untitled h1
untitled h2

Title: A Study of Patient-reported Outcomes in Patients with Lung or Esophageal Cancer NCT \#: NCT02239328 Document: Study Protocol and Statistical Analysis Plan Date of Document: July 31, 2014
irb-hsr protocol investigator agreement
by signing this document the

1. I am not currently debarred by the US FDA from involvement in clinical research studies. 2. I am not involved in any regulatory or misconduct litigation or investigation by the FDA. 3. That if this study involves any funding or resources from an outside source, or if you will be sharing data outside of UVA prior to publication that you will contact the Dean's office regarding the need for a contract and letter of indemnification. If it is determined that either a contract or letter of indemnification is needed, subjects cannot be enrolled until these documents are complete.  
4. The proposed research project will be conducted by me or under my close supervision. It will be conducted in accordance with the protocol submitted to and approved by the IRB including any modifications, amendments or addendums submitted and approved by the IRB throughout the life of the protocol.  
5. That no personnel will be allowed to work on this protocol until they have completed the IRB-HSR On-line training and the IRB-HSR has been notified.  
6. That all personnel working on this protocol will follow all IRB-HSR Policies and Procedures as stated on the IRB-HSR Website http://www.virginia.edu/vprgs/irb/ and on the School of Medicine Clinical Trials Office Website: http://knowledgelink.healthsystem.virginia.edu/intranet/hes/cto/sops/sop_index.cfm 7. I will ensure that all those delegated tasks relating to this study, whether explicitly or implicitly, are capable through expertise, training , experience or credentialing to undertake those tasks.  
8. I confirm that the implications of the study have been discussed with all Departments that might be affected by it and have obtained their agreement for the study to take place.  
9. That no subjects will be recruited or entered under the protocol until the Investigator has received the signed IRB-HSR Approval form stating the protocol is open to enrollment 10. That any materials used to recruit subjects will be approved by the IRB-HSR prior to use. 11. That all subjects will sign a copy of the most current consent form that has a non-expired IRB-HSR approval stamp.  
12. That any modifications of the protocol or consent form will not be initiated without prior written approval from the IRB-HSR, except when necessary to eliminate immediate hazards to the subjects.  
13. Any significant findings that become known in the course of the research that might affect the willingness of subjects to enroll or to continue to take part, will be promptly reported to the IRB.  
14. I will report immediately to the IRB any unanticipated problems involving risk to subjects or to others including adverse reactions to biologics, drugs or medical devices.  
15. That any serious deviation from the protocol will be reported promptly to the Board in writing.  
16. That any data breach will be reported to the IRB, the UVa Corporate Compliance and Privacy Office , UVa Police as applicable.  
17. That the continuation status report for this protocol will be completed and returned within the time limit stated on the form.  
18. That the IRB-HSR office will be notified within 30 days of a change in the Principal Investigator or of the closure of this study.  
19. That a new PI will be assigned if the current PI will not be at UVA for an extended period of time. If the current PI is leaving UVa permanently, a new PI will be assigned PRIOR to the departure of the current PI.  
20. All study team members will have access to the current protocol and other applicable documents such as the IRB-HSR Application, consent forms and Investigator Brochures.  
21. Signed consent forms and other research records will be retained in a confidential manner.  
Records will be kept at least 6 years after completion of the study.  
22. No data/specimens may be taken from UVa without a signed Material Transfer Agreement between OSP/SOM Grants and Contracts Office and the new institution. Original study files are considered institutional records and may not be transferred to another institution. I will notify my department administration regarding where the originals will be kept at UVa. The material transfer agreement will delineate what copies of data, health information and/or specimens may be taken outside of UVa. It will also approve which HIPAA identifiers may be taken outside of UVa with the health information or specimens.  
23. If any member of study team leaves UVa, they are STRONGLY ENCOURAGED to use Exit Checklist found on IRB-HSR website at http://www.virginia.edu/provost/facultyexit.pdf.
irb-hsr protocol investigator agreement
the irb reserves the right

