The Regulatory Citation and How It Applies:
Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met:
- The identifiable private information or identifiable biospecimens are publicly available;
- Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;
- The research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of ‘‘health care operations’’ or ‘‘research’’ as those terms are defined at 45 CFR 164.501 or for ‘‘public health activities and purposes’’ as described under 45 CFR 164.512(b); or
- The research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the identifiable private information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.” [§46.104(d)(4)]
Secondary research uses of identifiable, private information or identifiable biospecimens for which consent is not required is exempt under this category if at least one of the following is true:
- Part i: The identifiable private information or identifiable biospecimens are publicly available.
In most cases, publicly available datasets or biospecimens are de-identified and qualify for review under Not Human Subjects Research (NHSR). This exemption allows that some public datasets do in fact, contain private, identifiable data (e.g., Wikileaks). Use of this exemption will be fairly rare.
- Part ii: Use of Information or biospecimens, which may include some identifiers, but is not readily identifiable.
The data or biospecimens obtained may contain dates (date of birth, date of graduation, date of event, etc.) and geographic locations except street address. However, if these data in combination with other factors in the dataset or when combined with other available datasets allow the identity of the participant to be ascertained, the research will not meet this Category 4 exemption criteria.
Names, email address, phone/fax number, street address, SSN, medical record number, health plan beneficiary number, account numbers, certificate or license numbers, vehicle identifiers and serial numbers, device identifiers and serial numbers, biometric identifiers (e.g., fingerprint), URLs, IP addresses, or full photographic images are not allowed under part ii of this exemption.
If your data or biospecimens contain another variable from the paragraph above that you feel does not render the data any more readily identifiable than the two variables noted above, describe the variable and provide justification for why the variable fits this criteria. The reviewer will consider this justification in their evaluation of the project.
- Part iii: Use of Information or biospecimens regulated by HIPAA
The research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under HIPAA regulations, for the purposes of health care operations, research, or public health activities and purposes (as those purposes are described in the HIPAA regulations).
- Part iv: Research conducted by or on behalf of the federal government using information generated or collected by the government for non-research purposes, when the information is subject to other regulatory protections for data confidentiality.
- FISMA
- Information covered under the Privacy Act of 1974
- Information subject to the Paperwork Reduction Act of 1995
DEFINITIONS
Secondary means the re-use of identifiable information and identifiable biospecimens that are collected from some other “primary” or “initial” activity. In other words, data that were not collected for the purpose of the specific proposed study.
Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (e.g., a medical record).
Publicly available (Part i) describes identifiable information or biospecimens that are available from public entities such as the following:
- Libraries
- Online data repositories if the only requirement for obtaining the information is paying a user fee, registering, or signing in as a visitor. If access to the data is “limited” or “restricted,” then the data set is likely not “publicly available.”
- Government or other institutional records where public access is provided on request.
- Information/biospecimens from a commercial entity available to anyone on request for a fee.
SPECIAL INFORMATION
This category is limited to the secondary use of information and biospecimens only. It does not cover any primary collection of information or biospecimens. The more common sources of this secondary data are discussed below.
Online Datasets:
- Online datasets are typically categorized as either Public or Restricted.
- Publicly available datasets often have no identifying information stored in the dataset and do not require any special effort on behalf of the investigator to obtain the data. The general public can get the data/biological specimens with minimal effort and the data are available to anyone regardless of occupation, purpose, or affiliation. These data often fit the criteria for Not Human Subjects Research.
- Restricted datasets generally require a Data Use Agreement (DUA) to be completed by the investigator.
- Your application must differentiate clearly as to whether the data are publicly available or restricted/limited use from a commercial or online source.
- The onus for documentation of the contents of the dataset and/or documentation of the applicability of it to the Category 4 exemption is the responsibility of the investigator.
National Biorepositories:
- Many national biorepositories only offer coded and deidentified specimens, and these biospecimens likely fit the criteria for Not Human Subjects Research.
- If the biospecimens are identifiable in some way, a Material Transfer Agreement (MTA) and/or DUA may be required to obtain them.
Datasets/Biospecimens Collected for Non-Research Purposes:
- As with the above, MTAs, DUAs, or other agreements may need to be in place.
- The onus for documentation of the contents of the dataset and the source is the responsibility of the investigator.
Information or Biospecimens from an IRB -approved research project (UAB or elsewhere):
- If from an existing UAB study, obtain the following documentation:
- Permission to use the data from the Principal Investigator and a description of the information/biospecimens (including any identifiable information provided).
- Documentation from the study (e.g., a copy of the consent form) that the participant allowed for the sharing of identifiable data/specimens.
- If the source study is covered via HIPAA regulations, a Waiver of HIPAA Authorization must be submitted to the OIRB.
Medical Records:
- Most simple medical record reviews will be allowable under this exemption.
