Researcher Guidebook

The Human Research Protection Program (HRPP) and Institutional Review Board (IRB) Researcher Guidebook is designed as a resource to guide investigators and study staff through policies and procedures related to the conduct of human research that are specific to the Western Michigan University Homer Stryker M.D. School of Medicine “WMed”. This guidance document is intended as a supplement to the HRPP and IRB Policy Manual and serves as a guide for the research community when preparing and submitting materials to the WMed IRB.

General information regarding human research protections as well as relevant federal regulations and guidance has been incorporated throughout this manual where applicable.

The complete Researcher Guidebook is available here, otherwise click on the links below.

  • Key Definitions and Terms

    iMedRIS

    iMedRIS is the IRB’s online submission system, available at https://imedris.wmed.edu. Users must have an active WMed login to access the iMedRIS system. If you and/or any of the research team does not have a WMed login, please complete a New User Request Form.

    To report technical problems with iMedRIS, contact the WMed help desk at support@wmed.edu or call 269-337-4409, option 2.

    If you need help with the submission process, call 2690-337-4345. To schedule one-on-one training, call 269-337-4345.

    IRB

    The Institutional Review Board (IRB) is a committee that is required by federal law to protect the rights and welfare of human subjects participating in research. The committee meets this mandate by reviewing and overseeing human research activities. The Office of the IRB provides administrative support to the WMed IRB.

    HIPAA

    The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes national standards for the protection of health information (called “protected health information” or PHI). It applies to organizations such health plans, health insurance companies, health care clearinghouses, and health care providers that conduct health care transactions electronically. 

    These organizations are called “covered entities.” At WMed the WMed community clinics are covered entities under the HIPAA Privacy Rule but the medical school itself is not a HIPAA covered entity.

    The HIPAA Privacy Rule establishes conditions under which covered entities can use or disclose PHI for many purposes, including for research. Specifically, the Rule establishes the right of an individual, such as a research subject, to authorize a covered entity to use and disclose his/her PHI for research purposes. This requirement is in addition to the informed consent to participate in research required under the HHS Protection of Human Subjects Regulations (we follow the 2018 Requirements) and other applicable Federal and State laws. See Documenting HIPAA Authorization for additional considerations.

    To learn more about how the Rule may impact your research, refer to the NIH booklet Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule

    Human Research

    The WMed IRB follows the regulatory definitions of “Human Subjects Research”, which are described in Section I. Human Research Protection Program of the HRPP and IRB Policy Manual. To determine whether proposed activities constitute the DHHS or FDA definitions of Human Subjects Research, investigators can refer to “Checklist: Human Research Determination” or OHRP Decision Charts. If requested, the IRB will review the proposed activities and make a formal “Not Human Subjects Research” determination. Go to https://imedris.wmed.edu to submit this request.

    Human Research Protection Program

    The WMed Human Research Protection Program (HRPP) is a comprehensive system to ensure the protection of the rights and welfare of participants in human research. The HRPP is based on all the individuals at WMed which includes key individuals and committees fulfilling their roles and responsibilities as described in Section I. Human Research Protection Program of the HRPP and IRB Policy Manual.

    The HRPP has jurisdiction over all human subject research conducted under the auspices of, or using the services or resources of the medical school.  This includes research that is externally funded, funded from internal sources, or conducted without direct funding.

    The Institutional Review Board (IRB) serves as the cornerstone of the WMed HRPP.  The IRB and the HRPP report to the Institutional Official, who is also the dean of the medical school.

    Checklists/Templates/Forms/Guidance

    All Checklists, Templates, Forms referenced within this document can be found on the Forms and Templates webpage.

  • IRB Determinations and Modes of Review

    Not Human Subjects Research Determination

    All human subjects research must undergo review by the WMed IRB. Activities that do not meet the definition of human research do not require review and approval and do not need to be submitted to the IRB unless there is a question regarding whether the activity is human research.

    Refer to “Checklist: Human Research Determination” or OHRP Decision Charts for guidance on whether the proposed activities constitute human research. Email a description of the activity to irb@wmed.edu if it is unclear whether an activity is human research.

    To obtain a formal “Not Human Subjects Research” determination from the IRB go to https://imedris.wmed.edu to submit a request.

    Exempt Determination

    Certain categories of human research may be exempt from regulation. Investigators may not determine whether their proposed human research is exempt. Instead, formal determination is required by the WMed IRB prior to implementation in the field.

