Intervention includes both physical procedures by which data are gathered (example: drawing blood) and manipulations of the subject or the subject’s environment that are performed for research purposes. Interaction includes communication or interpersonal contact between investigator and participant. Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (example: a medical record). Private information must be individually identifiable (the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects.
Expedited require minimal risk. Vulnerable populations require additional review in certain circumstances and may not be eligible for exempt classification.
Minorities are included for two reasons – to make sure that they are accounted for in beneficial research and to make sure that they are not taken advantage of
Since cross-cultural variability exists in the ways people make decisions about participating in research studies, obtaining consent from gatekeepers or community leaders as well as from the individual subject may be necessary. Researchers also need to find ways to avoid any undue inducement that might affect a subject’s decision to participate and to minimize any possible social harm that may result from the study or associating with the researchers.
PHI is any information in the medical record or designated record that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health care service such as diagnosis or treatment. HIPAA regulations allow research to access and use PHI WHEN NECESSARY to conduct research. However, HIPAA only affects research that uses, creates, or discloses PHI that will be entered into the medical record or will be used for healthcare services, such as treatment, payment or operations. For example, PHI is used in research studies involving review of existing medical records for research information, such as retrospective chart review. Also, studies that create new medical information because a health care service is being performed as part of research, such as diagnosing a health condition or a new drug or device for treating a health condition, create PHI that will be entered into the medical record. For example, sponsored clinical trials that submit data to the U.S. Food and Drug Administration involve PHI and are therefore subject to HIPAA regulations. In contrast, some research studies use data that is person-identifiable because it includes personal identifiers such as name, address, but it is not considered to be PHI because the data are not associated with or derived from a healthcare service event (treatment, payment, operations, medical records) not entered into the medical records, nor will the subject/patient be informed of the results. Research health information that is kept only in the researcher’s records is not subject to HIPAA but is regulated by other human subjects protection regulations. Examples of research health information not subject to HIPAA include such studies as the use of aggregate data, diagnostic tests that do not go into the medical record because they are part of a basic research study and the results will not be disclosed to the subject, and testing done without the PHI identifiers. Some genetic basic research can fall into this category such as the search for potential genetic markers, promoter control elements, and other exploratory genetic research. In contrast, genetic testing for a known disease that is considered to be part of diagnosis, treatment and health care would be considered to use PHI and therefore subject to HIPAA regulations. Also note, health information by itself without the 18 identifiers is not considered to be PHI. For example, a dataset of vital signs by themselves do not constitute protected health information. However, if the vital signs dataset includes medical record numbers, then the entire dataset must be protected since it contains an identifier. PHI is anything that can be used to identify an individual such as private information, facial images, fingerprints, and voiceprints. These can be associated with medical records, biological specimens, biometrics, data sets, as well as direct identifiers of the research subjects in clinical trials.
2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
if investigators who receive health information under a Waiver of Authorization disclose any of that information to other investigators, institutions, or agencies, the investigator is responsible for keeping an accounting of disclosures. Under HIPAA, subjects can request a record of how often their health information was released to others in the previous six (6) year period. For health information obtained under a Waiver of Authorization, it is the investigator’s responsibility to provide this record of disclosures.
