A Study of Patient-reported Outcomes in Patients With Lung or Esophageal Cancer
Conditions: Lung Cancer, Esophageal Cancer
Sponsor: University of Virginia

Title: A Study of Patient-reported Outcomes in Patients with 
Lung or Esophageal Cancer 
 
NCT #: NCT02239328 
 
Document: Study Protocol and Statistical Analysis Plan 
 
 
Date of Document:  July 31, 2014 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 1 of 29 
Version Date: 07/31/2014 
 
IRB-HSR PROTOCOL 
 
Investigator Agreement 
 
BY SIGNING THIS DOCUMENT, THE INVESTIGATOR CONFIRMS: 
1. I am not currently debarred by the US FDA from involvement in clinical research studies. 
2. I am not involved in any regulatory or misconduct litigation or investigation by the FDA. 
3. That if this study involves any funding or resources from an outside source, or if you will be 
sharing data outside of UVA prior to publication that you will contact the Dean’s office 
regarding the need for a contract and letter of indemnification.  If it is determined that 
either a contract or letter of indemnification is needed, subjects cannot be enrolled until 
these documents are complete. 
4. The proposed research project will be conducted by me or under my close supervision.  It 
will be conducted in accordance with the protocol submitted to and approved by the IRB 
including any modifications, amendments or addendums submitted and approved by the 
IRB throughout the life of the protocol.  
5. That no personnel will be allowed to work on this protocol until they have completed the 
IRB-HSR On-line training and the IRB-HSR has been notified. 
6. That all personnel working on this protocol will follow all IRB-HSR Policies and Procedures as 
stated on the IRB-HSR Website http://www.virginia.edu/vprgs/irb/ and on the School of 
Medicine Clinical Trials Office Website:  
http://knowledgelink.healthsystem.virginia.edu/intranet/hes/cto/sops/sop_index.cfm 
7. I will ensure that all those delegated tasks relating to this study, whether explicitly or 
implicitly, are capable through expertise, training , experience or credentialing to undertake 
those tasks.   
8. I confirm that the implications of the study have been discussed with all Departments that 
might be affected by it and have obtained their agreement for the study to take place.  
9. That no subjects will be recruited or entered under the protocol until the Investigator has 
received the signed IRB-HSR Approval form stating the protocol is open to enrollment 
10. That any materials used to recruit subjects will be approved by the IRB-HSR prior to use.  
11. That all subjects will sign a copy of the most current consent form that has a non-expired 
IRB-HSR approval stamp. 
12. That any modifications of the protocol or consent form will not be initiated without prior 
written approval from the IRB-HSR, except when necessary to eliminate immediate hazards 
to the subjects. 
13. Any significant findings that become known in the course of the research that might affect 
the willingness of subjects to enroll or to continue to take part, will be promptly reported to 
the IRB.   
14. I will report immediately to the IRB any unanticipated problems involving risk to subjects or 
to others including adverse reactions to biologics, drugs or medical devices.   

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 2 of 29 
Version Date: 07/31/2014 
15. That any serious deviation from the protocol will be reported promptly to the Board in 
writing. 
16. That any data breach will be reported to the  IRB, the UVa Corporate Compliance and 
Privacy Office , UVa Police as applicable.  
17. That the continuation status report for this protocol will be completed and returned within 
the time limit stated on the form. 
18. That the IRB-HSR office will be notified within 30 days of a change in the Principal 
Investigator or of the closure of this study. 
19. That a new PI will be assigned if the current PI will not be at UVA for an extended period of 
time.  If the current PI is leaving UVa permanently, a new PI will be assigned PRIOR to the 
departure of the current PI.  
20. All study team members will have access to the current protocol and other applicable 
documents such as the IRB-HSR Application, consent forms and Investigator Brochures. 
21. Signed consent forms and other research records will be retained in a confidential manner.  
Records will be kept at least 6 years after completion of the study.  
22. No data/specimens may be taken from UVa without a signed Material Transfer Agreement 
between OSP/SOM Grants and Contracts Office and the new institution.  Original study files 
are considered institutional records and may not be transferred to another institution. I will 
notify my department administration regarding where the originals will be kept at UVa.  The 
material transfer agreement will delineate what copies of data, health information and/or 
specimens may be taken outside of UVa.  It will also approve which HIPAA identifiers may 
be taken outside of UVa with the health information or specimens. 
23. If any member of study team leaves UVa, they are STRONGLY ENCOURAGED to use Exit 
Checklist found on IRB-HSR website at http://www.virginia.edu/provost/facultyexit.pdf. 
 
The IRB reserves the right to terminate this study at any time if, in its opinion, (1) the risks of 
further experimentation are prohibitive, or (2) the above agreement is breached. 
 
 
Investigators Experience 
Dr. Kozower (Principal Investigator) is an Associate Professor of Surgery at the University of 
Virginia. He joined the faculty in 2006 and completed his Master of Public Health degree in 
2009. Dr. Kozower is an experienced health services researcher and has received NIH funding in 
the past.  Dr. Kozower has participated as a Principal Investigatory for NCI cooperative group 
trials and investigator initiated trials.   Dr. Kozower has presented his research findings at 
multiple national meetings, published many abstracts and articles, and is the director for the 
surgical outcomes research center at UVA. 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 3 of 29 
Version Date: 07/31/2014 
 
 
Signatures 
 
Principal Investigator 
 
____________________________ 
____________________________ 
_______ 
Principal Investigator 
Principal Investigator 
Date 
Signature 
Name Printed 
 
 
The Principal Investigator signature is ONLY required if this is a new protocol, a 5 year update or 
a modification changing the Principal Investigator. 
 
 
Department Chair 
BY SIGNING THIS DOCUMENT THE DEPARTMENT CHAIR AGREES: 
1. To work with the investigator and with the board as needed, to maintain compliance 
with this agreement. 
2. That the Principal Investigator is qualified to perform this study. 
3. That the protocol is scientifically relevant and sound. 
 
___________________________ 
_______________________  
_________ 
Department Chair or Designee  
Department Chair or Designee 
Date 
Signature 
Name Printed 
 
 
The person signing as the Department Chair cannot be the Principal Investigator or a sub-
investigator on this protocol. 
The Department Chair or Designee signature is ONLY required if this is a new protocol or a 
modification changing the Principal Investigator. 
 
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 4 of 29 
Version Date: 07/31/2014 
 
Brief Summary/Abstract 
A patient-centered approach to lung cancer surveillance following resection needs to 
incorporate patient reported outcomes. The Patient Reported Outcomes Measurement 
Information System (PROMIS®) was designed to revolutionize the assessment of patient 
reported outcomes by establishing a national resource for the measurement of patient-reported 
symptoms and other health outcomes. 
The PROMIS Assessment Center, the management tool within the larger PROMIS 
system, will be used to securely store de identified data, provide automated accrual reports and 
data export for this specific study.  This study will have it’s own study specific website.  
 
Patients seen at the University of Virginia Cancer Center will be identified and invited to 
participate in an assessment of their reported outcomes over multiple domains available in 
PROMIS.  Collecting this information on lung cancer survivors may provide a robust platform to 
design a patient-centered surveillance strategy following resection. 
 