    The IRB uses “Checklist: Exempt Determination” when determining whether a particular study meets one or more exempt criteria. When conducting exempt human research internationally, the Principal Investigator is required to comply with applicable local laws, legislation, regulations, and/or policies. Additionally, if local IRB/ethics review is required, it must be obtained before any human research activities are conducted in the field. If assistance with applicable local requirements is needed, contact Office of the IRB at 269-337-4345.

    Expedited Review Procedure

    Certain categories of non-exempt human research may qualify for review using the expedited procedure, meaning that the project may be approved by one or more designated reviewers, rather than by the convened IRB. Refer to “Checklist: Expedited Review” for reference on applicable categories of research. Minimal risk protocols eligible for review using the expedited procedure do not require continuing review unless the IRB member determines otherwise.

    Convened IRB Review (“Full Board”)

    Non-exempt human research that does not qualify for expedited review must be reviewed by the convened IRB. The WMed lRB meets monthly. Reference the convened IRB meeting schedule and submission deadlines information on the WMed website. 

  • Determining when an IRB Application is Required

    The WMed IRB is responsible for the review and oversight of human research conducted by its agents. Its oversight applies regardless of whether the human research is conducted at a WMed, another institution, in another country, and/or in collaboration with non-WMed affiliates. If it’s unclear what is required for collaborative research, please call the Office of the IRB at 269-337-4345.

    Some activities do not require WMed IRB review. Activities that do not meet the definition of “Human Subjects Research” do not fall under the HHS Protection of Human Subjects Regulations. See “Checklist: Human Research Determination” for additional guidance.

    IRB Review Process

    Once an application is submitted in iMedRIS, it will be undergo a pre-review by the Office of the IRB in the order it is received. After pre-review, the Office of the IRB may request clarifications, revisions, and/or additional information in iMedRIS (“Review Corrections/Additions Notification”). The Principal Investigator will submit a response to “Stipulations” in iMedRIS to resolve these requests. When resolved, the IRB reviewer will either complete their review and issue a determination letter or assign the application to an IRB meeting for review. The convened IRB may request additional information following its review.

    A determination letter will be issued in iMedRIS once the review is complete. System notifications are sent to the Principal Investigator and study contact from iMedRIS at initial receipt of the submission and when the institutional approvals have been completed. If you have questions about the status of your study during either the Institutional Approval or IRB review process call 269-337-4345 or email irb@wmed.edu  and request an update on the status of your review.

    IRB Approval Criteria

    The criteria for IRB approval of non-exempt human research can be found in “Checklist: Criteria for Approval.” Additional checklists may be applicable depending on the nature of the proposed Human Research, e.g., inclusion of children will prompt the use of “Checklist: Research Involving Children

    Checklists are used by IRB members and reviewers at the time of initial review, continuing review, during the review of modifications to previously approved human research, and when reviewing Reportable New Information. Investigators are also encouraged to consult these materials when writing the Research Protocol. “Checklists” and “Protocol Templates” can be found at on the WMed IRB website and are reflective of the information required to assess criteria for approval.

    IRB Review Turnaround Time

    The below table reflects “target” review turnaround time for IRB reviews.  Of note, these times are not inclusive of the institutional approval process and may vary depending on the quality and completeness of the submission, complexity of the project, required ancillary reviews, and responsiveness of the PI.

    Not Human Subjects Research Determination 1 Day
    Exemption Determination 3 Days
    Expedited Initial and Continuing 5 Days
    Expedited Modifications 2 Days
  • IRB Decisions

    If the IRB has approved the human research, it may commence once all applicable institutional and/or local approvals have been secured.  IRB approval may be granted for a limited period of time, not exceeding one year, which is noted in the approval notification letter.

    Approval

    For studies that do not require continuing review, the PI remains responsible for submitting the following to the IRB, as applicable:

    1. Any change or update to the research must be submitted in iMedRIS via a Modification.

    2. Once the study is eligible for closure, a closure request must be submitted in iMedRIS via the Close Study activity.

    3. All reports of new information must be submitted in iMedRIS via the Report New Information activity.

    Requires Modification(s)

    If the IRB requires modification(s) to secure approval, the notification letter will outline specific revisions to the human research and/or study materials, e.g., Research protocol, consent form, study tools, etc. Research may not commence until the IRB grants final approval.

