone, facsimile, or other means of electronic communications.
DEVICES – No prior approval from FDA is required for shipment or emergency use of investigational devices.
IRB: Emergency Use is exempt from prior IRB review and approval, provided it is reported to the IRB within 5 working days after the use. Contact IRB if you have any questions.
What are Emergency Use reporting requirements?
IRB:
Must be reported to the IRB within 5 working days after the use:
Emergency Use of a Test Article – Notification to the IRB
FDA:
Drugs: Physician or sponsor must submit a new IND, or amendment to an existing IND, within 15 working days of FDA’s authorization of the use. Clearly mark “Emergency IND” on top of Form 1571.
Devices with IDE: Sponsor is responsible to report the use after receiving sufficient information from the physician.
Devices with no IDE: Physician must report the use within 5 working days.
See also HRPP Policy Manual Chapter 5.9
Humanitarian Use (HUD)
What is a Humanitarian Use Device (HUD)?
A medical device intended to benefit patients by treating or diagnosing a disease or condition that affects or is manifested in not more than 8,000 individuals in the United States per year.
See also HRPP Policy Manual Chapter 5.10