OHRP Regulatory Interpretations That You Need To Know But Have Never Been Told

Clinical Research Management Webinar Series:

OHRP Regulatory

Interpretations That You Need To Know

But Have Never Been Told

Wednesday, November 14, 2012

12:00 p.m. - 1:00 p.m. CT

2 © 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.

Madeleine Williams, MA, CIP Director, Huron Life Sciences

P 312. 479. 3374

[email protected]

Maddie has over 10 years of research experience and assists clients with

research biorepository design and development, institutional review board (IRB)

assessments and operational support, regulatory compliance evaluations, and

human research protection program evaluation and accreditation.

Frank Conte, MS Manager, Huron Life Sciences

P 312. 404. 6413

[email protected]

Frank has more than 10 years of project management experience in higher

education and research compliance. He focuses on assisting higher education and

healthcare organizations with operational analysis, regulatory compliance

evaluations, process improvement and software design and implementation.

About Our Speakers

mailto:[email protected]


3

In today’s session, we plan to discuss topics including:

• Exempt Determinations • Category 1

• Category 4

• Expedited Review • Category 8b

• Institutional Engagement

• Modifications to Previously Approved Research • Changes in Study Personnel

• Single Subject Exceptions

• Research Involving Prisoners as Subjects

• HIPAA

• Unanticipated Problems Involving Risks to Subjects or Others

• IRB Record Retention

© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.

Agenda

Exemptions Expedited

Review Engagement

Modifications to Approved

Research

Research Involving Prisoners

HIPAA Unanticipated

Problems Record

Retention

4

The information in this webinar is representative of Huron’s

experience and correspondence with OHRP and should not be

interpreted as official guidance. We encourage the audience to

contact OHRP for feedback on specific questions.

© 2012 Huron Consulting Group. All Rights Reserved. Proprietary & Confidential.

Disclaimer

Current Environment

Of

Human Research Protections

Human Subjects Protections Current Environment

• Lots of Regulations • 45 CFR 46 (Department of Health & Human Services)

• 21 CFR 50 and 56 (Food and Drug Administration)

• 45 CFR 164.512 (HIPAA)

• Interpretation of regulations can be confusing; guidance documents

are helpful .

• Best Practices • Association for the Accreditation of Human Research Protection Programs (AAHRPP)

• Huron HRPP Toolkit


Scenarios for Discussion

and

Interpretations

Exempt Determinations - Category 1

45 CFR 46.101 (b)(1) states:

• (b) Unless otherwise required by department or agency heads, research activities

in which the only involvement of human subjects will be in one or more of the

following categories are exempt from this policy:

(1) Research conducted in established or commonly accepted educational

settings, involving normal educational practices, such as

(i) research on regular and special education instructional strategies, or

(ii) research on the effectiveness of or the comparison among instructional

techniques, curricula, or classroom management methods.



Review Engagement


Research


HIPAA Unanticipated Problems

Record Retention


Scenarios:

A. Does “involving normal educational practices” to refer to:

(1) The procedures involved in the research are normal educational practices;

(2) The purpose of the research involves normal educational practices; or

(3) Both

B. Suppose a standard practice in a high school current events class is to have a

teacher-led group discussion about how current events affect US society by having

a discussion of how the news of the day has personally affected them and their

families. An investigator/teacher wants to conduct research by facilitating the class

discussion.

1. If the purpose of the research was to improve methods of classroom discussion,

would this be exempt under #1?

2. If the purpose of the research was to understand high school student responses to

current events, would this be exempt under #1?



Review Engagement


Research



Record Retention


Interpretations:

Scenario A - In order to qualify for exemption under §46.101 (b) (1), the study would

need to fit BOTH:

- The procedures involved in the research are normal educational practices

AND

- The purpose of the research involves normal educational practices

Scenario B

• #1 qualifies for exemption under §46.101 (b) (1), because the research is conducted in

an established or commonly accepted setting and the research involves a normal

educational practice

• #2 may be exempt but it would depend on why the investigator wants to understand high

school students’ responses to current events; if it is because the investigator is trying to

better understand the education of high school students, it could be considered exempt

under §46.101 (b) (1)



Review Engagement


Research



Record Retention

Email correspondence dated April 2010

45 CFR 46.101 (b)(4) states:

• Research involving the collection or study of existing data, documents,

records, pathological specimens, or diagnostic specimens, if these sources

are publicly available or if the information is recorded by the investigator

in such a manner that subjects cannot be identified, directly or through

identifiers linked to the subjects.