A medical device is any instrument, apparatus, or other similar or related article, including component, part, or accessory, which is: (a) recognized in the official National Formulary, or the United States Pharmacopeia, or any supplement to them; (b) intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in humans or other animals; or (c) intended to affect the structure or any function of the human body or in animals; and does not achieve any of its principal intended purposes through chemical action within or on the human body or in animals and is not dependent upon being metabolized for the achievement of its principal intended purposes. Approximately 1,700 types of medical devices are regulated by FDA. The range of devices is broad and diverse, including bandages, thermometers, ECG electrodes, IUDs, cardiac pacemakers, and hemodialysis machines. For further information, see the information sheets entitled &quot;Medical Devices,&quot; &quot;Frequently Asked Questions about IRB Review of Medical Devices&quot; and &quot;Significant Risk and Nonsignificant Risk Medical Device Studies.&quot; In vitro diagnostic processes being developed for laboratories to eventually use to diagnose disease or test kits (such as pregnancy test kits) and computer software or video games developed to mitigate or diagnose disease are also medical devices regulated by the FDA. Class 1: least risk, subject only to general controls (Examples: elastic bandages, exam gloves) Class 2: also subject to special controls identified by agency such as special labeling (Examples: powered wheelchairs, surgical drapes, infusion pumps) Class 3: insufficient information exists to determine that general or special controls are sufficient to provide assurance of safety (examples: replacement heart valves, implanted cerebellar stimulants)
A premarket notification, or 510(k), is submitted to FDA before a manufacturer proposes to market a medical device. If FDA agrees the new device is substantially equivalent to a legally marketed device for which premarket approval is not required, the manufacturer may market it immediately. FDA does not require clinical data in most 510(k)s. A premarket approval (PMA) application is the most stringent type of device marketing application for medical devices. FDA approves a PMA if it determines that the application contains sufficient valid scientific evidence to provide reasonable assurance that the device is safe and effective for its intended use(s). An HUD is a device that is intended to benefit patients in the treatment and diagnosis of diseases or conditions that affect or is manifested in fewer than 4,000 individuals in the United States per year. The Office of Orphan Products Development (OOPD) determines if a device meets specific requirements, including scientific rationale and population prevalence, for designation as a HUD. A Humanitarian Device Exemption (HDE) application is similar to a PMA, but because a HUD is exempt from the effectiveness requirements of a PMA, an HDE application is not required to contain the results of scientifically valid clinical investigations demonstrating that the device is effective for its intended purpose. However, the HDE must contain sufficient information for FDA to determine that the probable benefit to health outweighs the risk of injury or illness, taking into account the probable risks and benefits of currently available devices or alternative forms of treatment. Only to be used after receipt of HDE and only at institutions with an IRB There are three types of studies described in the regulations: significant risk (SR) device studies, non-significant risk (NSR) device studies, and exempt studies. If an Investigational Device Exemption is issued by the FDA, the PI or sponsor must supply a letter from the FDA giving the IDE number. Medical devices under investigation which are invasive or implanted into the body usually require an IDE. PIs may ask for classification of a device or a pre-IDE conference with the FDA by completing the 513(g) process as listed on the UCF IRB and FDA websites. PIs can also get assistance by calling the Small Manufacturers Division.
Sponsors of investigational SR device studies are required to get an approved IDE from FDA before starting their study. 21 CFR 812.20 (FDA gives each IDE a number - for example #GXX0000, where XX denotes the year of the submission). Sponsors and clinical investigators of these studies must comply with the regulations at 21 CFR Part 812, &quot;Investigational Device Exemptions.” A conditional approval letter from FDA allows the study to begin if the study is approved by the IRB, but requires the sponsor to provide additional clarifying information in order to obtain full approval for the study IRBs do not have to make the SR or NSR determination if FDA has already made the risk determination. Most often, clinical investigators submit SR device investigations for IRB review after the study has already received IDE approval from FDA. IRBs may ensure that SR device investigations have an FDA-approved IDE by asking the clinical investigator to request from the sponsor a copy of FDA’s IDE approval letter.