- Submit a Waiver of HIPAA Authorization to the OIRB with your submission if the number of records is large enough that is not practicable to obtain authorization from each patient whose data will be used.
Category 4 - Secondary Use of Data
The Regulatory Citation and How It Applies:
Secondary research for which consent is not required: Secondary research uses of identifiable private information or identifiable biospecimens, if at least one of the following criteria is met:
- The identifiable private information or identifiable biospecimens are publicly available;
- Information, which may include information about biospecimens, is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained directly or through identifiers linked to the subjects, the investigator does not contact the subjects, and the investigator will not re-identify subjects;
- The research involves only information collection and analysis involving the investigator’s use of identifiable health information when that use is regulated under 45 CFR parts 160 and 164, subparts A and E, for the purposes of ‘‘health care operations’’ or ‘‘research’’ as those terms are defined at 45 CFR 164.501 or for ‘‘public health activities and purposes’’ as described under 45 CFR 164.512(b); or
- The research is conducted by, or on behalf of, a Federal department or agency using government-generated or government-collected information obtained for nonresearch activities, if the research generates identifiable private information that is or will be maintained on information technology that is subject to and in compliance with section 208(b) of the E-Government Act of 2002, 44 U.S.C. 3501 note, if all of the identifiable private information collected, used, or generated as part of the activity will be maintained in systems of records subject to the Privacy Act of 1974, 5 U.S.C. 552a, and, if applicable, the information used in the research was collected subject to the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.” [§46.104(d)(4)]
Secondary research uses of identifiable, private information or identifiable biospecimens for which consent is not required is exempt under this category if at least one of the following is true:
- Part i: The identifiable private information or identifiable biospecimens are publicly available.
In most cases, publicly available datasets or biospecimens are de-identified and qualify for review under Not Human Subjects Research (NHSR). This exemption allows that some public datasets do in fact, contain private, identifiable data (e.g., Wikileaks). Use of this exemption will be fairly rare.
- Part ii: Use of Information or biospecimens, which may include some identifiers, but is not readily identifiable.
The data or biospecimens obtained may contain dates (date of birth, date of graduation, date of event, etc.) and geographic locations except street address. However, if these data in combination with other factors in the dataset or when combined with other available datasets allow the identity of the participant to be ascertained, the research will not meet this Category 4 exemption criteria.
Names, email address, phone/fax number, street address, SSN, medical record number, health plan beneficiary number, account numbers, certificate or license numbers, vehicle identifiers and serial numbers, device identifiers and serial numbers, biometric identifiers (e.g., fingerprint), URLs, IP addresses, or full photographic images are not allowed under part ii of this exemption.
If your data or biospecimens contain another variable from the paragraph above that you feel does not render the data any more readily identifiable than the two variables noted above, describe the variable and provide justification for why the variable fits this criteria. The reviewer will consider this justification in their evaluation of the project.
- Part iii: Use of Information or biospecimens regulated by HIPAA
The research involves only information collection and analysis involving the investigator's use of identifiable health information when that use is regulated under HIPAA regulations, for the purposes of health care operations, research, or public health activities and purposes (as those purposes are described in the HIPAA regulations).
- Part iv: Research conducted by or on behalf of the federal government using information generated or collected by the government for non-research purposes, when the information is subject to other regulatory protections for data confidentiality.
- FISMA
- Information covered under the Privacy Act of 1974
- Information subject to the Paperwork Reduction Act of 1995
DEFINITIONS
Secondary means the re-use of identifiable information and identifiable biospecimens that are collected from some other “primary” or “initial” activity. In other words, data that were not collected for the purpose of the specific proposed study.
Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (e.g., a medical record).
Publicly available (Part i) describes identifiable information or biospecimens that are available from public entities such as the following:
- Libraries
- Online data repositories if the only requirement for obtaining the information is paying a user fee, registering, or signing in as a visitor. If access to the data is “limited” or “restricted,” then the data set is likely not “publicly available.”
- Government or other institutional records where public access is provided on request.
- Information/biospecimens from a commercial entity available to anyone on request for a fee.
SPECIAL INFORMATION
This category is limited to the secondary use of information and biospecimens only. It does not cover any primary collection of information or biospecimens. The more common sources of this secondary data are discussed below.
Online Datasets:
- Online datasets are typically categorized as either Public or Restricted.
- Publicly available datasets often have no identifying information stored in the dataset and do not require any special effort on behalf of the investigator to obtain the data. The general public can get the data/biological specimens with minimal effort and the data are available to anyone regardless of occupation, purpose, or affiliation. These data often fit the criteria for Not Human Subjects Research.
- Restricted datasets generally require a Data Use Agreement (DUA) to be completed by the investigator.
- Your application must differentiate clearly as to whether the data are publicly available or restricted/limited use from a commercial or online source.
- The onus for documentation of the contents of the dataset and/or documentation of the applicability of it to the Category 4 exemption is the responsibility of the investigator.