The study team hypothesizes that patient reported outcomes will vary according to the 
presence of recurrence or metastasis of lung or esophageal cancer.  The study team also 
believes including patient reported outcomes into routine post-treatment surveillance will 
improve patient satisfaction and improve outcomes. 
Background 
1. Provide the scientific background, rationale and relevance of this project.   
Lung cancer is the second most common cancer in both men and women in the United 
States.  Of the estimated 182,550 patients newly diagnosed with non-small cell lung cancer 
(NSCLC) this year, approximately 35% will present with localized disease and be eligible for 
curative resection.  For patients with limited NSCLC, surgical resection is the most effective 
method of controlling the primary tumor and provides the best opportunity for cure. The current 
standard of care is to perform a complete resection along with mediastinal lymph node 
sampling/dissection to accurately stage the patient, reduce local recurrence, and improve 
survival.  A recent analysis by our group demonstrated that the number of lung cancer 
resections has increased over the past decade, with over 45,000 lung cancer resections 
performed annually in the United States.  
Esophageal Cancer is one of the few cancers increasing in frequency in the US with 
18,170 cases estimated for 2014. Unfortunately, the majority of these patients will ultimately die 
of their disease as the 5-year survival rate for all stages combined is 17%.  The majority of 
these cancers are now adenocarcinomas of the distal esophagus and GE junction. Fortunately, 
more of these are being detected at an earlier stage when the chance of cure increases to over 
50%. We perform over 50 esophagectomies each year at UVA and the majorities are now 
performed in a multidisciplinary fashion including treatment with chemotherapy and radiation. 
 
The risk of lung and esophageal cancer recurrence varies widely from 30% to 75% and 
our group, along with others, has shown that recurrence depends upon a variety of tumor and 
patient related factors.  For those patients whose recurrences are detected early, there is a 
possibility for long-term survival following redo surgical resection, radiation therapy or 
chemotherapy.  However, the majority of patients with recurrence will not be candidates for 
curative treatment. Therefore, many patients undergo repeated surveillance testing to identify 
one patient whose survival can be meaningfully prolonged.  
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 5 of 29 
Version Date: 07/31/2014 
Therefore, the optimization of post treatment surveillance following lung or esophageal 
cancer resection is a national priority. The goal is to create a personalized decision support tool 
for lung and esophageal cancer surveillance that tailors follow-up to an individual patient. The 
decision tool incorporates risk-stratification for recurrence and survival, patient reported 
outcomes, and patient preferences to inform lung cancer survivors and their healthcare 
providers when selecting a surveillance strategy. 
 
This observational study will look to see if the PROMIS score for each patient directly 
reflects the state of their disease by using these three disease states, no recurrence, 
asymptomatic with recurrence, symptomatic with recurrence. 
Hypothesis to be Tested 
Hypothesis: Patient reported outcomes will vary according to the presence of recurrence or 
metastasis in patients with lung or esophageal cancer. 
 
Study Design: Biomedical 
1.  Will controls be used? 
No 
 
2. What is the study design?  
Observational study 
 
3. 
Does the study involve a placebo? 
No 
Human Participants 
Ages: _≥18___ 
Sex: 
_Male or Female___ 
Race: _Any___ 
 
Subjects- see below 
1.  Provide target # of subjects (at all sites) needed to complete protocol. 
400  
 
2.  Describe expected rate of screen failure/ dropouts/withdrawals from all sites.   
Expected rate of screen failures or dropouts is thought to be very low <%1 
 
3.  How many subjects will be enrolled at all sites?    
400 
 
4.  How many subjects will sign a consent form under this UVa protocol?     
400 
 
5. Provide an estimated time line for the study. 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 6 of 29 
Version Date: 07/31/2014 
50% enrollment in 6 months, 100% enrollment by end of year 1.  There will be ongoing 
analysis of the data during the conduct of this trial. 
 
Inclusion/Exclusion Criteria 
1.  List the criteria for inclusion  
• ≥18 years of age 
• Suspected or Known diagnosis of lung or esophageal cancer 
• Willing and able to complete questionnaires 
•  
2.  List the criteria for exclusion 
• Subjects unwilling to provide informed consent 
• Subjects unwilling or unable to answer the questionnaires 
3.  List any restrictions on use of other drugs or treatments. 
None 
Statistical Considerations 
1. 
Is stratification/randomization involved? 
NO 
 
2.  What are the statistical considerations for the protocol?  
  
This is an observational pilot study to obtain patient reported outcomes for lung and 
esophageal cancer. 
 
3.  Provide a justification for the sample size used in this protocol.   
The thoracic surgery and medical oncology clinics at UVa performed over 1,000 follow-up visits 
in 2012 for patients following lung and esophageal cancer resection. This pilot study will enroll 
200 patients for integration of PCOR (Patient Centered Outcomes Research) score into their 
electronic medical record.   A sample size of 150 patients is enough to detect a difference of 3.2 
points on the PROMIS scale between each of the three groups (asymptomatic without 
recurrence, asymptomatic with recurrence, and symptomatic) with 80% power at the 5% 
significance level. (i.e.: if asymptomatic without recurrence averages 56.4, asymptomatic with 
recurrence averages 53.2 and, symptomatic with recurrence averages 50). 
 
4.  What is your plan for primary variable analysis? 
This is an observational study to determine PROMIS scores at various time points. We will not 
be using repeated measures for this primary variable as each patient will only contribute one 
data point. We will calculate a mean and SD for each of the three disease states, no recurrence, 
asymptomatic with recurrence, symptomatic with recurrence. 
 
5.  What is your plan for secondary variable analysis?  
We may do some longitudinal analysis of patient reported outcomes and will then account for 
repeated measures. 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 7 of 29 
Version Date: 07/31/2014 
 
6. Have you been working with a statistician in designing this protocol? 
Yes, George Stukenborg 
 
Biomedical Research 
 
1.  What will be done in this protocol?    
Enrolled subjects will be asked to complete and on-line (web-based) survey using an 
IPad or computer during a regularly scheduled clinic visit.  This survey is estimated to 
take 10-15 min.  Most patients will only be asked to complete this survey once, but 
some patients will be asked to answer the questions a second or third time during a 
regularly scheduled clinic visit for follow up of their esophageal or lung cancer.  
 
Patients will provide their age, race, ethnicity and sex at the beginning of the survey.  
They will be provided a unique study identifier (i.e., 001, 002 etc.) and a password that 
they can used to complete the survey.  Only the patient will have access to the 
password and no HIPPA identifiers are collected in the PROMIS on-line system. A Private 
web browser will be used to access the PROMIS website for each patient, so that all web 
browsing activity is removed after each patient completes the survey.  A member of the 
research team will be responsible for closing the web based session in order to make 
sure all browsing history is erased properly.” 
 
Data will then be collected from the STS Society of Thoracic Surgeons database for 
subjects who complete the on-line survey.  The STS database is a national quality 
improvement database which the University of Virginia participates in for clinical 
purposes.  Local data from the STS database will be queried for subjects who are 
enrolled in this study to provide clinical information about the patients clinical 
condition.  The PROMIS reports and the STS data that links clinical information with the 
PROMIS data will be stored on a HIPPA compliant UVA server (surgery O: drive).  This 
data will be accessible only to members of this research team. 
 
Paper Case report forms for eligibility verification, consent process documentation and 
enrollment verification may be maintained in paper format.  Paper case reports forms 
will be stored in a limited access office and in a locked file cabinet. 
 
