|
THE COMMITTEE ON HUMAN RESEARCH
UCSF GUIDANCE ON RESEARCH TOPICS AND ISSUES
MEDICAL RECORDS REVIEW (revised
May 28, 2004; December 2004)
Brief Overview
In the hands of innovative researchers, the wealth of health-related
data residing in medical records holds tremendous promise for informing
and directing leading-edge research. This guidance aims to support
investigators in legally accessing and using this valuable information
by clarifying
the University’s requirements for the research use of medical records
data.
The procedures incorporated into the UCSF policy ensure compliance
with the following regulations:
| • | Title 45 Code of Federal Regulations Part 46: Protection of Human
Subjects, and |
| • | The Health Insurance Portability Act of 1996 (HIPAA) |
Because the
human subject definition [45 CFR 46.102(f)] extends
to a subject’s identifiable private information,
research
[45 CFR 46.102(d)] proposing to use data from medical records, obtained directly
or indirectly, must be approved by the Committee on Human Research (CHR),
the institutional
review board (IRB) at UCSF.
IRB oversight ensures that proposed research methods are designed
to minimize risk to subjects by protecting against the loss of
privacy and confidentiality. The type of protected health information
(PHI)
to be accessed or used in the study determines the level of oversight
and the type of CHR application
required.
The policies described in these guidelines apply to all medical
records, both paper and electronic, that contain PHI: charts, office
records
including shadow charts and study reports, as well as various media
such as radiographic
images and films.
CHR approval is required only for medical records review for research
studies, not for clinical activities conducted for health care
operations. Examples for each are shown below.
| Examples: When medical records are used for research,
CHR prior review and approval are required. The following activities
are considered research: |
• | Collection of clinical data associated with human specimens
to be used in research, |
• | Collection of data for research projects, including outcomes
data, |
• | Identification of potential subjects for recruitment into a
clinical research study, |
• | Collection of data for pilot or feasibility studies, |
• | Analysis by principal investigator (PI) of his or her own patient
records for research purposes. |
| Examples: When medical records are used for healthcare
operations, CHR review is not required. Medical records use
for treatment, payment, and operations (TPO) is not research.
Activities may include the review of medical records for: |
• |
Individual patient treatment |
• |
In-house use of medical records (Grand Rounds Presentations) |
• |
Program evaluation (Quality Control/Quality Improvement activities,
if not for publication) |
Medical Records Review: No Subject Contact
For research using data from medical records, and obtained without
having contact with subjects, the CHR approval process depends on
the level of risk to subjects’ privacy posed by the type and
extent of PHI associated with the dataset.
| • | Exempt Certification (#4): Research may qualify for exempt
certification if, and only if, all of the following apply: |
| | • |
Data do not include patient
identifiers, and |
| | • |
Data are not coded, or linked to medical records, and |
| | • |
Individuals cannot be identified by the data. |
| | • |
Personal identifiers are securely protected by the data repository
or data source using methods, such as a firewall, to ensure researchers
cannot access data. |
| Example #1 for Exempt Certification: Provided
no PHI is associated with the data, an investigator can apply
to receive health-related data from departments within UCSF
such as the Health Information Management System (HIMS) or
the Cancer
Registry with a CHR-approved Exempt
Certification (#4). |
| Example #2 for Exempt Certification: A CHR-approved
Exempt
Certification (#4) is needed by UCSF researchers who receive
aggregate data sets for analysis from national programs and
registries such as SEER (Surveillance, Epidemiology and End
Results), NHANES (the National Health and Nutrition Examination
Survey) and other CDC (Center for Disease Control) programs. |
| |
Expedited Review: No Subject Contact: Retrospective
research that involves reviewing existing medical records
may qualify for Expedited Review (category 5). Apply to the
CHR using: |
| | • |
The specialized form Expedited
Review: No Subject Contact Application, and |
| | • |
The supplemental form Waiver
of Consent/Authorization that
is needed to gain access to medical records. |
Because researchers will have access to PHI during the review of medical records, the application must include:
| • | Details of the study design; |
| • | Clear explanation of the research methods that will guard against disclosure of private information; and |
| • | Justification for waiving consent and HIPAA authorization. |
| Example for Expedited Review: No Subject Contact: A researcher
is interested in gathering data on the use of a particular
antibiotic by reviewing medical records from the year 1990
through year 2003. The research qualifies as Expedited Review
Category #5 and access to the specified records is granted
with a CHR-approved Waiver
of Consent/Authorization. |
| |
Full Committee Review: In very
rare cases
Full
Committee Review may be required for medical records review
even if there is no contact with subjects. Under federal regulation
(45
CFR 46.110) expedited review cannot be used for studies
that pose greater than minimal risk to subjects. |
| |
• |
Full committee review is required for medical record
studies where identification of the subjects and/or their responses
would reasonably place them at risk for criminal or civil liability
or be damaging to their financial standing, employability,
insurability, reputation, or be stigmatizing. |
| |
• |
If reasonable and appropriate protections can be
implemented so that the privacy and confidentiality risks are
minimized to no greater than minimal, then the CHR may review
the study at the expedited level. |
Medical Records Review Involving Subject Contact
The CHR has specific requirements for the following research activities – recruitment,
screening, and ongoing review – which involve accessing medical
records and subject contact.