Dr. Kozower (Principal Investigator) is an Associate Professor of Surgery at the University of Virginia. He joined the faculty in 2006 and completed his Master of Public Health degree in 2009. Dr. Kozower is an experienced health services researcher and has received NIH funding in the past. Dr. Kozower has participated as a Principal Investigatory for NCI cooperative group trials and investigator initiated trials. Dr. Kozower has presented his research findings at multiple national meetings, published many abstracts and articles, and is the director for the surgical outcomes research center at UVA.  
Signatures
irb-hsr protocol investigator agreement
principal investigator

| Principal Investigator   | Principal Investigator   | Date   |
|--------------------------|--------------------------|--------|
| Signature                | Name Printed             |        |  
The Principal Investigator signature is ONLY required if this is a new protocol, a 5 year update or a modification changing the Principal Investigator.
irb-hsr protocol investigator agreement
department chair

BY SIGNING THIS DOCUMENT THE DEPARTMENT CHAIR AGREES:
1. To work with the investigator and with the board as needed, to maintain compliance with this agreement.  
2. That the Principal Investigator is qualified to perform this study. 3. That the protocol is scientifically relevant and sound.  
___________________________ _______________________ _________ Department Chair or Designee Department Chair or Designee Date  
Signature Name Printed  
The person signing as the Department Chair cannot be the Principal Investigator or a subinvestigator on this protocol.  
The Department Chair or Designee signature is ONLY required if this is a new protocol or a modification changing the Principal Investigator.
irb-hsr protocol investigator agreement
brief summary/abstract

A patient-centered approach to lung cancer surveillance following resection needs to incorporate patient reported outcomes. The Patient Reported Outcomes Measurement Information System (PROMIS®) was designed to revolutionize the assessment of patient reported outcomes by establishing a national resource for the measurement of patient-reported symptoms and other health outcomes.  
The PROMIS Assessment Center, the management tool within the larger PROMIS
system, will be used to securely store de identified data, provide automated accrual reports and data export for this specific study. This study will have it's own study specific website.  
Patients seen at the University of Virginia Cancer Center will be identified and invited to participate in an assessment of their reported outcomes over multiple domains available in PROMIS. Collecting this information on lung cancer survivors may provide a robust platform to design a patient-centered surveillance strategy following resection.  
The study team hypothesizes that patient reported outcomes will vary according to the presence of recurrence or metastasis of lung or esophageal cancer. The study team also believes including patient reported outcomes into routine post-treatment surveillance will improve patient satisfaction and improve outcomes.
irb-hsr protocol investigator agreement
background 1. provide the scientific

Lung cancer is the second most common cancer in both men and women in the United States. Of the estimated 182,550 patients newly diagnosed with non-small cell lung cancer
(NSCLC) this year, approximately 35% will present with localized disease and be eligible for curative resection. For patients with limited NSCLC, surgical resection is the most effective method of controlling the primary tumor and provides the best opportunity for cure. The current standard of care is to perform a complete resection along with mediastinal lymph node sampling/dissection to accurately stage the patient, reduce local recurrence, and improve survival. A recent analysis by our group demonstrated that the number of lung cancer resections has increased over the past decade, with over 45,000 lung cancer resections performed annually in the United States.  
Esophageal Cancer is one of the few cancers increasing in frequency in the US with 18,170 cases estimated for 2014. Unfortunately, the majority of these patients will ultimately die of their disease as the 5-year survival rate for all stages combined is 17%. The majority of these cancers are now adenocarcinomas of the distal esophagus and GE junction. Fortunately, more of these are being detected at an earlier stage when the chance of cure increases to over 50%. We perform over 50 esophagectomies each year at UVA and the majorities are now performed in a multidisciplinary fashion including treatment with chemotherapy and radiation.  
The risk of lung and esophageal cancer recurrence varies widely from 30% to 75% and our group, along with others, has shown that recurrence depends upon a variety of tumor and patient related factors. For those patients whose recurrences are detected early, there is a possibility for long-term survival following redo surgical resection, radiation therapy or chemotherapy. However, the majority of patients with recurrence will not be candidates for curative treatment. Therefore, many patients undergo repeated surveillance testing to identify one patient whose survival can be meaningfully prolonged.  
Therefore, the optimization of post treatment surveillance following lung or esophageal cancer resection is a national priority. The goal is to create a personalized decision support tool for lung and esophageal cancer surveillance that tailors follow-up to an individual patient. The decision tool incorporates risk-stratification for recurrence and survival, patient reported outcomes, and patient preferences to inform lung cancer survivors and their healthcare providers when selecting a surveillance strategy.  
This observational study will look to see if the PROMIS score for each patient directly reflects the state of their disease by using these three disease states, no recurrence, asymptomatic with recurrence, symptomatic with recurrence.
irb-hsr protocol investigator agreement
hypothesis to be tested