2. List the procedures, in bullet form, that will be done for research as stipulated in this 
protocol. 
• Enrolled subjects will be asked to complete an on-line (web-based) survey using an IPad 
or computer.  This survey is estimated to take 10-15 min.  Most patients will only be 
asked to complete this survey once, but some patients will be asked to answer the 
questions a second or third time over a maximum five year period. 
• Information to be collected from the STS Database will include: 
o Subject Name 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 8 of 29 
Version Date: 07/31/2014 
o Subject medical record number 
o Age 
o Gender 
o Race 
o Pathology, laboratory/microbiology results 
o Medications 
o Vital signs, Height, weight, other clinical parameters. 
o Perioperative Data 
o Diagnosis 
o Comorbidities 
o Surgical procedure performed 
o Date of surgery 
o Surgical approach 
o Date of Discharge 
o Cancer stage, recurrence or metastasis sites 
 
3. Will you be using data/specimens in this study that were collected previously, with the use 
of a research consent form, from another research study? 
No 
 
4.  Will any of the procedures listed in item # 2 have the potential to identify an incidental 
finding?   
Yes 
__X__This examination(s) utilizes non-standard/investigational, technique, equipment, 
etc.  It is impossible to determine the significance of such results, therefore 
abnormalities will not be shared with the subject because the meaning of the 
exam is not yet proven and is of unknown clinical benefit.   
 
5.  Do any of the procedures listed above, under question # 2, utilize any imaging procedures? 
NO 
6. Will you be using viable embryos? 
NO 
 
7. Will you be using embryonic stem cells? 
NO 
 
8.  Are any aspects of the study kept secret from the participants?   
NO 
 
9.  Is any deception used in the study?     
NO 
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 9 of 29 
Version Date: 07/31/2014 
Cancer Center Protocol Review Committee (PRC) Requirements 
1.  Designate type of study  
CHECK 
ONE 
TYPE of 
SPONSOR 
Oversight by CC 
DSMC? 
External DSMB 
Required?  
Additional 
Requirements 
X 
UVa 
Investigator 
Initiated- 
Single site at 
UVa 
No 
Not required by 
PRC. 
• Enrollment/ 
accrual 
information must 
be submitted to 
OnCore. ** 
 
 
1. 
What is the risk level of this study? 
 
Check 
One 
Risk 
Level 
Examples 
Monitoring 
Frequency by CC 
DSMC, VPR Post 
Approval 
Compliance 
Monitors 
Additional 
Requirements 
X 
PRC 
review 
not 
required 
• Epidemiology research,  
• Surveys,  
• Database protocols 
• Protocols using discarded tissue 
• Any other protocols involving 
cancer patients that do not 
have cancer focus. 
N/A – studies not 
monitored by the 
CC  DSMC 
 
 
Data and Safety Monitoring Plan 
This study has been deemed minimal risk.  Because this study poses minimal risk to the subject, 
adverse events will only be collected or recorded if a causal relationship to the study 
intervention is suspected.  If any adverse event is considered serious and unexpected, the 
event must be reported to the IRB-HSR within 7 days from the time the study team receives 
knowledge of the event.  
 
1.  Definitions 
 
1.1 How will you define adverse events (AE)? 
Do not change this answer 
An adverse event will be considered any undesirable sign, symptom or medical 
condition considered related to the intervention. Medical condition/diseases 
present before starting the intervention will be considered adverse events only if 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 10 of 29 
Version Date: 07/31/2014 
they worsen after starting the study and that worsening is considered to be 
related to the study intervention.  An adverse event is also any undesirable and 
unintended effect of research occurring in human subjects as a result of the 
collection of identifiable private information under the research.   
 
1.2 How will you define an unanticipated problem?  
Do not change this answer 
An unanticipated problem is any issue that involves increased risk(s) 
to participants or others.  This means issues or problems that cause the subject 
or others to be placed at greater risk than previously identified, even if the 
subject or others do not incur actual harm.  For example if a subject’s 
confidentiality is compromised resulting in serious negative social, legal or 
economic ramifications, an unanticipated problem would need to be reported. 
(e.g. serious loss of social status, loss of job, interpersonal conflict.)     
 
1.3 What is the definition of a protocol violation?  
Do not change this answer 
A protocol violation is defined as any change, deviation, or departure from the 
study design or procedures of a research project that is NOT approved by the IRB-
HSR prior to its initiation or implementation, OR deviation from  standard operating 
procedures, Good Clinical Practices (GCPs), federal, state or local regulations. 
Protocol violations may or may not be under the control of the study team or UVa 
staff. These protocol violations may be major or minor violations. 
Additional Information: see the IRB-HSR website at  
http://www.virginia.edu/vpr/irb/HSR_docs/Forms/Protocol_Violations_%20Enrollm
ent_Exceptions_Instructions.doc 
 
1.4 What is the definition of a data breach? 
Do not change this answer 
A data breach is defined in the HITECH Act (43 USC 17932) as an unauthorized 
acquisition, access, or use of protected health information (PHI) that compromises 
the security or privacy of such information. 
Additional Information may be found on the IRB-HSR Website: Data Breach 
 
2.  What risks are expected due to the intervention in this protocol?   
 
Expected Risks related to study 
participation 
Pick One 
There is a small risk that breaches 
of privacy and/or confidentiality 
might occur. The risk of violation 
of subject privacy and 
Occurs rarely 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 11 of 29 
Version Date: 07/31/2014 
confidentiality is minimal due to 
the requirements of the privacy 
plan in this protocol.  
 
3.  When will recording and reporting of unanticipated problems/adverse events begin? 
__X___After subject signs consent 
 
4.  When will the recording/reporting of unanticipated problems/adverse events end?  
_X____Subject completes participation in the protocol 
 
5.  What is your plan for safety monitoring?   
Do not change this answer 
Safety monitoring and aggregate review of adverse events, unanticipated problems, 
protocol violations and any data breach will be performed by the PI and IRB-HSR 
through continuation review at least annually.   
 
6.  What is your plan for reporting a Unanticipated Problem, Protocol Violation or Data 
Breach?  
Do not change this answer 
 
Type of Event 
To whom will it 
be reported: 
Time Frame for 
Reporting 
How reported? 
Unanticipated Problems that
are not adverse events or 
protocol violations  
This would include a Data 
Breach.   
IRB-HSR 
 
 
Within 7 calendar 
days from the time 
the study team 
received knowledge 
of the event.  
Unanticipated Problem report 
form.  
 
http://www.virginia.edu/v
prgs/irb/HSR_docs/Forms/
Reporting_Requirements-
Unanticipated_Problems.d
oc ) 
Protocol Violations 
 (The IRB-HSR only requires 
that MAJOR violation be 
reported, unless otherwise 
required by your sponsor, if 
applicable.) 
 
OR 
 
Enrollment Exceptions 
IRB-HSR 
 
 
Within 7 calendar 
days from the time 
the study team 
received knowledge 
of the event.  
 
Protocol Violation and 
Enrollment Exception Reporting 
Form 
 
http://www.virginia.edu/v
prgs/irb/hsr_forms.html 
 
Go to 3rd bullet from the 
bottom. 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 12 of 29 
Version Date: 07/31/2014 
Data Breach of Protected 
Health Information  
 
The UVa 
Corporate 
Compliance and 
Privacy Office 
 
 
ITC:  if breach 
involves  
electronic data  
 
 
 
 
UVa Police if 
breach includes 
items that are 
stolen  
As soon as possible 
and no later than 24 
hours from the time 
the incident is 
identified. 
 
