Data Review Protocols: Chart Reviews, Case Studies, and Registries

1. Research Café Data Review Protocols:Chart Reviews, Case Studies, and Registries

2. Apples, Oranges, and Pears • Chart Reviews, Case Reports, and Registries do have a lot in common, however, there are many differences as well. • The differences determine what you need to submit to the IRB and the way that the IRB reviews your application.

3. HIPAA changed the rules: Fact or Fiction? • 45CFR46, “The Common Rule”,the federal regulation governing human research subjects, has ALWAYS regulated research studies that involve collecting data: YES, even when there is no interaction with the subject. • Thedefinition of a human subject as defined by federal regulation in 45CFR46.102,“means a living individual about whom an investigator (whether professional or student) conducting research obtains • (1) data through intervention or interaction with the individual, or • (2) identifiable private information.” All of this regulation is NOT because of HIPAA. HIPAA just adds another layer of compliance.

4. So how do I know what type of data review I’m conducting? • Chart reviews are retrospective and collect existing data. There are no specific individuals, but rather a class of subjects about which data is obtained. • Case reports are also retrospective and collect existing data. However, investigators have at least one individual specifically in mind. • Registries are prospective and may collect past, current, and future data on individuals and/or classes of individuals.

5. IRB Perspective • Three types of review can be used by the IRB for Data Review Protocols • Determination of Exempt Status • Only when there is no link to identity and no code or link between the subject and the data and the data is already exists • Expedited Review • When there is a coded link to subject identity or when data is identifiable or when the data does not already exist • Full Board Review • When there is a coded link to subject identity or when data is identifiable and the data collected could lead to civil or criminal liability or other significant harm (i.e., review of genetic testing results, criminal behaviors, or social stigmas)

6. I know that I want to do a chart review of existing data. Help! • Chart Reviews: Three choices • Collect existing data from medical records with no link to identity (the infamous HIPAA 18). (EXEMPT) • Collect data from medical records with a link to identity that will be destroyed once the all of the data has been collected and/or analyzed. (EXPEDITED) • Collect data without a link to “identity” or with a link that will be destroyed once data has been collected and analyzed but retain certain HIPAA identifiers (elements of dates and geographic codes) in a Limited Data Set. (EXPEDITED) • HIPAA had added the allowance of alimited data setand has standardized what should be considered an identifier.

7. Chart Review Scenario #1 • I am an oncologist and I have noticed that several of my patients on a certain medication seem to have a better hematological response than patients on a similar medication for the same indication. It’s just a hunch, but one that I want to look at closer and if the data is significant I would like to publish or use the data to create a larger randomized protocol. • I only need to collect diagnosis, age of subject, disease staging, medications, and the results of standard blood tests. The subjects are my own and the data is all in one place, my department’s medical records. • Eligible for Determination of Exempt Status. • Exempt DOES NOT mean exempt from IRB review, it is exempt from certain elements of “the Common Rule”, notably continuing review. • The IRB is the only body that can issue a determination of exempt status.

8. Chart Review Scenario #2 • I am an oncologist and I have noticed that several of my patients on a certain medication seem to have a better hematological response than patients on a similar medication for the same indication. Its just a hunch, but one that I want to look at closer and if the data is significant I would like to publish or use the data to create a larger randomized protocol. • I only need to collect diagnosis, age of subject, disease staging, medications, and the results of standard blood tests. The subjects are my own, but the data is NOT all in one place, I need to access my department’s medical records, the pharmacy’s records and pathology information. As a result I need a LINK to identity to correlate all of the information • Eligible for Expedited Review with a Waiver of Informed Consent and HIPAA Authorization pending the following • The link to identity must be kept separate from the data. • There must be an adequate plan to protect that link and destroy it once the data collection and analysis is completed. • The research could not be conducted without issuing a waiver.