If an IRB finds that an investigational medical device study poses a NSR, the sponsor does not need to submit an IDE to FDA before starting the study. If the IRB determines that the proposed study is an NSR study, the IRB may proceed to review the study FDA considers an NSR device study to have an approved IDE after IRB approval and when sponsors meet the abbreviated requirements at 21 CFR 812.2(b). Consequently, in most cases, FDA is not aware of non-significant risk device studies. If, however, FDA has not made the risk determination or the IRB disagrees with the NSR determination made by a sponsor, then the IRB must notify the investigator and, where appropriate, the sponsor, that the study involves a significant risk device Examples of exempt studies are consumer preference testing, testing of a device modification, or testing of two or more devices in commercial distribution if the testing does not collect safety or effectiveness data, or put subjects at risk. Studies of an already cleared medical device in which the device is used or investigated in accordance with the indications in the cleared labeling are exempt from Part 812.5 Note: Studies of a cleared device for a new use must comply with the human subject protection (informed consent and additional safeguards for children in research), IRB, and IDE regulations. Similarly, studies of a PMA approved device are exempt from the IDE requirements if the device is being studied for the indications in the approved labeling.
The IRB office will help investigators determine if they or UCF are engaged. If the UCF investigators and UCF are engaged, the study should be entered into the iRIS electronic system. If the UCF investigators and UCF are not engaged, the study should not be entered into the iRIS electronic system. In the latter case, the IRB office will create a letter advising that it recognizes the reviewing IRB at the other institution as “IRB of Record”. In some cases both IRBs review the study and in other cases one IRB may rely upon another. Discuss this with IRB staff.
1. Tracy L. Dietz, Ph.D.
Chair, UCF IRB
2. When is IRB Approval Required?
According to the OHRP:
If the activity:
 Involves any element that is “research”
 Includes humans subjects:
 identifiable data about humans,
 identifiable cell lines,
 data from humans
According to UCF Policy:
Only the IRB can determine if study is exempt
 Investigators or others may not make this determination
3. What is Research?
45 CFR 46.112 defines research as:
a systematic investigation, including research
development, testing and evaluation, designed to
develop or contribute to generalizable knowledge.
Activities which meet this definition constitute
research for purposes of this policy, whether or not
they are conducted or supported under a program
which is considered research for other purposes.
4. What is a Human Subject?
 45 CFR 46.112 defines a human subject as:
 a living individual about whom an investigator
(whether professional or student) conducting
 Data through intervention or interaction with the
 Identifiable private information
 Thus, this includes actually interacting or intervening to
obtain data but it also means identifiable cell lines and
identifiable data taken from records (which are not
5. What is Identifiable?
Social Security Numbers
Also, if the information that is obtained is specific
enough with the different “variables” to allow
someone to determine identity, then it is identifiable
(such as in a very small population size).
6. What is a Public Record?
Public records are those data sources that are available to
anyone from a public source (such as on the internet, from
associations, from licensing agencies, etc).
What is not a public record?
Items that are part of a sealed report or record
MANY, MANY others. Just because they are existing does
not mean they are public
7. What About Institutional Level
Studies involving aggregate level data do not require
Numbers of people treated in any given month
Doctor to patient ratio
Policies that govern decisions at the clinic, etc.
8. How are studies classified
Full Board – greater than minimal risk or needing
group decision as to risk, ethics, or other problem
Expedited – according to specific federal regulation
list and minimal risk only. See list.
Exempt – according to specific federal regulation list
and minimal risk only – usually this is research
involving databases, secondary data use, or existing
(already collected and/or stored) data, documents,
records, pathological specimens or diagnostic
specimens. See list.
9. Federally designated
 For more information http://www.hhs.gov/ohrp/irb/irb_chapter6ii.htm
 Fetuses and Human in vitro fertilization
 Pregnant women
 The Cognitively impaired
 Traumatized and comatose patients
 Terminally ill patients
 Elderly/aged ONLY when there is cognitive impairment or institutionalization
 Socially and economically disadvantaged
 Students, employees, and normal volunteers WHEN there are procedures that
may create feelings of coercion, etc.
 International research*
10. International Research
Several regulatory standards provide foundation and
ethical codes. Much of it medically-focused.