As soon as possible 
and no later than 24 
hours from the time 
the incident is 
identified. 
 
 
IMMEDIATELY.  
 
UVa Corporate Compliance and 
Privacy Office- Phone 924-9741 
 
 
 
 
ITC:  Information Security 
Incident Reporting 
procedure,  
http://www.itc.virginia.ed
u/security/reporting.html 
 
Police: phone- (434) 924-7166 
 
Risk/ Benefit Analysis 
1.  What are the potential benefits for the participant as well as benefits which may accrue to 
society in general, as a result of this study? 
There are no expected direct benefits for individual participants in this study.  However, future 
patients with lung or esophageal cancer may benefit as a result of information learned in this 
research.  The risks in this study are considered minimal and related to risk to privacy and 
confidentiality.  The risks are minimized by the privacy plan outlined in this study.  The risks are 
outweighed by the potential benefits this could bring.  We believe if this study shows a 
correlation between patient reported outcomes and their clinical presentation, this could 
potentially play a role in the development of patient specific cancer surveillance tools.  
 
2.  Do the anticipated benefits justify asking subjects to undertake the risks?   
The potential benefits to cancer surveillance do justify the minimal risk this study poses. 
Bibliography 
 
1. Siegel R, Naishadham D, Jemal A. Cancer statistics, 2013. CA Cancer J Clin 
2013;63:11-30. 
2. Cancer Facts & Figures. 2013. (Accessed July 26, 2013, at 
http://www.cancer.org/research/cancerfactsstatistics/index.) 
3. Colt HG, Murgu SD, Korst RJ, Slatore CG, Unger M, Quadrelli S. Follow-up and 
Surveillance of the Patient With Lung Cancer After Curative-Intent Therapy: 
Diagnosis and Management of Lung Cancer, 3rd ed: American College of Chest 
Physicians Evidence-Based Clinical Practice Guidelines. Chest 2013;143:e437S-
54S. 
4. Darling GE, Allen MS, Decker PA, Ballman K, Malthaner RA, Inculet RI, Jones DR, 
McKenna RJ, Landreneau RJ, Rusch VW, Putnam JB. Randomized trial of 
mediastinal lymph node sampling versus complete lymphadenectomy during 
pulmonary resection in the patient with N0 or N1 (less than hilar) non-small cell 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 13 of 29 
Version Date: 07/31/2014 
carcinoma: results of the American College of Surgery Oncology Group Z0030 Trial. 
J Thorac Cardiovasc Surg 2011;141:662-70. 
5. Ginsberg RJ, Rubinstein LV. Randomized trial of lobectomy versus limited resection 
for T1 N0 non-small cell lung cancer. Lung Cancer Study Group.see comment. Ann 
Thorac Surg 1995;60:615-22. 
6. LaPar DJ, Bhamidipati CM, Lau CL, Jones DR, Kozower BD. The Society of 
Thoracic Surgeons General Thoracic Surgery Database: establishing generalizability 
to national lung cancer resection outcomes. Ann Thorac Surg 2012;94:216-21; 
discussion 21 
7. 14. Sugimura H, Nichols FC, Yang P. Survival after recurrent nonsmall-cell lung 
cancer after complete pulmonary resection. Ann Thorac Surg 2007;83:409-17; 
discussioin 17-8. 
8. 15. Taylor MD, Nagji AS, Kozower BD, Lau CL, Jones DR. Tumor recurrence after 
complete resection for non-small cell lung cancer. Ann Thorac Surg 2012;93:1813-
20; discussion 20-1 
9. 21. Colice GL, Rubins J, Unger M, American College of Chest P. Follow-up and 
surveillance of the lung cancer patient following curative-intent therapy. Chest 
2003;123:272S-83S 
APPENDIX:  Legal/Regulatory 
Recruitment 
The following procedures will be followed: 
• Finders fees will not be paid to an individual as they are not allowed by UVa Policy. 
• All recruitment materials will be approved by the IRB-HSR prior to use.  They will be 
submitted to the IRB after the IRB-HSR has assigned an IRB-HSR # to the protocol. 
• Only those individuals listed as personnel on this protocol will recruit and or conduct 
the consenting process with potential subjects.  
 
Retention Incentives 
Any item used by the sponsor/ study team to provide incentive to a subject to remain in the 
study, other than compensation identified in the Payment section, will be submitted to the IRB 
for review prior to use.  The IRB-HSR will provide the study team with a Receipt 
Acknowledgement for their records.  Retention incentive items are such things as water bottles, 
small tote bags, birthday cards etc.  Cash and gift cards are not allowed as retention incentives.  
 
Clinical Privileges 
The following procedures will be followed:  
• Investigators who are members of the clinical staff at the University of Virginia Medical 
Center must have the appropriate credentials and been granted clinical privileges to 
perform specific clinical procedures whether those procedures are experimental or 
standard.  
• The IRB cannot grant clinical privileges.   
• Performing procedures which are outside the scope of the clinical privileges that have 
been granted may result in denial of insurance coverage should claims of negligence or 
malpractice arise. 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 14 of 29 
Version Date: 07/31/2014 
• Personnel on this protocol will have the appropriate credentials and clinical privileges in 
place before performing any procedures required by this protocol.  
• Contact the Clinical Staff Office- 924-9055 or 924-8778 for further information. 
 
Sharing of Data/Specimens 
Data and specimens collected under an IRB approved protocol are the property of the 
University of Virginia.  You must have “permission” to share data/ specimens outside of UVa 
other than for a grant application and or publication.  This “permission” may come in the form 
of a contract with the sponsor or a material transfer agreement (MTA) with others.  A contract/ 
MTA is needed to share the data outside of UVa even if the data includes no HIPAA identifiers 
and no code that could link the data back to a HIPAA identifier.   
• No data will be shared outside of UVa, beyond using data for a grant application and or 
publication, without a signed contract/MTA approved by the SOM Grants and Contracts 
office/ OSP or written confirmation that one is not needed. 
• No specimens will be shared outside of UVa without a signed contract/MTA approved 
by the SOM Grants and Contracts office/ OSP or written confirmation that one is not 
needed. 
 
Prisoners 
If the original protocol/ IRB application stated that no prisoners would be enrolled in this study 
and subsequently a subject becomes a prisoner, the study team must notify the IRB 
immediately.  The study team and IRB will need to determine if the subject will remain in the 
study.  If the subject will remain in the study, the protocol will have to be re-reviewed with the 
input of a prisoner advocate.  The prisoner advocate will also have to be involved in the review 
of future continuations, modifications or any other reporting such as protocol violations or 
adverse events.   
 
Prisoner- Individuals are prisoners if they are in any kind of penal institution, such as a prison, 
jail, or juvenile offender facility, and their ability to leave the institution is restricted. Prisoners 
may be convicted felons, or may be untried persons who are detained pending judicial action, 
for example, arraignment or trial. 
For additional information see the OHRP website at  
http://www.hhs.gov/ohrp/policy/populations/index.html 
 
Compensation in Case of Injury  
If a subject requests compensation for an injury, the study team should notify the IRB-HSR (924-
9634/2439847) the UVa Health System Patient Relations Department (924-8315).  As a 
proactive courtesy, the study team may also notify UVa Health System Patient Safety and Risk 
Management (924-5595). 
 