Review Engagement


Research



Record Retention

Scenario:

An investigator does the following:

1. Creates a data collection form-this is constructed such that the identity of the subject

cannot readily be ascertained by the investigator or associated with the recoded

information. (e.g., the investigator wants to see if there is a relationship between length

of stay for laparoscopic surgery and age, so the data collection form records age and

length of stay. The data collection form contains no other information.)

2. Creates a list of medical record numbers-runs a search to get a list of MRNs of

subjects/potential subjects. This list is separate from the data collection form.

3. Picks a medical record number and get the corresponding medical chart.

4. Checks the chart to see if the individual meets inclusion criteria. If so, complete the

data collection form.

5. Marks the medical record number on the list as complete.

6. Repeats steps #1-#3 until done and then analyzes the data.




Review Engagement


Research



Record Retention

Polling Question:

Is the described process acceptable for exempt #4 under 45

CFR 46?

A. Yes

B. No

C. Not Sure



Polling Question


Review Engagement


Research



Record Retention

Interpretation:

Yes-the described process is consistent with OHRP’s interpretation of exemption 4.

Exemption 4 applies even if an investigator records a list of identifiable information

(e.g. medical record numbers) for the purpose of linking this list with other records,

provided that: (1) the investigator does not include any private information such as

medical information on this list of identifiers; and (2) does not record identifiers once

the data for the study have been obtained and the analyses begin.

Note: VA has issued guidance in July 2011 that does not allow exemption 4 to be

applied to such activities.


Email correspondence dated August 2011

Exempt Review - Category 4


Review Engagement


Research



Record Retention

Expedited Review - Category 5

Expedited category 5 states:

Research involving materials (data, documents, records, or specimens) that have been

collected, or will be collected solely for non-research purposes (such as medical

treatment or diagnosis). (NOTE: Some research in this category may be exempt from the

HHS regulations for the protection of human subjects. 45 CFR 46.101(b)(4). This listing

refers only to research that is not exempt.)

Scenario:

Can this category be interpreted to encompass:

• Research involving materials (data, documents, records, or specimens) that have been

collected (for any reasons either for research or for non-research purposes) OR

• Research involving materials (data, documents, records, or specimens) that will be

collected solely for non-research purposes?



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Expedited Review - Category 5

Interpretation:

In 2007 OHRP proposed to amend expedited review category 5 to clarify that the

category includes

• Research involving materials that were previously collected for either non-research or

research purposes, provided that any materials collected for research were not collected

for the currently proposed research, OR

• Research involving materials that will be collected solely for non-research purposes.

http://www.hhs.gov/ohrp/archive/requests/com102607.html




Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention





Expedited category 8 states:

(8) Continuing review of research previously approved by the convened

IRB as follows:

(a) where (i) the research is permanently closed to the enrollment of new

subjects; (ii) all subjects have completed all research-related interventions;

and (iii) the research remains active only for long-term follow-up of subjects;

or

(b) where no subjects have been enrolled and no additional risks have

been identified; or

(c) where the remaining research activities are limited to data analysis.


Expedited Review - Category 8b


Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Scenario:

• A study is initially reviewed and approved by the convened IRB on 1/6/12.

• A new risk is identified by the investigator and reviewed by the convened IRB on

6/25/12 where the IRB approves a modification.

• The research then comes up for continuing review on 12/10/12.

If no subjects have been enrolled at the site since initial review and no additional risks

have been identified (at any site) since the convened IRB review on 6/25/12, can the

study undergo continuing review via expedited review under category 8b?




Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Interpretation:

Yes, the IRB could review the research at the time of continuing review under an

expedited review procedure

• Since there are no additional risks since the last IRB review (the modification on

6/25/12), it would be considered to have “no additional risks identified” and could

be reviewed via expedited procedures.





Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Guidance on Engagement of Institutions in

Human Subjects Research

Scenario:

Dr. Smith at institution A asks individuals at institutions X, Y, and Z to release private

identifiable information to institution A for Dr. Smith’s HHS supported research. The

individuals at institutions X, Y, and Z will review medical records, fill out case report

forms with information extracted from the medical records, and submit them to Dr.

Smith.