9. Chart Review Scenario #3 • I am an oncologist and I have noticed that several of my patients on a certain medication seem to have a better hematological response than patients on a similar medication for the same indication. Its just a hunch, but one that I want to look at closer and if the data is significant I would like to publish or use the data to create a larger randomized protocol. • I need to collect diagnosis, age of subject, disease staging, medications, and the results of standard blood tests. But I also want to look at hospitalizations, length or treatment, and length of stay. As a result I want to record dates of hospitalization, dates of treatment, and dates of discharge. The subjects are my own and the data is all in one place, my department’s medical records. • Eligible for Expedited Review with a Waiver of Informed Consent and HIPAA Authorization with the Use of a Limited Data Set pending the following • No other HIPAA identifiers other than dates and geographic codes are collected. • There must be an adequate plan to protect identifiers and preserve confidentiality. • There should be no unauthorized secondary use of the data. • A Data Use Agreement has been completed. • The research could not be conducted without issuing a waiver.

10. The Chart Review Wrinkle • Okay, so maybe all or some of the data doesn’t exist yet, and/or I want to collect follow up data. Can I do that? • Yes except now we call that a Registry.  • Different Name = Different Rules • Apples ≠ Pears

11. Registry Scenario #1 • I am an oncologist and I want to explore whether patients on a certain medication have a better hematological response than patients on a similar medication for the same indication. • I want to collect information on subjects being treated as per standard care. This protocol will not modify or offer any treatment. This is a new treatment and there are not that many patients who have received it in the past, as a result I need to do the study prospectively. I do not need to collect any follow up data. • Eligible for Expedited Review. Could be eligible for a Waiver of Informed Consent and HIPAA Authorization pending the following • You are collecting no identifiers or links to identity • It’s a one time data collection, there is no continued data collection. • You would have access to that subject’s medical record as part of normal clinical responsibilities. • The research could not be conducted without issuing a waiver.

12. Registry Scenario # 2 • I am an oncologist and I want to explore whether patients on a certain medication have a better hematological response than patients on a similar medication for the same indication. • I want to collect information on subjects being treated as per standard care. This protocol will not modify or offer any treatment. This is a new treatment and there are not that many patients who have received it in the past, as a result I need to do the study prospectively. I want to collect data on treatment, outcome, and follow-up. • Eligible for Expedited Review. Need to obtain Informed Consent and HIPAA Authorization. Why? What’s different here? • It’s NOT a one time data collection, there is continued data collection, as a result you need to maintain a link to identity. • You are creating a database of subjects, which you could use for future research.

13. Registry Scenario #3 • I am an oncologist and I want to explore whether patients on a certain medication have a better hematological response than patients on a similar medication for the same indication. Most of the patients are my own but I would also like to get colleagues in private practice or at other institutions involved. • I want to collect information on subjects being treated as per standard care. This protocol will not modify or offer any treatment. This is a new treatment and there are not that many patients who have received it in the past, as a result I need to do the study prospectively. I may want to collect data on treatment, outcome, and follow-up. • Eligible for Expedited Review. Need to obtain Informed Consent and HIPAA Authorization. Why? What’s different here? • It’s NOT a one time data collection, there is continued data collection, as a result a link to identity will exist. • You are creating a database of subjects, which you could use for future research. • You do not have access to all these medical records as part of normal clinical practice

14. What to include in a chart review protocol • Purpose • Number of charts to be reviewed, dates of charts that will be reviewed • Methods: include who will review, where the charts are, and all of the data points that will be abstracted. • Risks and Benefits • Confidentiality • Data Analysis • References • A copy of the data collection sheet to be employed.

15. The Case Report Conundrum • I’m not doing a study. One or two patients had a really great response. I can just write those up, right? WRONG This is where HIPAA changed the way we do business. • An orange may be a citrus, but it is still a fruit.

16. When does a case report need to be submitted to the IRB? • When it is more than one in a series. • When it is in a disease or condition that is so rare that by discussing the case and identifying yourself you are identifying the subject. • When you are using it for more than internal education. • When it is not for use as quality improvement or as a response to a public health request.

17. What to include in a case report protocol • Purpose and intent of the case report. • Number of cases that will be reviewed. • Methods: Who will collect the data and from where? • General outline of the case report or abstract. • Request for a waiver of HIPAA authorization or an informed consent form.

18. Case Reports and the IRB • New territory, subject to change. • Probably eligible for expedited review, may need informed consent and HIPAA authorization • Each situation is currently being reviewed on a case by case basis. • Call the Office of the IRB early in the process so that we can advise you how to proceed.