On request, the study team should provide the Risk Management Office with the following 
information/documents: 
• Subject Name and Medical Record Number 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 15 of 29 
Version Date: 07/31/2014 
• Research medical records 
• Research consent form 
• Adverse event report to IRB 
• Any letter from IRB to OHRP 
 
Subject Complaints  
During a research study, the study team may receive complaints from a subject.  If the study 
team is uncertain how to respond to a complaint, or is unable to resolve it with the subject, the 
study team may contact the IRB-HSR (924-9634/243-9847), the UVa Health System Patient 
Relations Department (924-8315). 
 
Request for Research Records from Search Warrant or Subpoena 
If the study team receives a request for research records from a search warrant or subpoena, 
they should notify UVa Health Information Services at 924-5136. It is important to notify them if 
information from the study is protected by a Certificate of Confidentiality.   
 
APPENDIX:  Recruitment 
Recruitment includes identifying, review of records to determine eligibility or any contact to 
determine a potential subjects interest in the study. 
 
*The UVa HIPAA covered entity is composed of the  UVa VP Office of Research, the Health 
System, School of Medicine, School of Nursing, Nutrition Services (Morrison’s), the Sheila C. 
Johnson Center, the Exercise and Sports Injury Laboratory and the Exercise Physiology 
Laboratory.   
 
1. How do you plan to identify potential subjects? 
• To "identify" a potential subject refers to steps you plan to take to determine 
which individuals would qualify to participate in your study. This does NOT 
include steps to actually contact those individuals. 
• If your study involves more than one group of subjects (e.g. controls and cases or 
subjects and caregivers) note below which groups are being identified by the 
given method.  
• Check the methods you plan to utilize: 
 
a. __X__ Chart Review/ Clinic Schedule Review/ Database Review from a 
database established for health care operations (departmental clinical 
database) or quality improvement. 
 
DHHS: Study team requests Waiver of Consent to identify potential 
subjects.  
 
HIPAA: Allowed under Preparatory to Research if PHI to be accessed.  

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 16 of 29 
Version Date: 07/31/2014 
 
IMPORTANT 
Keep in mind that PHI in the medical record may only be accessed by 
individuals who work under the UVa HIPAA covered entity; which means 
they meet one of the following criteria: 
--a UVa student working in the UVa HIPAA Covered Entity*   
--a faculty or staff member in a PAID appointment in the UVA HIPAA 
Covered Entity* 
 
b. ____ Review of a database that was established to keep data to be used 
for future research such as the CDR, departmental research database or 
use of data from a separate current active research protocol.     
DHHS: Study team requests Waiver of Consent to identify potential 
subjects. 
 
HIPAA: Allowed under Preparatory to Research if PHI to be accessed.  
 
IMPORTANT 
Keep in mind that PHI in the medical record may only be accessed by 
individuals who work under the UVa HIPAA covered entity; which means 
they who meet one of the following criteria: 
--a UVa student working in the UVa HIPAA Covered Entity*   
--a faculty or staff member in a PAID appointment in the UVA HIPAA 
Covered Entity* 
 
The information from which you are obtaining potential subjects must 
also have an IRB protocol approval.  If this item is checked, enter the IRB 
# below.  
 
IRB# ________________ 
If obtaining information from the Clinical Data Repository (CDR) insert IRB 
# 10797 
 
c. ____ Patients UVa health care provider supplies the UVa study team with 
the patients contact information without patients knowledge OR  / 
potential subject is a patient at UVa and will be identified by their health 
care provider during an appointment at UVa Medical Center.  
 
DHHS: Study team requests Waiver of Consent to identify potential 
subjects.  
 
HIPAA: Allowed under Preparatory to Research if PHI will be shared by 
the health care provider.  

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 17 of 29 
Version Date: 07/31/2014 
 
IMPORTANT 
Keep in mind that PHI may only be given to individuals who work under 
the UVa HIPAA covered entity; which means they meet one of the 
following criteria: 
--a UVa student working in the UVa HIPAA Covered Entity*   
--a faculty or staff member in a PAID appointment in the UVA HIPAA 
Covered Entity* 
 
d. ____ Patient obtains information about the study from their health care 
provider.  The patient contacts the study team if interested in 
participating.  
DHHS:  NA 
HIPAA:  Allowed under Health Care Operations 
 
If this choice is checked, check 3d-INDIRECT CONTACT below.  
 
e. ____ Potential subjects will not be directly identified. They will respond 
to an advertisement such as a flyer, brochure etc.   
If this choice is checked, check 3d- INDIRECT CONTACT below.  
DHHS & HIPAA:  NA 
 
f. _____ Potential subjects have previously signed a consent to have their 
name in a registry/database to be contacted for future studies of this 
type.   
IRB# of registry/ database:  ________________ 
DHHS & HIPAA:  NA 
 
g. ____ Other: Specify   Answer/Response: 
 
 
If item # a, b or c is checked above and if this protocol involves the use of 
protected health information do you confirm the following to be true? 
• The use or disclosure is sought solely to review protected health 
information as necessary to prepare the research protocol or other 
similar preparatory purposes. 
• No PHI will be removed from the UVa covered entity. 
• The PHI that the researcher seeks to use or access is necessary for the 
research purposes. 
YES 
 
2. How will potential subjects be contacted? 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 18 of 29 
Version Date: 07/31/2014 
To "contact" a potential subjects refers to the initial contact you plan to take to 
reach a potential subject to determine if they would be interested in participating in 
your study.  This may include direct contact by such methods as by letter, phone, 
email or in-person or indirect contact such as the use of flyers, radio ads etc.  
 
If your study involves more than one group of subjects (e.g. controls and cases or 
subjects and caregivers) note below which groups are being contacted by the given 
method.    
 
Check the methods below you plan to utilize: 
a.____Direct contact of potential subjects by the study team via letter, 
phone, direct e-mail. Members of study team ARE NOT health care 
providers of patients.  Information will not be collected from 
psychotherapy notes.  
Note:  Letter, phone, direct email scripts must be approved by IRB 
prior to use.  See IRB-HSR Website for templates. 
 
DHHS/HIPAA: Study team requests a Waiver of Consent and 
Waiver of HIPAA Authorization to contact potential subjects.  
 
IMPORTANT:   
Keep in mind that if PHI was collected during the identification 
phase that contact with potential subjects may only be performed 
by individuals who work under the UVa HIPAA covered entity; 
which means they meet one of the following criteria: 
 a UVa student working in the UVa HIPAA Covered Entity*   
 a faculty  or staff member in a PAID appointment in  the UVA 
HIPAA Covered Entity* 
 
b.____Potential subjects will be approached while at UVa Hospital or 
Health Clinic by a person who is NOT a member of their health care team.  
Information will not be collected from psychotherapy notes.  
DHHS & HIPAA: Study team requests a Waiver of Consent and a Waiver of 
HIPAA Authorization to contact potential subjects.  
 