• None of the data being abstracted from the medical records was obtained for research

purposes and the individuals would normally have access to these records.

• Individuals at institutions X, Y, and Z will not interact or intervene with subjects and will not

be involved in the analysis of private identifiable data.

• Institutions X, Y, and Z are not awardees through a grant, contract, or cooperative

agreement directly from HHS.

• Institutions X, Y, and Z have ensured that institutional requirements have been satisfied as

well as compliance with other applicable regulations and laws (e.g., HIPAA.)



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Questions:

1. Are institutions X, Y, and Z engaged in the research?

2. The protocol says that institutions X, Y, and Z are “sites” and that the individuals

providing data to Dr. Smith are “co-investigators.” Does this change the

engagement determination?

3. Dr. Smith says that the individuals at institutions X, Y, and Z will be co-authors

on the paper. Does this change the engagement determination?

4. Dr. Smith will pay institutions X, Y, and Z to reimburse for the work of extracting

the medical records. Does this change the engagement determination?



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention



Interpretation:

Institutions X, Y, and Z are NOT engaged in the research, regardless of whether the

collaborating employees at institutions X, Y, and Z are listed as co-investigators, will

be co-authors on publications related to the research, or will be reimbursed for

extracting medical record data.

The OHRP guidance on engagement states that if an institution releases private

identifiable data to an investigator conducting research outside the institution,

the institution is not engaged in research.

The person gathering the data for release needs to have legitimate access to the

data.

• If the individuals at institutions X, Y, and Z did not normally have access to the subjects’

medical records and were accessing them for the purposes of the research, then those

individuals would be doing more than just releasing identifiable private information to

institution A – they would also be obtaining identifiable private information for research

purposes and, thus, institutions X, Y, and Z would be engaged in the research.




Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention



A common activity in a clinical trial are “protocol exceptions” or “single subject

exceptions.” An exception is when an individual is otherwise eligible for participation in a

protocol but does not meet an inclusion or exclusion criterion or is eligible but one or

more procedures cannot be conducted as specified in the protocol.

The investigator contacts the sponsor and asks to follow a variation on the protocol for

one subject. The sponsor provides permission provided the IRB approves the plan.

Examples of exceptions include:

• The protocol specifies that a patient must have a creatinine (kidney function measure) level of

<=1.0. As individual is otherwise eligible for the trial except for a creatinine level of 1.1. The

investigator contacts the sponsor and asks for permission to enroll the subject because the

difference between a creatinine of 1.0 and 1.1 is not clinically significant.

• The protocol specifies that subjects will not be paid for participation nor provided any

reimbursement. The investigator finds an individual who qualifies for the research except that

the subject has insufficient funds for taxi fare to and from the hospital for clinic visits. The

investigator contacts the sponsor and asks for permission to enroll the subject and reimburse

for transportation costs.


Single Subject Exceptions


Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

45 CFR 46.103 (b)(4) states:

• (b) Departments and agencies will conduct or support research covered by this policy only

if the institution has an assurance approved as provided in this section, and only if the

institution has certified to the Department or Agency head that the research has been

reviewed and approved by an IRB provided for in the assurance, and will be subject to

continuing review by the IRB. Assurances applicable to federally supported or conducted

research shall at a minimum include:

– (4) Written procedures which the IRB will follow…

(iii) for ensuring prompt reporting to the IRB of proposed changes in a research

activity, and for ensuring that such changes in approved research, during the period

for which IRB approval has already been given, may not be initiated without IRB

review and approval except when necessary to eliminate apparent immediate

hazards to the subject.



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Questions:

1. Are these exceptions “proposed changes in a research activity”?

2. If these exceptions are not “proposed changes in a research activity”, what

procedures, if any, does the IRB need in place to grant permission for these

exceptions before they are initiated by the investigator?

3. If these exceptions are “proposed changes in a research activity”, can the IRB

approve these proposed changes in a research activity by any mechanism other

than review by the convened IRB or, if eligible for review using the expedited

procedure, review by the IRB chair or one or more experienced IRB members

designated by the IRB chair?