Hypothesis: Patient reported outcomes will vary according to the presence of recurrence or metastasis in patients with lung or esophageal cancer.
irb-hsr protocol investigator agreement
study design biomedical 1. will

2. **What is the study design?**
Observational study 3. **Does the study involve a placebo?**
No
irb-hsr protocol investigator agreement
human participants ages >=18 sex

Subjects- see below 1. Provide target \# of subjects (at all sites) needed to complete protocol.  
400 2. Describe expected rate of screen failure/ dropouts/withdrawals from all sites.  
Expected rate of screen failures or dropouts is thought to be very low <%1 3. How many subjects will be enrolled at all sites?  
400 4. How many subjects will sign a consent form under this UVa protocol?  
400 5. Provide an estimated time line for the study.  
50% enrollment in 6 months, 100% enrollment by end of year 1. There will be ongoing analysis of the data during the conduct of this trial.
irb-hsr protocol investigator agreement
inclusion/exclusion criteria 1. list the

- ≥18 years of age
- Suspected or Known diagnosis of lung or esophageal cancer
- Willing and able to complete questionnaires
•
irb-hsr protocol investigator agreement
2. list the criteria for

- Subjects unwilling to provide informed consent
- Subjects unwilling or unable to answer the questionnaires 3. List any restrictions on use of other drugs or treatments. None
irb-hsr protocol investigator agreement
2. what are the statistical

This is an observational pilot study to obtain patient reported outcomes for lung and esophageal cancer. 3. Provide a justification for the sample size used in this protocol.  
The thoracic surgery and medical oncology clinics at UVa performed over 1,000 follow-up visits in 2012 for patients following lung and esophageal cancer resection. This pilot study will enroll 200 patients for integration of PCOR (Patient Centered Outcomes Research) score into their electronic medical record. A sample size of 150 patients is enough to detect a difference of 3.2 points on the PROMIS scale between each of the three groups (asymptomatic without recurrence, asymptomatic with recurrence, and symptomatic) with 80% power at the 5% significance level. (i.e.: if asymptomatic without recurrence averages 56.4, asymptomatic with recurrence averages 53.2 and, symptomatic with recurrence averages 50).
irb-hsr protocol investigator agreement
4. what is your plan

This is an observational study to determine PROMIS scores at various time points. We will not be using repeated measures for this primary variable as each patient will only contribute one data point. We will calculate a mean and SD for each of the three disease states, no recurrence, asymptomatic with recurrence, symptomatic with recurrence.
irb-hsr protocol investigator agreement
5. what is your plan

We may do some longitudinal analysis of patient reported outcomes and will then account for repeated measures. 6. Have you been working with a statistician in designing this protocol? Yes, George Stukenborg
irb-hsr protocol investigator agreement
biomedical research 1. what will

Enrolled subjects will be asked to complete and on-line (web-based) survey using an IPad or computer during a regularly scheduled clinic visit. This survey is estimated to take 10-15 min. Most patients will only be asked to complete this survey once, but some patients will be asked to answer the questions a second or third time during a regularly scheduled clinic visit for follow up of their esophageal or lung cancer. Patients will provide their age, race, ethnicity and sex at the beginning of the survey. They will be provided a unique study identifier (i.e., 001, 002 etc.) and a password that they can used to complete the survey. Only the patient will have access to the password and no HIPPA identifiers are collected in the PROMIS on-line system. A Private web browser will be used to access the PROMIS website for each patient, so that all web browsing activity is removed after each patient completes the survey. A member of the research team will be responsible for closing the web based session in order to make sure all browsing history is erased properly." Data will then be collected from the STS Society of Thoracic Surgeons database for subjects who complete the on-line survey. The STS database is a national quality improvement database which the University of Virginia participates in for clinical purposes. Local data from the STS database will be queried for subjects who are enrolled in this study to provide clinical information about the patients clinical condition. The PROMIS reports and the STS data that links clinical information with the PROMIS data will be stored on a HIPPA compliant UVA server (surgery O: drive). This data will be accessible only to members of this research team. Paper Case report forms for eligibility verification, consent process documentation and enrollment verification may be maintained in paper format. Paper case reports forms will be stored in a limited access office and in a locked file cabinet.
irb-hsr protocol investigator agreement
2. list the procedures in