IMPORTANT:   
Keep in mind that contacting individuals in a clinical setting may only be 
performed by individuals who work under the UVa HIPAA covered entity; 
which means they  meet one of the following criteria: 
a UVa student working in the UVa HIPAA Covered Entity*   

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 19 of 29 
Version Date: 07/31/2014 
A faculty or staff member in a PAID appointment in the UVA HIPAA 
Covered Entity* 
 
You should share the following information with the potential subject:  
• Your name 
• Who you are:  physician, nurse etc. at the University of Virginia.    
• Why you want to speak with them 
• Ask if you have their permission to explain the study to them 
• If asked about how you obtained their information use one of the 
following as an option for response.     
• DO NOT USE THIS RESPONSE UNLESS YOU HAVE OBTAINED 
PERMISSION FROM THEIR UVa PHYSICIAN:   
• Your doctor, Dr. insert name wanted you to be aware of this 
research study and gave us permission to contact you.    
• We obtained your information from your medical records at UVa.   
• Federal regulations allow the UVa Health System to release your 
information to researchers at UVa, so that we may contact you 
regarding studies you may be interested in participating.  We 
want to assure you that we will keep your information 
confidential.  
• IF THE PERSON SEEMS ANGRY, HESITANT OR UPSET, THANK THEM 
FOR THEIR TIME AND DO NOT ENROLL THEM IN THE STUDY.  YOU 
MAY ALSO REFER THEM TO THE IRB-HSR AT 924-9634. 
 
c.__X__Direct contact of potential subjects by the study team by 
approaching in person at UVa or via letter, phone, direct e-mail. 
Members of study team contacting potential subjects ARE health care 
providers of patients.  
If you are not approaching them in person but using a letter, phone call 
or direct email please note that the letter, phone, direct email scripts 
must be approved by IRB prior to use.   
See IRB-HSR Website for templates. 
 
DHHS:  Study team requests a Waiver of Consent to contact potential 
subjects 
HIPAA:  Allowed under Health Care Operations.  
 
d.____ Indirect contact (flyer, brochure, TV, broadcast emails, patient 
provided info about the study from their health care provider and either 
the patient contacts study team or gives their healthcare provider 
permission for the study team to contact them.) 
The indirect method used (flyer, brochure, TV, broadcast emails) must be 
approved by the IRB prior to use.    The IRB does not need to review any 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 20 of 29 
Version Date: 07/31/2014 
type of script to use when the potential subject responds to the indirect 
method.   
 
DHHS & HIPAA:  NA 
 
 
e. ____  Potential subjects are not patients.  The study does not include 
obtaining subjects health information.   Subjects will be contacted 
directly via email, phone, letter or presentation in group setting with 
consent then obtained individually in a private setting.  
If you are not approaching them in person but using a letter, phone 
call or direct email please note that the letter, phone, direct email 
scripts must be approved by IRB prior to use.   
See IRB-HSR Website for templates. 
 
DHHS: Study team requests a Waiver of Consent to contact potential 
subjects.  
HIPPA:  NA 
 
3. Will any additional information be obtained from a potential subject during 
"prescreening"?   
NO 
 
4. Do you plan to ask the subjects to do anything, other than answering questions, 
for the study prior to signing a consent?  
NO 
 
5. How will the consenting process take place with either the prospective subject, the 
subject’s legally authorized representative or parent/legal guardian of a minor ( if 
applicable)?    
Subjects will be approached at UVA about participation in this study.  A member of 
the study team will review the informed consent with the subject, and facilitate a 
discussion of the study procedures, risks/benefits, and alternatives.  Subjects will 
be told that their participation is voluntary – and they do not have to participate in 
this study.  Subjects will also be informed that their decision to participate or not 
participate will not influence the medical care they receive at UVA.   
 
Subjects will be given the opportunity to take the consent home for consideration 
if they desire, and questions will be answered.  The physician investigator will be 
available to address questions; however consent will be primarily obtained by the 
study coordinators.  Subjects who wish to participate will be asked to sign the 
consent form prior to any data being collected.  A copy of the signed consent form 
will be given to the subject. 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 21 of 29 
Version Date: 07/31/2014 
 
6. Will subjects sign a consent form for any part of the study?  
yes 
 
7.  Will the study procedures be started the same day the subject is recruited for the 
study?  
Subjects will be recruited in the thoracic surgery clinic during routine visits.  
Subjects may be asked to complete the questionnaires/survey on the same day as 
they are signing informed consent, however, will be given the option of 
completing the baseline questionnaires at a later date as time permits.   
 
►IF YES, explain in detail why the subject cannot be given more time to make 
a decision to consent.  
Subjects will be given adequate time to consider participation in this 
observational study.  Subjects will be given the opportunity to take the consent 
home and consider participation at a later date.   
 
►IF YES, explain in detail what will be done to assure the potential subject has 
enough time to make an informed decision. 
Study team members will emphasize to subjects that participation in this 
observational study is voluntary and that they do not have to participate in order 
to receive care for their condition.  Subjects will be given time to read the consent 
and ask questions, and will not be asked to sign the consent until their questions 
have been answered. 
 
8.  Is there the potential to recruit economically or educationally disadvantaged 
subjects, or other vulnerable subjects such as students or employees? 
Yes 
 
IF YES, what protections are in place to protect the rights and welfare of these 
subjects so that any possible coercion or undue influence is eliminated?   
Study team members will emphasize to subjects that participation in this 
observational study is voluntary and that they do not have to participate in order 
to receive care for their condition and their jobs or grades will not be affected as 
stated in the consent form. 
 
9. Do you need to perform a “dry run” of any procedure outlined in this protocol?    
No 
APPENDIX:  Privacy Plan for Studies With Consent 
1. Answer the questions below (1a-1f) to describe the plan to protect the identifiable data from 
improper use and disclosure.   
 
1a.  How will data be collected?  
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 22 of 29 
Version Date: 07/31/2014 
2.__X___ Collection of data via web-based format (e.g. online consent/online surveys, 
online CRF's)  
 
4.__X__   Directly to a Health Systems Computing Services (HS/CS) managed server that 
is configured to store data regulated by HIPAA. 
 
7.___X Paper  
 
►If you checked item 1.2 or 3 will the data include any of the HIPAA identifiers listed 
below?  ANWER QUESTION IN TABLE BELOW  
 
HIPAA Identifiers 
YES 
NO 
HIPAA Identifier  
X 
 
1.  Name 
X 
 
2.Postal address information, other than town or city, state, and zip code 
X 
 
3.  Telephone numbers 
 
 
4.  Fax numbers 
 
 
5.  Electronic mail addresses 
 
 
6.  Social Security number 
X 
 
7.  Medical Record number 
 
 
8.  Health plan beneficiary numbers 
 
 
9.  Account numbers 
 
 
10.  Certificate/license numbers 
 
 
11.  Vehicle identifiers and serial numbers, including license plate numbers 
 
 
12.  Device identifiers and serial numbers 
 
 
13  Web Universal Resource Locators (URLs) 
 
 
14.  Internet Protocol (IP) address numbers 
 
 
15.  Biometric identifiers, including finger and voice prints 
 
 
16.  Full face photographic images and any comparable images  
 
 
17.  Any other unique identifying number, characteristic, code that is derived from or 
related to information about the individual (e.g. initials, last 4 digits of Social Security #, 
mother’s maiden name, first 3 letters of last name.) 
 
 
18.  Any other information that could be used alone or in combination with other 
information to identify an individual. 
 
1b. How will data be stored? 
___X__   Data, which may include health information, or other highly sensitive data will be 
stored with HIPAA identifiers.   
 