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Interpretation:

OHRP would consider such circumstances to be changes to the protocol which would

require prior IRB review and approval unless necessary to eliminate apparent

immediate hazards to subjects

It would be reasonable to review these in an expedited manner by the IRB chair or

one or more experienced IRB members designated by the IRB chair


Email correspondence dated July 2011


Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Changing Study Personnel

In many IRB offices, a huge effort goes into tracking the specific study personnel

assigned to a research protocol. For example:

• In cancer centers where there is a large pool of coordinators who cross cover many

protocols. When a new coordinator is hired, the PI is submitting dozens (or more)

modifications to add that coordinator to all possible protocols in which the coordinator

might be involved.



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Scenario:

Can an IRB approve a protocol that describes the qualifications of personnel and the

minimal complement of personnel, without knowing the specific names of the study

personnel, and then allow the principal investigator to change study personnel

provided the qualifications are met?

• A protocol submitted to the IRB indicates that the investigator will have the following study

personnel:

– One or more coordinators who are RNs and CITI trained who will perform specific

study procedures and be involved in the consent process.

– A licensed pharmacist who will dispense study drug.

– One or more physician sub-investigators who will be licensed by the state,

credentialed by the hospital, trained on the study protocol and CITI trained. These

individuals will work under the supervision of the principal investigator.



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Polling Question

Polling Question:

Can the IRB approve a protocol without knowing the specific

names of the study personnel, provided that the protocol

indicates specific criteria for selecting study team members?

A) Yes

B) No

C) Not sure



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Changing IRB Personnel

Interpretation:

It is reasonable for the IRB to approve a protocol without knowing specific names of

research personnel, provided that the proposal includes detailed criteria for selecting

research personnel

• Any changes to the proposed criteria would involve a modification to the approved

research, and would need to be reviewed and approved by the IRB.


Email correspondence dated January 2012


Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Research Involving Prisoners as Subjects

OHRP Guidance states:

• Upon receipt of the investigator's report that a previously enrolled research

subject has become a prisoner, if the investigator wishes to have the prisoner

subject continue to participate in the research, the IRB must promptly re-review

the proposal in accordance with the requirements of subpart C, and the

institution(s) engaged in the research involving the prisoner subject must send a

certification to OHRP and wait for a letter of authorization in reply. Otherwise, the

prisoner subject must stop participating in the research, except as noted

below…



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Scenarios:

A. An investigator discovers on a follow-up visit that a participant was incarcerated for

two weeks, but at the time of the follow-up visit is no longer incarcerated. The

investigator had no knowledge that the participant was incarcerated at the time of

incarceration, and performed no interventions, interactions, or gathering of private

identifiable information during the time of incarceration. Does Subpart C apply at the

time of the follow-up visit?

B. An investigator attempts to reach out to a subject via phone at the time of his

scheduled follow-up visit and finds out that the subject is now incarcerated. The

investigator wants to keep the subject enrolled in the study. No private identifiable

information is collected while the subject is incarcerated and the investigator makes

a note in the file to follow up with the subject again when he is

released. Does Subpart C apply?



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Interpretation:

In both scenarios Subpart C would not apply

• If there is no interaction or intervention with, or collection of private identifiable information

about the incarcerated subject, the research would not involve prisoners as subjects

Subpart C would not apply if all non-exempt human subjects research activities

associated with this subject were suspended until the subject is no longer a prisoner.


Email correspondence dated November 2011


Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

IRB Review of HIPAA Authorizations

NIH Guidance indicates:

• The HHS Protection of Human Subjects Regulations do not expressly require that Privacy

Rule Authorizations be reviewed or approved by the IRB. However, under HHS regulations

at 45 CFR 46.117(a) and FDA regulations at 21 CFR 50.27(a), IRB review and approval is

required for any document that contains the IRB-approved informed consent document for

human subjects research. Therefore, if the Authorization language is part of the IRB-

approved informed consent document, such as when the Authorization form is combined

with an informed consent, the IRB is required to review such language.



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Scenario:

Institutional policy indicates to have the IRB review a consent document, the privacy

officer review and approve a HIPAA authorization (but no IRB review of the

authorization language), and after the investigator goes over both and obtains

consent for the research and authorization for use and disclosure of PHI, ask the

subject to sign a single signature block (indicating that their signature provides

consent to both documents)

Question:

Does the IRB have to review and approve the authorization language if the consent

document and HIPAA authorization are independent documents except for having a

single common signature block?



Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Interpretation:

FDA has informally indicated that it would not consider the HIPAA Authorization

document to be a stand-alone document if a joint signature page/block is used for

both a research consent document and a HIPAA Authorization document.

