The Regulatory Citation and How It Applies:
“Research involving collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.” (§46.101(b)(4))
In order to qualify for this exemption, the materials to be used in the research must satisfy two criteria:
- The data/specimens must be existing or "on the shelf" at the time that the research is proposed to the IRB (i.e., date of the IRB application). This category does not apply to the prospective collection of data or specimens.
- The data to be used cannot include direct identifiers (e.g., names, social security numbers, addresses, phone numbers) or indirect identifiers (codes or pseudonyms that are linked to the subject's identity).
- Codes that allow the investigator to link back to identifiable data are not allowed in Category 4 exemption.
What is meant by “publicly available resources”? This language in the regulation was intended to apply to public sources of data, such as local telephone directory information. For example, student records which are covered by the Family Educational Rights and Privacy Act (FERPA) are not public records. The meaning of this language with respect to human tissue specimens is widely debated. Although there are organizations that make human cells and tissues broadly accessible to the research community, these materials are not usually available to the public at large and are not generally considered to be publicly available.
What is meant by “identifiers linked to the subjects”? Identifiers can include names, social security numbers, medical record numbers, or other codes that permit specimens or data to be linked to living individuals and perhaps also to associated medical information. For example, biological or pathological samples obtained by means of retrospective collection from existing sources may not be eligible if the subject’s identity is readily ascertainable to the researchers through direct or coded identifiers or the information is obtained from nonpublic sources such as medical records. If the samples are given to the investigator with any hospital numbers, codes or links that tie the data back to a list of subjects, then there is a mechanism in which the subject can be identified, directly or indirectly and the research does not qualify for exempt review in this category.
- Online data-sets are typically categorized as either Public or Restricted.
- Publicly available data-sets often have no identifying information stored in the data-set and do not require any special effort on behalf of the investigator to obtain the data. The general public can get the data/biological specimens with minimal effort and the data are available to anyone regardless of occupation, purpose, or affiliation). These data often fit the criteria for Not Human Subjects Research.
- Restricted data-sets generally require a Data Use Agreement to be completed by the investigator.
- The onus for documentation of the contents of the data-set and/or documentation of the applicability of it to the Category 4 exemption is the responsibility of the investigator.
Secondary Data Analysis of Existing Data-sets (not online)
- Same criterion for online data-sets applies to analysis of existing data-sets that may reside at UMKC or at other universities or institutions.
- The investigator must obtain documentation from the source of the data that the data-set meets the definition of Category 4.
Some medical record or chart reviews may qualify under this category of exemption. Data to be collected and stored with the research data CANNOT include any of the 18 HIPAA identifiers except elements of dates and elements of geographical location from the zipcode and higher (i.e., not street address). HIPAA regulations apply to this type of research. Examples of chart reviews that meet these criteria are as follows:
- Medical records are chosen at random, and do not require a list of MRNs to be generated in order to obtain the records.
- MRNs (not names) are generated to pull records. The list is stored separately from the research data and is destroyed once the records have been pulled.
In each case, it is the responsibility of the investigator to include enough information in the application for the IRB to determine if the medical record review is eligible for Category 4 exemption.
Information to include in your application:
- Specifically where the list of MRNs will be kept and when it will be destroyed
- The specific devices on which these data will be stored and/or transmitted
- Whether you will manually or electronically access the records
- Whether you will manually or electronically record the data
- All the security measures you have in place. It is NOT sufficient to merely state that the data storage and transmission meets HIPAA requirements.
Examples of Research Exempt under Category 4:
- A researcher conducts a retrospective chart review -- that is, the researcher only reviews data that was already in the medical record at the time of the exempt application. The researcher does not record any identifiers when abstracting the data or otherwise link data to individual subjects.
- The School of Education conducts a student satisfaction survey each year. The survey contained basic demographics, including some identifiable information and 5 questions on general satisfaction. A student researcher is given access to the area where the surveys are stored and records the responses to the 5 satisfaction questions for her research. None of the demographics are used in her proposed research.
Examples of Research NOT Exempt under Category 4:
- An intern wishes to study the geographical spread of tuberculosis in rural areas. He will run a query in the electronic medical records and receive an output that includes MRN, diagnosis, and smoking status. Because the MRN is linked to the clinical data, this project would require Expedited review.
- A researcher will obtain access to the research database for an existing study and will record whether or not participants on the study received information about smoking cessation. The entries will be coded so that he can go back to the research data at a later date to assess health outcomes. Aside from the code, he will only record age, smoking status, whether they received the cessation information, and blood pressure. The use of the linked code requires Expedited review.
- A graduate student will review existing data from an ongoing IRB-approved registry. He applies to the IRB on March 15, 2014. The description of his research states that he will record the information needs for her research without code and no identifiable information will be recorded by the investigator. He states that he will utilize data from March 2013 – March 2014. This does not qualify as Category 4 exemption as all of the data to be analyzed must be on the shelf at the time of submission date to the IRB.
FAQs Regarding Exempt Category 4
Yes. If a researcher wishes to utilize the results of a previously conducted QI project, a clear distinction should be made in the application between the QI project, which may have involved data mining, satisfaction surveys, and staff interviews, and the proposed analysis of this data as part of the Category 4 exemption. The IRB cautions faculty and staff to think about the outcomes of Quality Improvement (QI) efforts and consider the generalizablilty of the project ahead of time. In many instances, the project serves both QI and research purposes. In such cases, prospective IRB approval must be obtained prior to implementation of the program.
Exemption 4 applies to retrospective studies of specimens and/or data that have already been collected. The materials must be “on the shelf” (or in the freezer) at the time the protocol is submitted to the OIRB to determine whether the research is indeed exempt. Research that involves the ongoing collection of specimens and/or data does not meet the criteria for Exemption 4, even if they were destined to be discarded.
Participants may be identifiable through direct identifiers (e.g., name, email, street address) or indirectly through demographics. For example, demographics obtained from personnel in a certain clinic may drill down to the only male LPN of Pacific Islander descent on staff; thereby, identifying the individual without any direct identifiers.