    If the Principal Investigator accepts the required modifications, s/he should submit the revised materials via iMedRIS to the IRB within 30 calendar days. If all requested modifications are made, the IRB will issue a final approval notification letter after which time the Human research can begin.

    If the Principal Investigator does not accept the modifications, s/he should write a response detailing why such modifications are not appropriate and/or feasible and submit it to the IRB within 30 calendar days.  If the Principal Investigator does not respond to the IRB within 45 calendar days, the decision of approval with the requested modifications will be withdrawn.

    Deferral or Disapproval

    If the IRB defers or disapproves the Human research, it will provide a statement of the reasons for this decision. Deferral or Disapproval means that the Human research, as proposed in the submission, cannot be approved and the IRB was unable to articulate specific modifications that, if made, would allow the Human research to be approved.

    In most cases, if the IRB’s reasons for the deferral or disapproval can be addressed through revision(s) to the protocol, IRB approval can be achieved. In all cases, the Principal Investigator has the right to address his/her concerns to the IRB directly at an IRB meeting and/or in writing.

  • Principal Investigator

    Eligibility

    A Principal Investigator (PI) for non-exempt Human research must be a WMed faculty member, or a member of the medical staff at Borgess or Bronson e.g., professor, community faculty. This requirement does not preclude any non-faculty member from being listed as a Co-Investigator on the project, or having certain research responsibilities delegated to them, but they may not be named as PI nor assume ultimate responsibility for the assurances listed in Appendix A. Principal Investigator Responsibilities and Assurance Statement (in iMedRIS).

    Responsibilities

    For each application submitted to the IRB, the PI must acknowledge their role and responsibilities in the research. This action must be completed prior to the submission packet completion in iMedRIS.

  • Human Subjects Research Training

    All investigators and key personnel who participate in the design, conduct, and/or reporting of human subjects research (including exempt research) must be trained in the protection of human subjects (biomedical or social behavioral track, as applicable), Health Information Privacy and Security; and Conflicts of Interest. WMed uses the Collaborative Institutional Training Initiative (CITI) web-based human research courses to satisfy this requirement. Go to https://wmed.edu/cititraining for instructions.

    If you’ve completed CITI or an equivalent while conducting human research at another institution, submit your completion certificate to the IRB at irb@wmed.edu. We’ll evaluate and determine if it meets the requirements of the WMed HRPP training policy. If you completed CITI at another institution, you can simply affiliate with WMed that way your training information will transfer into the WMed system. Go to https://wmed.edu/cititraining for instructions on how to affiliate. Also, when you affiliate with WMU Homer Stryker M.D. School of Medicine on your CITI account your training information will transfer into the WMed electronic system.

    Evidence of current training for each investigator and member of the research staff with the date of completion within three years of the application date must be included as part of every new research study application and application for continuing review. Training is verified by the Office of the IRB at the time of initial application and continuing review. 

    Other Training & Requirements

    Sponsors and/or funders may require investigators and study staff complete additional training.

  • Emergency/Disaster Preparedness Considerations for Investigators Conducting Human Research

    Investigators conducting human research should be aware of the following additional considerations associated with managing human research during an emergency/disaster scenario (e.g., extreme weather events, natural disasters, man-made disasters, infectious disease pandemics, etc.) related to investigators’ ongoing interactions with research subjects and the Institutional Review Board (IRB) in such cases.

    During Emergency/Disaster Scenarios: Deciding Whether a Study-Specific Risk Mitigation Plan for Ongoing Research Is Needed

    In general, investigators should develop a study-specific emergency/disaster risk mitigation plan for their research unless one of the following is true:

    • Research does not involve in-person interaction with research subjects.
    • Research can be conducted as written while adhering to additional institution-level and HRPP-level guidance and requirements regarding the emergency/disaster event.
    • The research is externally sponsored, and the sponsor has developed a protocol-specific risk mitigation plan for the research.
    • The research has been voluntarily placed on hold for recruitment and all research procedures (except for necessary follow-up procedures to be done consistently with additional institution-level and HRPP-level guidance and requirements regarding the emergency/disaster event).

    For guidance on developing study-specific risk mitigation plans contact the IRB Office.

    Voluntary Holds on Human Research Activities

    Investigators may voluntarily elect to place all recruitment, enrollment, and research procedures on temporary hold during emergency/disaster scenarios if doing so will better ensure the safety of research subjects and would not create any additional risks to the safety and welfare of research subjects. Such voluntary holds on research activity do not require IRB notification or review.

