We’ve noticed a few things in new submissions regarding data and sample handling and storage that slow down approvals. Here are some reminders of things to keep in mind when drafting protocols and CLARA completing new submission forms:
- UAMS Administrative Guide Policy 3.2.01 requires research data, reports, and analyses to be kept for “7 years after final reporting or publication of a project, or longer if required by a sponsor or regulation.” We’ve seen submissions that indicate the study team plans to destroy all the data immediately after publication. We understand the desire to try to minimize access to data by getting rid of it as soon as you think you won’t need it anymore, and we know that sometimes the 7-year retention period far exceeds the time the investigator will be at UAMS, e.g. students and fellows. But the policy does require retention for 7 years, and keeping it around allows you to address any questions that might come up later about your publications. Note also that nothing prevents you from removing all identifiers from your data after your study is completed.
- Make sure your submission is consistent throughout regarding data storage. Don’t tell us it is deidentified in one place, and then tell us it will be labeled with only date of birth and medical record number someplace else.
- Be very careful with the usage of words like “deidentified,” “coded,” and “anonymized.” They mean different things to different people. In general, if, after collecting your data, you are able to return to an individual’s medical record to collect more data about that person, or able to recontact or reidentify an individual based upon information in the material collected, your data are identifiable. If your study is subject to HIPAA, please note that HIPAA lists specific items that are considered identifiers, including a catchall “any other unique identifying number, characteristic, or code.” Dates in particular tend to trip people up, as any date related to the subject, e.g. diagnosis or procedure date, is considered an identifier. See UAMS Administrative Guide Policy 2.1.12 for the full list of HIPAA identifiers. And whether your study is subject to HIPAA or not, if your data are coded, and somewhere there exists a key linking the code to identifiers, you data are identifiable.
- If you are collecting data or samples to be sent to a central site, or to be stored in a repository either here or elsewhere, please let us know if great and gory detail if the material sent to the central site/repository will have any direct identifiers on them (rare, but it happens), or if they will be coded with the key to the code kept separately.
- Investigators have the option of keeping study data and samples from one project for use in future studies. For studies involving an informed consent process, the UAMS IRB has long required investigators who do this to inform their subjects about this planned future use, include an opt-in/opt-out provision in most cases (we’ve noticed some studies, typically industry-sponsored, saying that if you don’t agree to this future use you can’t be in our study, so that would be an exception), and indicate where and how long the material will be stored and whether it will be labeled with direct identifiers, a code with the key kept separately, or completely stripped of identifiers. Note that this UAMS IRB practice is a requirement under the Revised Common Rule, slated to take effect in January.