_____   Data, which may include health information, or other highly sensitive data will NOT be 
stored with any HIPAA identifier except date(s).  This means: 
• Documents such as case report forms will have NO HIPAA identifiers except dates (e.g. 
no initials or medical record #) 
• HIPAA identifiers, except dates will be stored in a different place than the health 
information/specimens.  A code such as subject # 1 will be used to link the identity of 
the individual (HIPAA identifiers) with the persons health information. 
1c. Will specimens be stored by the UVa study team? 
N/A 
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 23 of 29 
Version Date: 07/31/2014 
1d.  Will any of the data be stored electronically? 
Yes 
 
►IF YES, will it include storage of any health information or other sensitive data?   
Yes 
 
►IF YES, will the data include any of the HIPAA identifiers listed below?   
ANWER QUESTION IN TABLE BELOW  
HIPAA Identifiers 
YES 
NO 
HIPAA Identifier  
X 
 
1.  Name 
X 
 
2.Postal address information, other than town or city, state, and zip code 
X 
 
3.  Telephone numbers 
 
 
4.  Fax numbers 
 
 
5.  Electronic mail addresses 
 
 
6.  Social Security number 
X 
 
7.  Medical Record number 
 
 
8.  Health plan beneficiary numbers 
 
 
9.  Account numbers 
 
 
10.  Certificate/license numbers 
 
 
11.  Vehicle identifiers and serial numbers, including license plate numbers 
 
 
12.  Device identifiers and serial numbers 
 
 
13  Web Universal Resource Locators (URLs) 
 
 
14.  Internet Protocol (IP) address numbers 
 
 
15.  Biometric identifiers, including finger and voice prints 
 
 
16.  Full face photographic images and any comparable images  
 
 
17.  Any other unique identifying number, characteristic, code that is derived 
from or related to information about the individual (e.g. initials, last 4 digits of 
Social Security #, mother’s maiden name, first 3 letters of last name.) 
 
 
18.  Any other information that could be used alone or in combination with 
other information to identify an individual. 
(e.g. rare disease, study team or company has access to the health information 
and a HIPAA identifier or the key to the code) 
 
1e.  If you answered YES to any HIPAA identifier above, where will the data be stored?  
___X__   a Health Systems Computing Services (HS/CS) managed server that is 
configured to store data regulated by HIPAA. 
1f. Will any of the data be collected or stored in hard copy format by the UVa study team?   
 
 
Yes 
 
►IF YES, where will it be stored?  
 
___X__  case report forms will be stored in a secure area with limited access.  
 
1g.  The following procedures will also be followed.  
• Only investigators for this study and clinicians caring for the patient will have access 
to the data.  They will each use a unique log-in ID and password that will keep 
confidential.  

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 24 of 29 
Version Date: 07/31/2014 
• Each investigator will sign the University’s Electronic Access Agreement forward the 
signed agreement to the appropriate department as instructed on the form. 
If you currently have access to clinical data it is likely that you have already signed 
this form.  You are not required to sign it again.  
• UVa University  Data Protection Standards will be followed 
http://itc.virginia.edu/security/dataprotection.   
• If identifiable data is transferred to any other location such as a desktop, laptop, 
memory stick, CD etc. the researcher must follow the University’s  “Electronic 
Storage of Highly Sensitive Data Policy”. Additional requirements may be found in 
the Universities Requirements for Securing Electronic Devices.  
• If identifiable health information is taken away from the UVa Health System, Medical 
Center Policy # 0218 will be followed.  
• The data will be securely removed from the server, additional computer(s), and 
electronic media according to the University's Electronic Data Removal Policy.  
• The data will be encrypted or removed if the electronic device is sent outside of UVa 
for repair according to the University's Electronic Data Removal Policy. 
• If PHI will be faxed, researchers will follow the Health System Policy # 0194.     
• If PHI will be emailed, researchers will follow the Health System Policy # 0193 and 
UVa Institutional Data Protection Standards . 
• The data may not be analyzed for any other study without additional IRB approval.  
• If you are using patient information you must follow Health System Policy  # 0021. 
 
Summary of Requirements to Comply with UVa Health System, Medical Center and University 
Policies and Guidance as noted above: 
 
Highly Sensitive Data is: 
-personal information that can lead to identify theft if exposed or 
-health information that reveals an individual’s health condition and/or history of health 
services use.  
 
Protected Health Information (PHI) a type of Sensitive Data, is health information combined 
with a HIPAA identifier  
 
Identifiable Health Information under HIPAA regulations is considered to be Highly Sensitive 
Data 
 
A Limited Data Set (LDS) under HIPAA regulations is considered to be Moderately Sensitive 
Data. The only HIPAA identifiers associated with data: full dates and or postal address 
information including town or city, state, and zip code 
 
De-identified or Anonymous data is considered to be NOT Sensitive Data 
 
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 25 of 29 
Version Date: 07/31/2014 
Summary Table 
Highly Sensitive Data 
(Identifiable Health Info per HIPAA )  
Moderately Sensitive Data  
(Limited Data Set per HIPAA)  
General Issues  
General Issues 
Discussions in private 
Do not share with those not on the study team 
or those who do not have a need to know. 
 
Do not share with those not on the study team 
or those who do not have a need to know 
Password protect  
Password protect 
Physically secure, do not leave unattended,  
turn off File Sharing; turn on firewalls; use up 
to date antivirus and antispyware; delete data 
securely  
Physically secure, turn off File Sharing; turn 
on firewalls; use up to date antivirus and 
antispyware; delete data securely 
Encrypt 
See encryption solutions guidance.  
Files on Health System Network drives are 
automatically encrypted.  If not stored there it 
is study teams responsibility to make sure data 
is encrypted.  
 
If device sent out for repair, encrypt  or 
remove data 
If device sent out for repair,  encrypt or 
remove data 
Store files on a network drive specifically 
designated for storing this type of data, e.g. 
high-level security servers managed by 
Information Technology Services or the “F” 
and “O” managed by Heath Systems 
Computing Services.  You may access it via a 
shortcut icon on your desktop, but you are not 
allowed to take it off line to a local drive such 
as the desktop of your computer (e.g. C drive) 
or to a Single Use Device*. 
 
May access via VPN 
 
Do not share with sponsor or other outside 
group before consent is obtained or the IRB 
has granted appropriate approvals and 
contract/ MTA is in place  
Do not share with sponsor or other outside 
group before consent is obtained or the IRB 
has granted appropriate approvals and 
contract/ MTA is in place 
If collected without consent/ HIPAA 
authorization will NOT be allowed to leave 
UVa HIPAA covered entity unless disclosure is 
approved by the IRB and the disclosure is 
tracked in EPIC  
If collected without consent/ HIPAA 
authorization will NOT be allowed to leave 
UVa HIPAA covered entity unless disclosure is 
approved by the IRB and an MTA is in place 
prior to sharing of data 
 
Single Use Device  
Single Use Device 
Do not save to single use device* without 
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 26 of 29 
Version Date: 07/31/2014 
written approval of your Department AND VP 
or Dean.   
If approval obtained, data must be password 
protected and encrypted. 
Do not save an email attachment containing 
HSD to a single use device ( e.g. smart phone)  
 
E Mail 
E Mail 
Do not share via email with Outlook Web/ or 
forward email using other email vendors like 
Gmail/ Yahoo  
 