National Biorepositories:
- Many national biorepositories only offer coded and deidentified specimens, and these biospecimens likely fit the criteria for Not Human Subjects Research.
- If the biospecimens are identifiable in some way, a Material Transfer Agreement (MTA) and/or DUA may be required to obtain them.
Datasets/Biospecimens Collected for Non-Research Purposes:
- As with the above, MTAs, DUAs, or other agreements may need to be in place.
- The onus for documentation of the contents of the dataset and the source is the responsibility of the investigator.
Information or Biospecimens from an IRB -approved research project (UAB or elsewhere):
- If from an existing UAB study, obtain the following documentation:
- Permission to use the data from the Principal Investigator and a description of the information/biospecimens (including any identifiable information provided).
- Documentation from the study (e.g., a copy of the consent form) that the participant allowed for the sharing of identifiable data/specimens.
- If the source study is covered via HIPAA regulations, a Waiver of HIPAA Authorization must be submitted to the OIRB.
Medical Records:
- Most simple medical record reviews will be allowable under this exemption.
- Submit a Waiver of HIPAA Authorization to the OIRB with your submission if the number of records is large enough that is not practicable to obtain authorization from each patient whose data will be used.
IMPORTANT NOTE ABOUT STORAGE AND TRANSMISSION OF PROTECTED HEALTH INFORMATION (PHI) AND SPECIMENS CONTAINING PHI:
If your project falls under HIPAA regulations (either here at UAB or at another location), the storage or transmission of these data must comply with HIPAA regulations.
You must follow your covered entity’s policy on storage and transmission. Before you begin your research, find out what you are allowed to do concerning personal laptops and PCs or portable devices such as CDs or flash drives. Note some hospitals or other entities may not allow you to use these devices. The best method is to obtain your data and convert any identifiable data to another variable (e.g., dates of birth to ages, zip code to miles from home, date of admission to time in the hospital) prior to any data leaving the source’s covered entity. In other words, deal with all identifiable data while at your clinic or hospital.
The transfer of identifiable biospecimens from one entity to another will require an MTA and/or a DUA. However, if all PHI (including date of collection) is removed before transferring, these documents may not be required.
If, however, UAB faculty or staff (e.g., dissertation chair of a study that uses another institution’s PHI) will have access to identifiable data, then UAB policies on storage and transmission come into play. Any information containing PHI must be stored on a UAB server or on a UAB encrypted device. Use of personal devices that are not encrypted properly are not acceptable.
If you are in doubt as to whether your method of storage or transmission is acceptable, contact the OIRB at 934-3789.
EXAMPLES
Examples of Research Exempt Under Category 4:
Part i (Publicly Available)
- A study involving the analysis of public officials’ leaked emails currently available via Wikileaks.
Part ii (Some Identifiers)
- A UAB researcher would like to analyze an existing study’s dataset for barriers to healthcare. The research involves geocoding participants’ to the nearest dialysis center. The PI of the source study provides zip codes and kidney disease status to the investigator.
- An analysis of biospecimens from a UAB IRB-approved biorepository that contain the date of specimen collection and are accompanied by the date of birth, smoking status, and clinical data regarding cancer diagnosis. Participants in the biorepository agreed to allow for sharing of some identifiers with other researchers.
- A review of national Census data that contains zip codes.
Part ii (HIPAA data)
- A medical record review of clinical data for 20010-2018 with continued data collection yearly.
- An analysis of biospecimens from an IRB-approved biorepository.
Examples of Research NOT Exempt Under Category 4:
- A medical record review of UAB clinical data, with a follow up phone call to the participant to obtain missing information needed to conduct the analysis. This research is not eligible for Category 4 exemption as it involves direct data collection from the participant.
- Research involving the collection of an extra biopsy sample for evaluation for research purposes. This research involves direct data collection and will also require consent from the participant. Therefore this research is not allowed under Exempt Category 4.
- Evaluation of secondary, recorded data from a series of interviews with truckers and commercial drivers regarding their adherence to rest/sleep requirements while on the road. Drivers used their own names in the interviews. Although secondary in nature, this research contains identifiable data and is not regulated under HIPAA or those regulations in Part iv.
FAQs Regarding Exempt Category 4
Category 4 - If I receive Category 4 exemption for my samples obtained last year, can I amend the protocol later to get samples from this year?
YES. The revised common rule removed the requirement that all data/biospecimens to be analyzed be in existence (i.e., “on the shelf”) at the time of submission to the OIRB. Projects that were previously designated Category 4 Exempt may submit a modification to add more data, including the ongoing compilation of future data, if desired.
Category 4 - Last year, my clinic conducted a quality improvement project to improve hand washing. I would now like to evaluate that data. Will this qualify as Category 4 exemption?
YES. This data was collected for non-research purposes, and the secondary analysis of this data for research purposes would fall under one of the Category 4 parts.