The International Compilation of Human Subject
Research Protections lists laws, regulations, and
guidelines governing human subjects research world-
11. Strategies for Protecting Human Subjects in
See summary report
Consent from gatekeepers or community leaders
Avoid undue inducement and avoid social harm (or
perception of it)
Consider solicitation of community input
Signed consent not mandatory (consider literacy)
12. Strategies for Protecting Human
Subjects in Global Project (cont)
Communities can be unaware of their rights
Communities can be distrustful of researchers
Issues of concern:
Confidentiality and privacy protection
Access to medicines and vaccines
Involvement of children in clinical research
Use of stem cells
Research with biological weapons
13. Things to consider in International
Risks of Research can be different in an international
What is considered private may be different
Age of majority may be different
May be gender differences
Cultural expectations about what is appropriate to
The Health Insurance Portability and Accountability
Act of 1996, also known as the Privacy Rule
Established a set of national standards for the
protection of certain health information.
Requires that an IRB or a Privacy Office review research
involving identifiable health information.
Protected Health Information (PHI): What it is. What
UCF HIPAA components
Communication Sciences & Disorders and Health
15. What are the PHI identifiers?
Social Security number
Medical record number
Health plan beneficiary
VIN, serial number,
license plate number
Device identifiers and
Any other unique code
16. HIPAA Authorization & Waiver
Waiver of HIPAA Authorization (example: retroactive
chart review for data collection)
To qualify for a Waiver of Authorization
 Research use of PHI does not represent more than a minimal
risk to privacy
 Research could not be done without the requested PHI
 It would not be practical to obtain signed authorizations
from research subjects (if you are talking to them, it is
 Specific elements of PHI are not more than the minimum
necessary to accomplish study goals.
17. Biosafety Committee Review
Research involving hazards require biosafety and/or
radiation committee approval.
 Microbiological/viral agents, pathogens, toxins and
other selected agents
 Human cell or tissue samples
 Recombinant DNA
 Controlled substances
 Ionizing Radiation
 Physical agents such as ultraviolet light, lasers (class
FDA regulation occurs with all medical devices
What is a medical device?
IRB is to make determination of significant versus non-significant risk
How are medical devices classified by FDA?
Examples: elastic bandages, exam gloves)
Examples: powered wheelchairs, surgical drapes, infusion pumps
Examples: replacement heart valves, implanted cerebellar
19. Other information on FDA
Premarket notification – 510(k)
Premarket approval – PMA
Humanitarian use device -- HUD
Humanitarian device exemption -- HDE
Medical device clinical investigation – IDE
Request for pre-IDE conference or classification –
Small Manufacturers Division – 1-800-638-2041
20. IDE – Investigational
Significant Risk Device
Intended as implant and presents potential for serious
For use in supporting or sustaining life and presents
Substantial importance in diagnosing, curing,
mitigating, treating disease and presents serious risk
Otherwise presents serious risk
Regulations for IRB review, marketing, labeling, etc.
apply as per 21 CFR 812
21. Non-significant Risk
Non-significant risk device
 An NSR device is an investigational device that does not meet the
definition of a significant risk device
IRB determination that a device is non-significant risk relies upon:
 Sponsor’s description of why it is not SR
 Whether proposed NSR research meets the definition of significant risk
 Use of device & protocol related procedures/tests (not just device alone)
 Additional information from sponsor
 PIs are responsible for “abbreviated requirements” at 21 CFR 812
 Subject to informed consent
 Off-label USE of legally marketed device does not require IRB approval as
in the normal practice of medicine, but research to make claims or change
the label does require IRB review and approval
Collaborators from other institutions engaged in the research
must be identified as well as their roles, such as:
Administer research interviews, questionnaires, etc.
Perform invasive or non-invasive procedures or experiments
Manipulate a subject’s environment
Receive or access identifiable private information
Obtain informed consent
The collaborating institution must have a Federalwide
Assurance if it receives federal research funding
Collaborators must complete CITI training
23. Institutions Not Engaged
Release individually identifiable information or
specimens to another institution
Permit investigators from another institution to use
their facilities, students, employees, etc. for research
Provide information about research to prospective
Perform commercial or non-collaborative service