    Submitting Study-Specific Emergency/Disaster Risk Mitigation Plans for IRB Review

    If immediate modification of the research is necessary to eliminate an apparent immediate hazard to a subject, take action and notify the IRB within seven business days following the standard pathway to submit reportable new information.

    For all other study modifications made to ensure the ongoing safety of research subjects during emergency/disaster scenarios, submit a study modification and all relevant new or modified study materials to the IRB.

  • Reporting Financial Interests to the IRB

    To minimize the actual or potential conflicts of interest in human research, the IRB requires that all individuals involved in the design, conduct, or reporting of the research disclose financial interests related to non-exempt research. Of note, in addition to principal investigators and co-investigators, individuals involved in the design, conduct, or reporting of the research may include study coordinators, research nurses, and data coordinators.

    Investigators must report any change(s) to this disclosure via a Modification form in iMedRIS within 30 business days of discovering or acquiring (e.g., through purchase, marriage, inheritance, filing a patent application, etc.) a new financial interest.

  • Conducting Research with Non-WMed Collaborators

    All WMed investigators engaged in human research must secure IRB review. This applies when the human research is conducted at WMed, another institution, in another country, and/or in collaboration with non-WMed affiliates. Non-WMed collaborators are expected to inquire with their home/affiliate institution to determine whether local IRB review and oversight is required.  If desired, their home/affiliate institution may consider entering into a reliance agreement with WMed. Ceding review allows one institution to serve as the Reviewing Institution/IRB while the others serve as the Relying Institution/IRB. A request to Cede Review to an External IRB or to request that WMed IRB act as the IRB of record for that institution or that researcher's activities can be done in the iMedRIS IRB Submission Application.

    Where non-WMed collaborators do not have a home/affiliate institution, e.g., community member or independent contractor, it may be appropriate to add them to the WMed IRB-approved study as Individual Investigators. Contact the Office of the IRB for assistance with executing an Individual Investigator Agreement.  Such collaborators will be required to complete human subjects research training and should request access to iMedRIS as an individual investigator.

  • Cede Review (Designating an External IRB)

    Reliance agreement, IRB Authorization Agreement (IAA), cede review, cede, or External IRB are all terms that refer to a situation where research is conducted at two (or more) institutions and one is designated to serve as the Reviewing Institution/IRB (“single IRB” or “sIRB”) while the others serve as the Relying Institution/IRB (“participating sites”).

    Non-exempt human research is eligible for such an Agreement, i.e., protocols reviewed on an expedited basis or by the convened IRB.  To review the criteria for when WMed may rely on another institution for IRB review, refer to HRPP and IRB Policy Handbook. Activities that do not constitute human subjects research or are determined to be exempt are ineligible for reliance agreement/cede review; the WMed IRB requires in-house review of those projects.

    To request that WMed rely on another institution, submit an external IRB request complete the initial application form in iMedRIS under “Site Information”.

    To request that WMed IRB serve as the IRB of record, submit the request by completing the initial application form in iMedRIS under “Site Information”.

  • Preparing the Research Protocol and IRB Application

    Assistance with Research Development

    To start the protocol development process, please complete the Project Request & Triage Form. The form asks basic questions about what your project will entail including a summary of the project, where the data will be collected and if you would like guidance with project development. Submission of the form prompts an alert to WMed's research support services: the Research Process Coordinator, Data Manager, Biostatisticians, Health Information Management and IRB staff. The Research Process Coordinator will contact you to confirm your project needs and to request dates and times you (and your team) are available for a brainstorming meeting. If you have a protocol draft available, it can be uploaded on the Project Request & Triage Form.

    Investigators can seek information to aid in the design and/or feasibility of their project. Feasibility data can be requested using the VDW Data Request Form or by emailing datawarehouse@wmed.edu. In order to comply with the laws governing preparatory research activity HIPAA Privacy Rule 45 CFR 164.512(i)(1)(ii) investigators must attest to the following: 

    • The use or disclosure is sought solely to review PHI as necessary to prepare the research protocol or similar preparatory purposes. 
    • No PHI is removed from the covered entity during the review. 
    • The PHI the researcher seeks to use, or access, is the minimum necessary to prepare a research protocol or grant application. 