The IRB should review and approve the HIPAA authorization language if the consent

document and HIPAA authorization have a single common signature block.

Alternatively, separate signature blocks could be used for both documents, in which

case the IRB would not have to review and approve the HIPAA authorization

language.


Email correspondence dated February 2010


Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention


Reporting of Unanticipated Problems Involving

Risks to Subjects or Others

45 CFR 46.103 (b)(5) states:

• (b) Departments and agencies will conduct or support research covered by this policy only

if the institution has an assurance approved as provided in this section, and only if the

institution has certified to the Department or Agency head that the research has been

reviewed and approved by an IRB provided for in the assurance, and will be subject to

continuing review by the IRB. Assurances applicable to federally supported or conducted

research shall at a minimum include:

– (5) Written procedures for ensuring prompt reporting to the IRB, appropriate

institutional officials, and the department or agency head of (i) any unanticipated

problems involving risks to subjects or others or any serious or continuing

noncompliance with this policy or the requirements or determinations of the IRB; and

(ii) any suspension or termination of IRB approval.



Review Engagement

Modifications to Approved Research


HIPAA Unanticipated

Problems Record

Retention


Risks to Subjects or Others

Scenario:

A new risk is identified for a federally funded multi-site study. The sponsor modifies

the protocol and informed consent form to add this new risk. A participating site

receives the protocol and informed consent modification and submits it to their IRB

for review. In the process of reviewing the modification, the IRB also determines that

this is an unanticipated problem involving risk to subjects or others because a new

risk that was unexpected and related to the research was identified.



Review Engagement



HIPAA Unanticipated

Problems Record

Retention


Risk to Subjects or Others – Polling Question

Polling Question:

Who does the IRB need to report this unanticipated problem

involving risk to subjects or others to?

A. OHRP

B. Institutional Official (IO)

C. Both OHRP and the IO

D. None of the above



Review Engagement



HIPAA Unanticipated

Problems Record

Retention

Interpretation:

For multicenter research projects, only the institution at which the subject(s)

experienced an event determined to be an unanticipated problem must report the

event to the supporting agency head (or designee) and OHRP (45 CFR

46.103(b)(5)).

• Alternatively, the central monitoring entity may be designated to submit reports of

unanticipated problems to the supporting agency head (or designee) and OHRP.

In the scenario, the participating site would be responsible for reporting the

unanticipated problem involving risks to subjects or others to the institutional official.

Reporting to OHRP would not be required as there was no local event that was

determined to be an unanticipated problem.



Risk to Subjects or Others

Email correspondence dated July 2010


Review Engagement



HIPAA Unanticipated

Problems Record

Retention

45 CFR 46.115 states:

• (b) The records required by this policy shall be retained for at least 3 years, and records

relating to research which is conducted shall be retained for at least 3 years after

completion of the research.

Scenario:

An IRB reviews a study that is being conducted by the sponsor at 25 sites. The local

investigator enrolls one subject and the investigator closes the study after the one

subject completes all protocol required interactions, interventions, and collection and

analysis of private identifiable data. Three years later, can the IRB dispose of its

protocol records or does the three years start when all 25 sites no longer have

activities that involve human subjects?


Retention of IRB Records


Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Interpretation:

The requirement for retention of IRB records for at least three years after research is

completed is institution-specific; that is, each institution must retain its records for

three years following the completion of the research study at that institution.

• In the case when an institution is part of a multi-site clinical trial, the institution must retain

records for three years after the subjects’ participation at that institution has ended, even if

the clinical trial continued after that time at some other institutions.

• In the case when a research study is transferred from the original institution to a second

institution, the original institution must only retain records for three years following the date

of the transfer.


Email correspondence dated April 2010


Review Engagement


Research


HIPAA Unanticipated

Problems Record

Retention

Retention of IRB Records

Questions?


Madeleine Williams, MA, CIP Director, Huron Life Sciences

P 312. 479. 3374

[email protected]

Frank Conte, MS Manager, Huron Life Sciences

P 312. 404. 6413

[email protected]

Thank You!

Visit us online, and download the Huron HRPP Toolkit:

besthrppsops.com

Also stop by the Huron/Click booth at PRIM&R in December!



Business

OHRP Regulatory Interpretations That You Need To Know But Have Never Been Told