Medical Record Review

The use of medical records or protected health information (PHI) requires IRB review. Studies which involve only chart /medical record review sometimes pose significant risk to subjects. The most common risk is a breach of confidentiality with the exposure of potentially embarrassing information without the knowledge or consent of the subject. Such studies may also lead to recruitment of subjects into future non-therapeutic studies in a manner which may provoke the subject to ask how his/her record was revealed to someone not part of his/her therapeutic team.

The HIPAA Privacy Rule requires covered entities to obtain each subject's authorization, or an IRB waiver of such authorization, before a researcher (including the subject's treating physician) may access the subject's records or other protected health information for research purposes.
To access charts or medical records for research purposes, the researcher must submit an application to the IRB for approval.

To obtain IRB approval to review medical records at UVa, go to IRB Online and proceed with a new application. This approval is required regardless of where these medical records are located (e.g., Health Information Services-HIS- formerly Medical Records, shadow records in your department, departmental databases, electronic medical record etc.).

In addition, if you need to have charts pulled from HIS, complete a Request for Medical Records Form. Attach a copy of your IRB Approval Form to the Request for Medical Records Form in order to have the charts pulled.

Preparatory to Research or Review of Decedent Information

If the researcher wishes to review charts of decedents, to design a research study or to assess the feasibility of conducting a study, IRB approval is not required, however, the researcher must first complete a Request for Medical Records Form and submit this to the UVa Health System Department of Health Information Services (HIS). In this form the researcher will represent that the use or disclosure of the protected health information is solely to:

• prepare a research protocol or
• for similar purposes preparatory to research,
• that the researcher will not record any protected health information, and
• that protected health information for which access is sought is necessary for the research purpose.

Decedent Information with HIPAA Identifiers

If you need to collect information on deceased individuals and also need to record any HIPAA identifier, submit the Decedent Research with PHI: Waiver of HIPAA Authorization Application form to the IRB. The IRB will provide you with an Approval/Assurance Form which may be submitted to Health Information Services to obtain the charts you need.

Epidemiologic Studies

Epidemiologic studies present several unique problems because they often use sensitive private documents, such as medical records, and link them with other data, such as employment, insurance or police records. The primary ethical concerns presented by epidemiologic studies are protection of subjects' privacy and the confidentiality of data. Access to those records without prior consent of the subject raises concerns about the violation of the ethical principle of respect for persons (sometimes referred to as autonomy).

The IRB's review is to ensure that epidemiologists take adequate steps to preserve the confidentiality of the data they collect, and that they specify

• who will have access to the data,
• how and at what point in the research personal information will be separated from other data,
• whether the data will be retained at the conclusion of the study, and
• any possible disclosure of the data.

The IRB also requires a thorough description of interview instruments and questionnaires.
When a study involves reviews of records which can be linked to the identity of the subject, the IRB must ensure that subject's privacy interests will be adequately protected and that any uses or disclosures of protected health information for the research comply with any applicable Privacy Rule requirements.

Where the Principal Investigator will have personal contact with subjects, a potential for harm exists since they are identified as potential subjects because they either have or are at risk of developing a disease or condition. Simple contact with subjects may present a risk of harm, either because of sensitivity to discussing a disease or condition they know they have, or because they may not be aware of their condition. Once potential subjects are identified, the Principal Investigator should obtain their consent to participate in the study.

Disclosure of information such as that usually collected in epidemiologic studies also presents an ethical concern. All information collected as part of a study is confidential. Data must be stored in a secure manner and must not be shared inappropriately. The Principal Investigator's protocol should detail how data will be kept and how confidentiality of data will be maintained. Principal Investigators should note, however, that, unlike medical records, research data is not privileged under law unless a Certificate of Confidentiality is obtained and is current.

*Taken from UVa IRB-HSR Research Guidance

Udated 08/05/2010.