    General Requirements

    A Research Protocol is required for any human research application (this includes applications for an exempt determination).  A Research Protocol is not required when requesting a Not Human Subjects Research Determination however some type of plan or summary should be submitted with the application.

    Here are some key points to remember when developing your Research Protocol:

    • There are several protocol templates provided on the WMed website to assist with development. They are organized by your intended study design. They serve as guidance when developing a protocol for submission to the IRB. Please delete all example language prior to submission.
    • The Research Navigator is also available to assist you with protocol development at 269-337-6471.
    • Certain sections of the templates may not be applicable to your project. Please mark inapplicable sections with “N/A”.
    • In some instances a project may appear to be human subject research when it does not meet the regulatory definitions of human subject research. More information can be found under IRB Determinations and Modes of Review. If you believe your activity may not be human research, read the information in this section. If you need a formal determination from the IRB that your project is not human research, create and submit a new project in iMedRIS.
    • You may not include any individuals of the following populations as subjects in your research unless you indicate in your application the populations will be included.
      • Adults who lack the capacity to provide legally effective consent
      • Individuals who are not yet adults (infants, children, teenagers)
      • Pregnant women
      • Prisoners
    • If you are conducting community-based participatory research, you may contact the IRB for information about:
      • Research studies using a community-based participatory research design
      • Use of community advisory boards
      • Use of participant advocates
      • Partnerships with community-based Institutions

    IRB Application

    The IRB application corresponds with the general flow of information provided in the protocol. You may reference your protocol on the application form in response to the various questions. Keep in mind in outlining your plan, the protocol and the application should be consistent. As you complete the IRB application you will automatically be guided to the appropriate sections needed to complete your submission.

    The purpose of the application is to provide IRB members and designated reviewers with sufficient information to conduct a substantive review. If you have any questions about completing the application, please call the IRB office at 269-337-4345.

    Any members of the research team who will be obtaining informed consent from research participants, interacting with research participants to collect data, and/or analyzing identifiable data must have completed Human Subjects Protection Training. 

    Management of Data

    Research involves increasingly complex arrangements for the storage and transmission of research data. Robust data privacy and security planning is necessary to protect the privacy of research subjects and to secure sensitive, personally identifiable information. 

    When crafting a data management plan, consider:

    • Any contracts or agreements that may be needed
    • Documentation
    • Storage and back-up
    • Sharing and re-use
    • Retention and disposal

    Some data require special management considerations. For example, Protected Health Information (PHI) is subject to several restrictions. During protocol development consider:

    • How any data sharing will be tracked or documented
    • Where the data will be stored (In the cloud? Accessed from a secure server?)
    • How the data will be stored and protected (On a secure, password protected, server behind a firewall (e.g., on a G: drive, not a C: drive)? How protected? Password or encryption? How many people get the password? Who may access?)
    • If using a mobile computing device (laptop, PDA, iPod) or removable media (flash drive, CD/DVD) for any part of your study, determine how the data containing PHI will be stored.
    • Estimated size of datasets that will be collected and produced, and whether the amount and/or formats of data will change over time; The IT departments may need to be informed of anticipated large data sets in order to support back-up.

    If your research involves sharing data or electronic data transfers from any of our community partners (i.e., Ascension Borgess, Bronson, Grace Health, etc.), the Virtual Data Warehouse (VDW) is responsible for data management for all electronic health record (EHR) data for quality improvement and research projects. Requests for data projects will now begin by using the Project Request and Triage Form and will be followed by a consultation with the VDW Data Manager. If you have a project that will be impacted by this change, please email datawarehouse@wmed.edu to ensure there is a secure way to transfer.

    The VDW data manager will help you consider what data should be retained. They will also assist in planning or establishing processes for archiving data, including aiding in the selection of formats and media. Familiarize yourself with publication requirements and institutional guidelines for data retention.  

    Identifiable data should be held for the minimum amount of time necessary to conduct the research (and meet any access requirements). For example, data that is collected in a corporate-sponsored clinical trial might have contractual obligations regarding how long the data must be retained. Data collected in federal or state-funded projects or when using large health care data sets, may require public access to data and therefore may have specific requirements regarding retention, disposal and archiving. It is essential to understand such requirements and proactively plan so that, at the end of a project, data is properly retained, disposed of, shared, or securely archived.