19. How to Submit to the IRB • For Determination of Exempt Status ** Note that the final determination on review can ONLY be made by the IRB ** • IRB Form 1 – Proposal Cover Sheet • IRB Form 2a – Chart Review Research Plan • IRB Form 3  – Conflict of Interest Questionnaire • IRB Form 4a – Application for Determination of Exempt Status

20. How to Submit to the IRB • For Expedited Review ** Note that the final determination on review can ONLY be made by the IRB ** • IRB Form 1 – Proposal Cover Sheet • IRB Form 2 – Protocol Summary • IRB Form 3  – Conflict of Interest Questionnaire • IRB Form 4 – Application for Research Involving Human Subjects • IRB Form 4b – Request for Waiver of Informed Consent/HIPAA Authorization (if appropriate) OR Research Consent Form (if appropriate) • Research Protocol

21. How to Submit to the IRB • For Full Board Review ** Note that the final determination on review can ONLY be made by the IRB ** • IRB Form 1 – Proposal Cover Sheet • IRB Form 2 – Protocol Summary • IRB Form 3  – Conflict of Interest Questionnaire • IRB Form 4 – Application for Research Involving Human Subjects • IRB Form 6 – Fee Form (for industry sponsored studies) • Research Consent Form • Research Protocol

22. For more information • Office of the IRB: (516) 719-3100 • IRB website: www.nslij.com/irb • Consultation hours are available both off and on campus. • Office of Research Compliance

23. Review Preparatory to Research45 CFR 164.512(I)(1)(iii)

24. Review Preparatory to Research • HIPAA provision to access PHI with a waiver of authorization to design a research study, generate a hypothesis or to assess the feasibility of conducting a study e.g enough potential patients.

25. Review Preparatory to Research • Researcher needs to certify in writing that: • PHI is necessary for the research • PHI will not be used for any other purpose • PHI will not be removed from the CE and • The researcher is the PI that will oversee all other study personnel

26. Review Preparatory to Research • Recruitment is prohibited under Review Preparatory to Research • Patient contact without IRB approval is not permitted

27. Review Preparatory to Research • Research Scenario I am an oncologist and I have noticed that several of my patients on a certain medication seem to have a better hematological response than patients on a similar medication for the same indication. Its just a hunch, but one that I want to look at closer and if the data is significant I would like to publish or use the data to create a larger randomized protocol. What do I need to do?

28. Review Preparatory to Research Research Scenario continued • Submit a written proposal and “Review Preparatory to Research Form” to the Research Privacy Board for review and approval • Describe the purpose of the PHI review • Design a study or feasibility to conduct a study You must:

29. Review Preparatory to Research Research Scenario continued • Describe the specific nature of the PHI requested, where it is located, and why it is necessary to achieve the purpose of the review • Indicate the type of record, chart or database that will be reviewed

30. Review Preparatory to Research Research Scenario continued • Explain why the PHI review is necessary to prepare the research protocol • List all the individuals under PI direction that may access the records • Must be employees of the CE • Attach copy of data collection form if applicable

31. Review Preparatory to Research Research Scenario continued • Submit an original Review Preparatory to Research form and 2 copies to the IRB • Request will be forwarded to the Research Privacy Officer or designee for review and approval (RPR#) • Approval is for 6 months from the approval date

32. Review Preparatory to Research Research Scenario continued • Use documentation of approval to gain access to data source • Confirm that 100 subjects are potentially eligible • Cannot use this information to contact individuals or remove from the source

33. IRB Institutional Review Board 5 Dakota Drive, Suite 307 Lake Success, NY 11042 Phone: (516) 719-3100 FAX: (516) 719-3110 www.northshorelij.com/education/irb.cfm

34. ORC • Office of Research Compliance 350 Community Drive, Manhasset, NY 11030 Phone: (516) 562-9476 FAX: (516) 562-1022

35. For more information • Office of the IRB: (516) 719-3100 • IRB website: www.nslij.com/irb • Consultation hours are available both off and on campus. • Office of Research Compliance: 516-562-9476