| • |
Recruitment – Involves reviewing existing medical records to identify potential study subjects who may
be contacted and asked to participate in a research study. |
| |
• |
The CHR has specific guidelines for contacting subjects
for recruitment purposes after medical records are reviewed. |
| |
|
• |
Contact letters must state that the
person was identified as a result of reviewing medical records.
The letter must also specify how the investigator had access
to the records. The only acceptable means are:
- With a consent form previously signed by the person allowing contact
for future research;
- Through the investigator’s position as a staff member at the clinic where the person receives care; or,
- With a waiver of informed consent/authorization approved by the University’s institutional review board.
|
| |
|
• |
Phone calls, without a prior letter informing
subjects of a phone call and a way to opt out of receiving
such a call, are strongly discouraged |
| |
|
• |
More details on acceptable
recruitment methods are provided by the CHR. |
| • |
Screening – Involves reviewing medical records to determine eligibility of subjects based on inclusion/exclusion criteria specified in the study protocol. |
| |
• |
Medical records may already exist or may
be created prospectively as part of the study. |
| |
• |
Because subject contact occurs before medical
records are reviewed, the consent should include a statement
informing subjects that medical records review is a procedure
used during the study. See Informed Consent Requirements for
details. |
| • |
Ongoing Review – Involves
reviewing medical records throughout the study in order to
meet requirements specified in the protocol. |
| |
• |
The consent should include a statement
informing subjects that medical records review is a procedure
used during the study. See Informed Consent Requirements for
details |
The type of CHR application is based on the level
of risk posed by the study. The table below, and the previous flowchart,
show the type of application to use for each risk category.
Summary Table: CHR Applications: Medical Records
Review and Subject Contact
| Example for Expedited Review - Medical Records
Review and Subject Contact: A researcher wants to gather
data on her own patients who have been diagnosed with
oral cancer. In most cases, the information can be
retrieved from existing medical records with a waiver
of consent/authorization. However, in some cases the
medical record does not contain all of the information
needed and the investigator proposes to contact patients
by letter to obtain the missing data. |
| Example for Full Committee Review - Medical
Records Review and Subject Contact: A researcher is interested
in reviewing medical records to identify and possibly
recruit potentially eligible subjects for a diabetes
treatment study. In order to gain access to existing
medical records, a Waiver
of Consent/Authorization is submitted with the Full
Committee Application form.