  • Consent Considerations

    Creating a Consent Script for Exempt Human Research

    Exempt Human research does not usually require a long-form, signed consent form. However, the ethical principles outlined in The Belmont Report, namely, respect for persons, emphasizes the importance of ensuring that participants are fully informed. Therefore, a consent process is required when exempt Human research involves an interaction with human subjects.  At a minimum, this process must disclose the following:

    • That the activities involve research;
    • The procedures to be performed;
    • That participation is voluntary;
    • The name and contact information for the investigator.

    The IRB strongly recommends that investigators use “TEMPLATE: Exempt Human research Consent Script” to create a consent script for Exempt Human research.  You’ll be prompted to upload the script to the Consent Forms page in iMedRIS.

    Creating Consent Forms for Non-Exempt Research

    Consent documents must contain all of the required and, as appropriate, additional elements of informed consent. No informed consent (oral or written) should include exculpatory language whereby the participant or their representative is made to waive or appear to waive any of the participant’s legal rights, or releases or appears to release the Investigator, the sponsor, the Institution or its agents from liability for negligence.

    The IRB strongly recommends that investigators use WMed template consent documents. These templates are located on the HRPP/IRB website under Forms and Templates.

    Obtaining HIPAA Authorization

    Combine HIPAA authorization with the consent document, if applicable, using “TEMPLATE: Consent Template”. Use the signature block(s) approved by the IRB when obtaining combined informed consent and HIPAA authorization. Ensure that all items in the signature block are complete, including dates and applicable checkboxes, e.g. future use; specimen storage, etc.

    The following are customary requirements to document HIPAA authorization:

    Required Elements:

    • The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
    • A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.
    • The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.
    • A description of each purpose of the requested use or disclosure.
    • An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. (The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository.)
    • Signature of the individual and date.
    • The individual's right to revoke the authorization in writing.
    • The authorization either:
      • Describes the exceptions to the right to revoke the authorization.
      • References the Notice for Privacy Practices for Protected Health Information which describes the exceptions to the right to revoke the authorization.
    • The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either of the following:
      • The covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization.
      • The consequences to the individual of a refusal to sign the authorization when the covered entity can condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization.
      • The potential for information disclosed pursuant to the authorization to be subject to re-disclosure by the recipient and no longer be protected by this authorization.
  • HIPAA Privacy Protections

    Permitted Access/Disclosure

    No need for patient HIPAA authorization if accessing or disclosing records for:

    • Treatment: any activity related to patient care
    • Payment: activities to pay or get paid for healthcare services
    • Operations: day to day core activities (audits, quality improvement projects)

    Access/Disclosure for Research

    Releasing information for research purposes requires authorization from research subjects. Reference “Checklist: Elements of HIPAA Authorization”.

    In certain circumstances, the Privacy Rule permits Covered Entities to use and disclose Research PHI without patient authorization as follows:

    • If the IRB has granted a waiver or an alteration of the authorization.
      • Reference “Checklist: Waiver of HIPAA Authorization” for criteria.
      • If the IRB approves a waiver, the receipt of the requisite documentation of the approval/determination letter permits a covered entity to use or disclose PHI in connection with a particular research project without Authorization.
    • If the Covered Entity has entered into Data Use Agreement for sharing a limited data set
    • Activities are preparatory to research
    • Research on decedents’ information

    Data Use Agreements

    The purpose of a Data Use Agreement (DUA):

    • Sets out the permitted uses and disclosures of the Protected Health Information (PHI) in the “limited data set”.
      • A “limited data set” is a limited set of identifiable patient information as defined in the Privacy Regulations issued under the Health Insurance Portability and Accountability Act, better known as “HIPAA”. A “limited data set” of information may be disclosed to an outside party without a patient’s authorization if certain conditions are met.

        A “limited data set” is information from which “facial” identifiers have been removed. Specifically, as it relates to the individual or his or her relatives, employers or household members, all the following identifiers must be removed in order for health information to be a “limited data set”:
         
      • names;
      • street addresses (other than town, city, state and zip code);
      • telephone numbers;
      • fax numbers;
      • e-mail addresses;
      • Social Security numbers;
      • medical records numbers;
      • health plan beneficiary numbers;
      • account numbers;
      • certificate license numbers;
      • vehicle identifiers and serial numbers, including license plates;
      • device identifiers and serial numbers;
      • URLs;
      • IP address numbers;
      • biometric identifiers (including finger and voice prints); and
      • full face photos (or comparable images).


