# Presentation: 127164

## Use of Existing Data in VA Research: Basic Considerations

- Brenda Cuccherini, Ph.D., M.P.H.       VA  Office of Research & Development
- Joan P. Porter, D.P.A., M.P.H.            VA Office of Research Oversight
- SRA International October 17, 2005

## Terms as Defined for this Discussion 

- Research data repository:
- It is a database or a collection of databases that have been created to facilitate one or more specific research studies and/or to be stored for a specific or an indefinite period of time
- Pre-existing:
- On hand or obtainable at the time the research protocol is approved by the IRB or R&D Committee
- De-identified data definition (draft):
- meets the Common Rule definition & contains none of the 18 HIPAA identifying elements
- J

## Sources of Data for a Repository 

- VA clinical or administrative databases
- Data imported from other non-VA sources (e.g., Medicare)
- Quality assurance data
- Data from previous research projects
- Data collected specifically to populate a repository
- J

## Location of Repositories

- National VA databases, e.g., “Austin,” PBM
- VISN data warehouses
- Individual VA facilities
- Individual investigators
- Quality assurance databases
- 															                                                J

## Critical Questions

- Research?

- Stop

- Human
- subjects?

- Exempt
- from IRB
- review?

- R&D
- Committee

- IRB

- R&D
- Committee

- No

- Yes

- Yes

- No

- No

- Yes

## Issues to Consider

- OHRP Guidance
- August 17, 2004 “Guidance on Research Involving Coded Private Information or Biological Specimens”
- November 7, 1997 “Issues to Consider in the Research Use of Stored Data or Tissues”
- January 26, 1999 “Engagement of Institutions in Research”
- HIPAA
- Privacy Act of 1974

## Human Subjects Research: Which IRB?

- Determine if IRB review is required
- Is it human subjects research?
- Is it exempt from IRB review?
- Determine the responsible IRB
- Where are the investigator(s) and research staff located?
- Is that facility(ies) engaged in research?
- Does that facility(ies) have an FWA?
- Which IRB is the IRB of record?

## Which R&D Committee?

- Determine the responsible R&D Committee
- Where are the investigator(s) and research staff located?
- Is that  facility(ies)  engaged in research?
- Does that facility(ies) have a R&D Committee(s) of record?
- Determine which facilities are NOT engaged in research
- The facility where the repository/database is kept _if_ their only function is to provide the PI data
- The facilities where the data were collected unless PI or staff are located there!!!!

## Key Point 1

-    Although the data originated from human subjects, it is possible that the proposed research is not human subjects research.
- J

## Key Point 2

-    De-identified data: When the investigator receives de-identified data there is a good probability that the research would not meet the definition of human subjects research.
- J

## Key Point 3

-    A facility may become engaged in research when database/repository staff are characterized as researchers.
- J

## Key Point 4

-    Once data leave the facility to go to a database repository, they are under the control of the database repository policies.
- J

## Major Truth 1

- Coded data can be considered de-identified if:
- Data cannot be linked to the subject directly or indirectly by the investigator
- Data are stripped of identifiers per Common Rule AND HIPAA
- The key to decipher the code is destroyed or the investigator cannot get access to the key
- The investigator cannot otherwise ascertain the identify of the subject(s)
- The codes should not be based on the 18 HIPAA identifying elements, e.g., last 4 digits of SSN, initials

## Major Truth 2

-    	It is not human subjects research if the following are true: 1) the investigator receives de-identified data as defined in the VA draft policy, AND 2) the data were not collected for this project through intervention or interaction with research subjects.

## IRB vs. R&D Committee Review

- IRB conducts the primary reviews for all non-exempt human subjects research
- The chair or designee determines exemption status
- If no IRB of record, new policy may allow R&D Committee to make determination
- R&D Committee is the only review committee if:
- Research is not human subjects
- Research is exempt from IRB review
- R&D Committee must review all human subjects research & approve it AFTER the IRB approval

## Questions IRBs Should Ask 

- Are the proposed data the minimal necessary?
- What identifiers are necessary, e.g. real SSN, HIPPA “identifiers”?
- Even if coded, can the data be “re-linked” to the subject by the investigator?
- Will the data be retained for future research?
- J

## Questions IRBs Should Ask (2)

- If data were collected from previous research, is the re-use consistent with the consent under which it was collected?
- If submitted, are the requests for waiver of consent and HIPAA authorization justified and meet applicable criteria?
- Will the approvals of the waivers be documented in IRB minutes?
- J

## Questions IRBs Should Ask (3)

- If consent required for data collection, will it allow for storage & future use?
- Will the data be shared with others (VA or non-VA)?
- Will data be used to recruit subjects?
- Where will the data be stored?
- What security will be in place?
- J

## Questions the R&D Committee Might Ask If IRB Review Not Required

- Is a HIPAA waiver of authorization necessary?
- Exempt research de-identified by common rule but containing HIPAA “identifiers”
- If so, what Privacy Board will review the request for waiver?
- Many of the questions asked by the IRB
- “Normal” questions asked for all research, e.g. scientific merit, relevance, etc.

## Investigator’s Responsibilities

- Provide a well developed protocol that anticipates the IRB’s & R&D Committee’s questions
- Ensure data storage & security meets all VA requirements
- Be familiar with HIPAA and Privacy Act requirements
- Contemplate & address future uses of the data

## Facility Responsibilities 

- Adequate local policies and SOPs related to data repositories & use of data
- Training (investigator & review committee members)
- Agreements between facilities or data repository/database administrators or managers
- Oversight of the repository; not just the research

## Unresolved Issues

- Should recruitment of subjects from databases by a researcher not known to the subject/patient be allowed?
- What mechanism should be in place for IRB/R&D Committee oversight of data repositories?
- Who “owns” the data?
- J

## What Do You Think?

- Is this approach realistic?
- Does this approach protect the subjects?
- Are there other issues?
- J

## Are we protecting their right to privacy & their right to decide?