The prospective review of medical records will require
informed consent and HIPAA authorization signed by
subjects. The consent form should include a statement
disclosing that medical records review is part of
the study procedures. |
Consent and Authorization Requirements
| • |
Informed
Consent Requirements: Research
involving subject contact requires informed consent
and materials to be submitted as part of the application
process, whether expedited or full committee review
is required for your study. |
| |
• |
If medical records are reviewed as part
of a study for which written consent is obtained,
the consent form should include the following information,
if applicable, in the “Procedures” section: |
| | |
• |
A statement regarding the purpose of the
medical records review (i.e. for screening, for ongoing
review, or to meet follow-up requirements). |
| | |
• |
A statement informing subjects their medical
records will be reviewed by others besides UCSF researchers
(i.e., sponsor or FDA). |
| |
• |
The CHR website contains detailed information
regarding informed
consent requirements and access to consent form templates. |
| • |
HIPAA Requirements:
In addition to obtaining informed consent to participate in
a research study, HIPAA
authorization, or an approved waiver, is also required. |
| |
• |
HIPAA Authorization: Researchers wishing to access
medical records must obtain a UC
Permission to Use Personal Health Information for Research signed by the subject. |
| IMPORTANT NOTE: The CHR Approval Letter will
indicate the approved mechanism allowing access to medical
records: |
| |
• |
A CHR-approved Waiver of Consent/Authorization, or |
| |
• |
Informed consent and HIPAA authorization signed by
the subject. |
Common Situations
| • |
Physicians review the medical records of their
own patients for research purposes: |
| |
• |
CHR approval is always required for research involving
review of medical records, even if the records are a physician’s
own patients. The need for Expedited or Full Committee Review
will be determined by the level of risk the study poses to
subjects. See the medical records review flowchart to
determine the type of CHR application to use. |
| |
• |
The CHR-approved study must be kept active by submitting
annual renewals until all data analysis is complete, even if
the research no longer needs access to the medical records
or all subject follow up is completed. |
| |
• |
A subjects’ authorization is not required when
physicians screen their own patient’s records for recruitment
purposes. However, if the records will come from a clinic that
does not have a CHR-approved recruitment protocol or records
other than a physician’s own patients will be screened,
submit a Waiver
of Consent/Authorization with the CHR application. |
| • |
Medical professionals and students accessing
medical records for research: |
| |
• |
When review is conducted as part of a Principal
Investigator’s project: |
| |
|
• |
The PI must obtain CHR approval before students
or other members of the research team can review medical records
for research. |
| |
|
• |
CHR approval must be kept active until all
data analysis is complete, even if access to the medical records
is no longer required, or if subject follow up is completed. |
| |
• |
When research review will not be part of
a Principal Investigator’s project: |
| | |
• |
Students other medical professionals who do not
qualify
for PI status, must find a PI who will sponsor their
research. |
| | |
• |
The PI-sponsor must obtain CHR approval before
the study begins. |
| • |
Accessing HIMS or STOR medical records at
UCSF: |
| |
• |
Health
Information Management Systems (HIMS)
controls access to the UCSF medical records as well as to the
Summary
Time Oriented Record (STOR) system, which is the clinical
information system at UCSF. Investigators will need to show
their CHR approval letter to HIMS in order to access health-related
data for research. |
| • |
Recruiting subjects from the Division of General
Internal Medicine (DGIM): |
| |
• |
Access to STOR to identify and to contact
potential study subjects from DGIM will need DGIM approval
prior to subject contact. |
| |
• |
The investigator’s request will
be reviewed to ensure that there are no additional burdens
to the DGIM faculty or clinical staff or the patients they
serve. |
| |
• |
After DGIM approval, the clinical study
will be posted on their Active Studies Website. |
| |
• |
Visit the DGIM
website for further details. |
Review of Medical Records of the Deceased
The health information of deceased individuals is protected
under federal and state regulations. Review by The Committee
on Human Research (CHR) is determined by the level of
protected health information (PHI) associated with the
data.
| • |
Records With No PHI: If the decedent
study will not have direct access to PHI, CHR review and
approval is not required because the deceased individuals
cannot be identified. |
| Example: Researchers receive only de-identified data from
medical records and data will be abstracted or de-identified.
In this case, although the information comes from the medical
record, the research team does not have access to the PHI in
the medical record. Therefore, no CHR review or approval is
required. |
| • |
Records With PHI: Decedent research that will
have direct access to medical records or PHI, even if identifiers
will not be recorded, must be submitted for CHR review and
approval. |
| Example: Researchers plan to review medical records of deceased
individuals to verify biological specimen data. Even if PHI
will not be recorded, the investigators will need to submit
either the expedited or full committee application for CHR
review and approval. |
| IMPORTANT NOTE: Research on
living individuals, identifiable or not, must be approved or
certified by the CHR. |
Summary Table of CHR Applications for Decedent Research:
Access to or Use of Medical Records
|
Use of PHI from State, County, Local Death Data Files
|
|
CHR ReviewAnd Application Type
|
HIPAA Authorization Requirements
|
| No |
No |
|
None |
None |
| No |
Yes |
|
Expedited |
CHR Waiver of Authorization |
| Yes |
Either Yes of No |
|
Expedited |
CHR Waiver of Authorization |
|