    The health information that may remain in the information disclosed includes:

    • dates such as admission, discharge, service, DOB, DOD;
    • city, state, five digit or more zip code; and
    • ages in years, months or days or hours.
    • Identifies who is permitted to use or disclose the information
    • Provides that the recipient will
      • Properly safeguard the data
      • Not use the information in a manner inconsistent with the DUA
      • Report any improper uses or disclosures to the covered entity
      • Not use the information to attempt to identify or contact individuals based on the information in the “limited data set”
      • Require all agents and subcontractors to comply with the terms of the DUA


    If you have a project you would like to share a limited data set, please contact the WMed Sponsored Programs office at 269-337-4268.

  • Questions

    This document and the HRPP and IRB Policy Manual for the WMed Human Research Protection Program are available on the WMed HRPP website.

    If an investigator or member of the research team has any questions or concerns about the Human Research Protection Program, contact:

    Maureen Owens, MM, CIP
    Director, Human Research Protection Program
    Upjohn Campus, Fourth Floor
    Office Phone: 269-337-4269
    Maureen.owens@wmed.edu

    If you have questions, concerns, complaints, allegations of undue influence, allegations or findings of non-compliance, or input regarding the Human Research Protection Program that cannot be addressed by contacting the Director, follow the Research Compliance Violation Reporting procedures.

  • Appendix A: Principal Investigator Responsibilities and Assurance Statement

    Principal Investigator Responsibilities and Assurance Statement in iMedRIS

    1. I will ensure that there are adequate resources to carry out the research safely, e.g. sufficient investigator time, equipment and spacing.
    2. I will ensure that Research Staff are qualified (e.g., including but not limited to appropriate training, education, expertise, credentials, protocol requirements and, when relevant, privileges) to perform procedures and duties assigned to them during the study.
    3. I will update the IRB office with any changes to the list of study personnel.
    4. I will personally conduct or supervise the Human research.
      • Conduct the Human research in accordance with the relevant current protocol as approved by the IRB.
      • When required by the IRB ensure that consent or permission is obtained in accordance with the relevant current protocol as approved by the IRB.
      • Not modify the Human research without prior IRB review and approval unless necessary to eliminate apparent immediate hazards to participants.
      • Protect the rights, safety and welfare of participants involved in the research.
    5. I will submit to the IRB in a timely manner:
    6. Proposed modifications to the previously approved Human research.
    7. A continuing review application (to avoid a lapse in approval) when required.
    8. A notice of closure when the Human research is completed.
    9. I will submit to the IRB any reportable new information within seven business days.
    10. I will comply with applicable federal and state regulations, ethical guidelines, and WMed Institutional policies.
  • Appendix B: Principal Investigator Responsibilities When Relying on an External IRB
    1. Obtain appropriate approvals from your institution prior to seeking review by another IRB.
    2. Comply with determinations and requirements of the reviewing IRB.
    3. Provide the reviewing IRB with requested information about local requirements or local research context issues relevant to the IRB’s determination prior to IRB review.
    4. Cooperating in the reviewing IRB’s responsibility for initial and continuing review, record keeping and reporting and providing all information requested by the reviewing IRB in a timely manner.
    5. Disclosing conflicts of interest and complying with management plans, if applicable.
    6. Promptly reporting to the reviewing IRB any proposed changes to the research and not implementing those changes to the research without prior IRB review and approval, except where necessary to eliminate apparent immediate hazards to the participants.
    7. When enrolling participants, obtain, document and maintain records of consent for each participant or each participant’s legally authorized representative when applicable.
    8. Promptly reporting to the reviewing IRB any unanticipated problems involving risks to participants or others according to the requirements specified in the reliance agreement.
    9. Proving the reviewing IRB with data safety monitoring reports in accordance with the reviewing IRB’s reporting policy.
    10. Reporting non-compliance, participant complaints, protocol deviations or other events according to the requirements specified in the reliance agreement.
  • Appendix C: Prompt Reporting Requirements

    Investigators must report Unanticipated Problems (UAP’s) to the IRB as soon as possible but within seven (7) business days after the investigator first learns of the event using the New Information Reporting Form in iMedRIS.