Do not send via email on smart phone unless 
phone is set up by Health System  
 
Email may include name, medical record 
number or Social Security number only if 
sending email to or from a person with * HS in 
their email address. 
NOTE: VPR& IRB staff do not meet this criteria!  
In addition to sharing LDS, may include 
initials if persons sending and receiving email 
work within the UVa HIPAA covered entity.** 
FAX 
FAX 
Verify FAX number before faxing 
Verify FAX number before faxing 
Use Fax Cover Sheet with Confidentiality 
Statement 
Use Fax Cover Sheet with Confidentiality 
Statement 
Verify receiving fax machine is in a restricted 
access area 
Verify receiving fax machine is in a restricted 
access area 
Verify intended recipient is clearly indicated 
Verify intended recipient is clearly indicated 
Recipient is alerted to the pending 
transmission and is available to pick it up 
immediately 
Recipient is alerted to the pending 
transmission and is available to pick it up 
immediately 
Electronic Data Collection & Sharing 
Electronic Data Collection & Sharing 
(e.g. online case report forms, smart phone 
app, electronic consent using tablet etc.) 
 
MUST consult with ISPRO or Health System 
Web Development Office  
University Side:    vams@virginia.edu  
Health System: Web Development Center:  
434-243-6702 
Contract must include required security 
measures.  
 
May NOT be stored in places like Drop Box, 
UVa Box, Colab.  
May be stored in places like Drop Box, UVa 
Box, Colab. 
LOST OR STOLEN:  
LOST OR STOLEN: 
Must report in accordance with protocol/ in 
accordance with the Information Security 
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 27 of 29 
Version Date: 07/31/2014 
Incident Reporting Policy 
 
*  Single Use Device – examples include smart phone, CD, flash drive, laptop, C drive of your 
computer,  
 
**The UVa HIPAA covered entity is composed of the UVa VP Office of Research, the Health 
System, School of Medicine, School of Nursing, Nutrition Services (Morrison’s), the Sheila C. 
Johnson Center, the Exercise and Sports Injury Laboratory and the Exercise Physiology 
Laboratory.   
 
2.  Describe your/central registry’s plan to destroy the HIPAA identifiers at the earliest opportunity 
consistent with the conduct of the research and in accordance with any stipulations in the research 
sponsor contract and UVa records management guidelines. 
 
___X__The HIPAA identifiers (except full dates and or address information if needed) will be 
destroyed as soon as all publications are complete.  
This wording would allow the researcher to keep HIPAA identifiers until all queries/ request for 
additional information from publisher are addressed. 
 
3.  Do you confirm that you will not reuse the identifiable data (HIPAA identifiers or health 
information) or disclose any of this information to any other person or entity except as outlined in 
this protocol, except as required by law, for authorized oversight of the research study, or use it for 
other research unless approved by the IRB-HSR?   
Yes 
 
This means that after the study is closed at UVa: 
 
• You cannot contact the subject by any method (you cannot call them, send a letter, talk to 
them in person about the study, etc.) without additional IRB approval 
• You cannot use the data for any research that is not already described in your IRB protocol 
without additional IRB approval (if you change your hypothesis you must modify your 
protocol)  
• You cannot share your research data with another researcher outside of your study team 
without additional IRB approval 
• Any health information with HIPAA identifiers will be shredded or discarded by using 
recycling bins for confidential material found in clinic settings.  For large item disposal of 
confidential material contact Environmental Services at 2-4976 or University Recycling at 2-
5050.  
 
TABLE A:  HIPAA Identifiers (Limited Data Set)  
1.  Name 
2.  Postal address information, other than town or city, state, and zip code 
3.  Telephone numbers 
4  Fax numbers 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 28 of 29 
Version Date: 07/31/2014 
5.  Electronic mail addresses 
6.  Social Security number 
7.  Medical Record number 
8.  Health plan beneficiary numbers 
9.  Account numbers 
10.  Certificate/license numbers 
11.  Vehicle identifiers and serial numbers, including license plate numbers 
12.  Device identifiers and serial numbers 
13.  Web Universal Resource Locators (URLs) 
14.  Internet Protocol (IP) address numbers 
15.  Biometric identifiers, including finger and voice prints 
16.  Full face photographic images and any comparable images  
17.  Any other unique identifying number, characteristic, code that is derived 
from or related to information about the individual (e.g. initials, last 4 digits of 
Social Security #, mother’s maiden name, first 3 letters of last name.) 
 
 
 
APPENDIX:  Sponsor 
Sponsor Information 
1. Explain the sponsorship for this study.  
This study is funded via a contract with ALLIANCE (cooperative group for clinical trials), 
which has a grant from PCORI to conduct this study.   
 
Do you confirm that you will obtain a contract/ material transfer agreement with the 
sponsor via the School of Medicine Grants and Contracts Office or the Office of 
Sponsored Programs (OSP) ospnoa@virginia.edu? Yes 
 
 
APPENDIX:  Transfer of Data Outside of UVa 
1. Will any data be sent outside of UVa to any person at another institution other than the 
sponsor or the FDA (e.g. researcher outside of UVa)?  
Yes (data to be input in the PROMIS system) 
 
If YES, answer questions # 2-5: 
 
2. What will be shared? 
Patients will complete questionnaires as described in this protocol via a web-
based PROMIS system.  Questions are about physical, psychological, and 
emotional well-being. 
 

IRB-HSR# 17525 A Study of Patient-reported Outcomes in Patients with Lung or 
Esophageal Cancer  
Page 29 of 29 
Version Date: 07/31/2014 
3. Who will it be shared with? PROMIS 
 
4. What will they do with the data?  Store data for researchers in this UVA Research 
study.  
 
5. Will data be sent back to UVa?  We can pull our own data from the PROMIS 
database. 
 
6. What identifiers will be sent with the data? 
YES 
NO 
 
 
 
1.  Name 
 
 
2.Postal address information, other than town or city, state, and zip code 
 
 
3.  Telephone numbers 
 
 
4.  Fax numbers 
 
 
5.  Electronic mail addresses 
 
 
6.  Social Security number 
 
 
7.  Medical Record number 
 
 
8.  Health plan beneficiary numbers 
 
 
9.  Account numbers 
 
 
10.  Certificate/license numbers 
 
 
11.  Vehicle identifiers and serial numbers, including license plate numbers 
 
 
12.  Device identifiers and serial numbers 
 
 
13  Web Universal Resource Locators (URLs) 
 
 
14.  Internet Protocol (IP) address numbers 
 
 
15.  Biometric identifiers, including finger and voice prints 
 
 
16.  Full face photographic images and any comparable images  
 
 
17.  Any other unique identifying number, characteristic, code that is derived from or related to 
information about the individual (e.g. initials, last 4 digits of Social Security #, mother’s maiden 
name, first 3 letters of last name.) 
x 
 
18.  Any other information that could be used alone or in combination with other information to 
identify an individual. 
(e.g. rare disease, study team or company has access to the health information and a HIPAA 
identifier or the key to the code) 
 
7.  How will data be sent? 
_x___ Web Based Data Entry (e.g website, database, registry): Encrypted and 
Password Protected;  
If checked, do you confirm that you have verified with host site that data will be 
sent and stored in an encrypted fashion (e.g. via Secure FX, Secure FTP, HTTPS, 
PGP)?   
Yes