When an IRB reviews studies regarding data usage, risk is the primary consideration. When discussing exempt category reviews, issues surrounding the use of the DATA are key. The first issue often considered is what data are being used? What are the particulars of these data? Have the individuals consented to the use of their data?
Below are examples of a few data sets and the probable review types that an IRB might employ.
Data set 1:
These data are existing, stripped of all “direct” identifiers and there is absolutely no way to link them back together. Starting in July 2018—the use of these data is not subject to regulation under the Common Rule. A Human Subjects determination would be the applicable review type here. Because the use of these data is not subject to regulation under the Common Rule, consent is not an issue.
“Direct” identifiers are those identifiers excluded in the creation of Limited Data Sets under HIPAA. Specifically, “direct” identifiers are the following identifiers about the individual or about relatives, employers, or household members of the individual: “(i) Names; (ii) Postal address information (other than town or city, State, and 5-digit zip code); (iii) Telephone numbers; (iv) Fax numbers; (v) Electronic mail addresses; (vi) Social security numbers; (vii) Medical record numbers; (viii) Health plan beneficiary numbers; (ix) Account numbers; (x) Certificate/license numbers; (xi) Vehicle identifiers and serial numbers, including license plate numbers; (xii) Device identifiers and serial numbers; (xiii) Web Universal Resource Locators (URLs); (xiv) Internet Protocol (IP) address numbers; (xv) Biometric identifiers, including finger and voice prints; and (xvi) Full face photographic images and any comparable images.” 45 C.F.R. § 164.514(e)(2).
Data set 2:
This data set involves the study of existing data or specimens if they are publicly available or recorded such that subjects cannot be readily identified. These data are existing but identification may be possible – if even remotely. While consent is not required for the use of these data, the IRB must determine that the data are used ethically. (i.e., confidentiality is protected, the nature of the data will not harm the individuals if identifiers are linked back to the data and released, the data do not belong to a vulnerable population (like prisoners), etc.
To use these data, these studies may qualify for a review under Exemption category 4.
“Data set” 3:
These data do not exist at the time of the IRB submission. Exemption category 7 covers the storage of identifiable information or biospecimens for secondary research use (i.e., the creation of a bank) collected after broad consent was obtained. Limited IRB review of a consent form compliant with §46.116 is required before collection may begin. The IRB will review the consent form where subjects consent to their data or specimens being banked for future use.
Data set 4:
Exemption category 8 covers the secondary research use of identifiable information or biospecimens collected under databases established via Exemption category 7. Broad consent and limited IRB review are required prior to study start. That is, the consent that was utilized for the creation under Exemption category 7 must be submitted and the IRB must confirm that the ICF is in line with the study being proposed. The investigator must show that they have procedures ensuring they can identify the types of research that may be conducted with the data/biospecimens, record and track who has agreed to or refused consent, and to track the terms of consent to determine whether proposed future secondary research use falls within the scope of the types of research identified in the ICF.