    If investigators are uncertain but believe that the event might represent an UAP, a report should be submitted. Examples of UAPs include:

    • A single occurrence of a serious, unexpected event that is uncommon and strongly associated with drug exposure.
    • A single occurrence, or more often a small number of occurrences, of a serious, unexpected event that is not commonly associated with drug exposure, but uncommon in the study population.
    • Multiple occurrences of an Adverse Event (AE) that, based on an aggregate analysis, is determined to be an unanticipated problem. There should be a determination that the series of AEs represents a signal that the AEs were not just isolated occurrences and involve risk to human subjects (e.g., a comparison of rates across treatment groups reveals higher rate in the drug treatment arm versus a control). A summary and analyses supporting the determination should accompany the report.
    • An AE that is described or addressed in the investigator’s brochure, protocol, or informed consent documents, but occurs at a specificity or severity that is inconsistent with prior observations. For example, if transaminase elevation is listed in the investigator’s brochure and hepatic necrosis is observed in study subjects, hepatic necrosis would be considered an unanticipated problem involving risk to human subjects. A discussion of the divergence from the expected specificity or severity should accompany the report
    • A serious AE that is described or addressed in the investigator’s brochure, protocol, or informed consent documents, but for which the rate of occurrence in the study represents a clinically significant increase in the expected rate of occurrence (ordinarily, reporting would only be triggered if there were a credible baseline rate for comparison). A discussion of the divergence from the expected rate should accompany the report.
    • AEs involving direct harm to subjects enrolled by the local investigator which in the opinion of the investigator or sponsor, may represent an UAP;
    • IND Safety Reports from sponsors that meet the criteria for an UAP. Such reports must be accompanied by an analysis from the sponsor explaining why the report represents an UAP and whether it has been reported to the FDA as such.
    • Unanticipated adverse device effects (UADEs).
    • Any other AE or safety finding (e.g., based on animal or epidemiologic data) that indicates subjects or others might be at risk of serious, unanticipated harms that are reasonably related to the research. These would cause the sponsor to modify the investigator’s brochure, study protocol, or informed consent documents, or would prompt other action by the IRB to ensure the protection of human subjects.  An explanation of the conclusion should accompany the report.  
    • Reports (including reports from DSMBs/DMCs) that indicate that risks are greater than previously known or that indicate that the research should be modified, suspended, or halted.  
    • Sponsor or lead investigator/coordinating center-imposed suspension or termination of some or all research activities.
    • An unanticipated event related to the research that exposes subjects to potential risk but that does not involve direct harm to subjects.
    • A breach of confidentiality or loss of research data (eg, a laptop or thumb drive is lost or stolen).
    • An unanticipated event related to the research that results in actual harm or exposes individuals other than the research subjects (eg, investigators, research assistants, students, the public, etc.) to potential risk.
    • New information that indicates increased risk, new risk(s), or decrease to potential benefit from what was previously understood.  Examples include:
      • An interim analysis or safety monitoring report indicates that the frequency or magnitude of harms or benefits may be different than initially presented to the IRB.
      • A report or publication that indicates the risks, benefits, or merit of the research are different from what was previously understood.

    Other reportable information:

    • Changes made to the research without prior IRB approval to eliminate apparent immediate hazards to the subject(s).
    • Protocol Deviations - any variation from the IRB approved research plan that happens without prior review and approval of the IRB and isn’t necessary to eliminate apparent immediate hazards to the subject(s).
    • Monitoring, audit, and inspection reports in accordance with Section 2, Audits and Inspections by Regulatory Agencies and Sponsors, of this manual.
    • Sponsor or coordinating center reports.
    • Data Safety Monitoring reports, including reports from DSMBs, DMCs, and others.
    • Enrollment or inclusion of vulnerable populations not previously approved by the IRB for the study (eg, prisoner, pregnant woman, neonate, child, adult with impaired decision-making capacity).
    • When an existing subject becomes a member of a vulnerable population not previously approved by the IRB for inclusion in the study (eg, incarceration, pregnancy, or change in decision-making capacity of an already enrolled subject).
    • Holds, suspensions, or terminations of a study, in part or in full, by an investigator, sponsor, or others.
    • Changes that impact the ability of the PI to conduct or supervise the study, temporarily or permanently.
    • Changes that impact the qualifications of investigators or research staff members such as actions taken by regulatory authorities, licensing boards, or credentialing committees.
    • New information that may impact the rights, welfare, or willingness of subjects to continue in the research.