- Enrolled subjects will be asked to complete an on-line (web-based) survey using an IPad or computer. This survey is estimated to take 10-15 min. Most patients will only be asked to complete this survey once, but some patients will be asked to answer the questions a second or third time over a maximum five year period.  
- Information to be collected from the STS Database will include:
o Subject Name o Subject medical record number o Age o Gender o Race o Pathology, laboratory/microbiology results o Medications o Vital signs, Height, weight, other clinical parameters.  
o Perioperative Data o Diagnosis o Comorbidities o Surgical procedure performed o Date of surgery o Surgical approach o Date of Discharge o Cancer stage, recurrence or metastasis sites 3. Will you be using data/specimens in this study that were collected previously, with the use of a research consent form, from another research study? No 4. Will any of the procedures listed in item \# 2 have the potential to identify an incidental finding? Yes
__X__This examination(s) utilizes non-standard/investigational, technique, equipment, etc. It is impossible to determine the significance of such results, therefore abnormalities will not be shared with the subject because the meaning of the exam is not yet proven and is of unknown clinical benefit.  
5. Do any of the procedures listed above, under question \# 2, utilize any imaging procedures? NO 6. Will you be using viable embryos?  
NO
7. **Will you be using embryonic stem cells?**
NO
8. **Are any aspects of the study kept secret from the participants?**
NO
9. **Is any deception used in the study?**
NO  
| 1. Designate type of study  CHECK TYPE of   | Oversight by CC                                        | External DSMB   | Additional      |               |
|---------------------------------------------|--------------------------------------------------------|-----------------|-----------------|---------------|
| ONE                                         | SPONSOR                                                | DSMC?           | Required?       | Requirements  |
| X                                           | UVa  Investigator  InitiatedSingle site at  UVa                                                        | No              | Not required by | - Enrollment/ |
| PRC.                                        | accrual  information must  be submitted to  OnCore. ** |                 |                 |               |
irb-hsr protocol investigator agreement
1. what is the risk

| Check   | Risk                       | Examples                                                                                                                                                                       | Monitoring                                   |
|---------|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------|
| One     | Level                      | Frequency by CC  DSMC, VPR Post  Approval  Compliance Monitors                                                                                                                 | Additional  Requirements                     |
| X       | PRC  review  not  required | - Epidemiology research,  - Surveys,  - Database protocols - Protocols using discarded tissue - Any other protocols involving  cancer patients that do not  have cancer focus. | N/A - studies not  monitored by the  CC DSMC |
irb-hsr protocol investigator agreement
data and safety monitoring plan

This study has been deemed minimal risk. Because this study poses minimal risk to the subject, adverse events will only be collected or recorded if a causal relationship to the study intervention is suspected. If any adverse event is considered serious and unexpected, the event must be reported to the IRB-HSR within 7 days from the time the study team receives knowledge of the event.
irb-hsr protocol investigator agreement
1. definitions

1.1 **How will you define adverse events (AE)?**
Do not change this answer An adverse event will be considered any undesirable sign, symptom or medical condition considered **related to the intervention**. Medical condition/diseases present before starting the intervention will be considered adverse events only if  
they worsen after starting the study and that worsening is considered to be related to the study intervention. An adverse event is also any undesirable and unintended effect of research occurring in human subjects as a result of the collection of identifiable private information under the research.
irb-hsr protocol investigator agreement
1.2 how will you define

Do not change this answer An unanticipated problem is any issue that involves increased risk(s) to participants or others. This means issues or problems that cause the subject or others to be placed at greater risk than previously identified, even if the subject or others do not incur actual harm. For example if a subject's confidentiality is compromised resulting in serious negative social, legal or economic ramifications, an unanticipated problem would need to be reported. (e.g. serious loss of social status, loss of job, interpersonal conflict.)
irb-hsr protocol investigator agreement
1.3 what is the definition

A protocol violation is defined as any change, deviation, or departure from the study design or procedures of a research project that is NOT approved by the IRBHSR prior to its initiation or implementation, OR deviation from standard operating procedures, Good Clinical Practices (GCPs), federal, state or local regulations. Protocol violations may or may not be under the control of the study team or UVa staff. These protocol violations may be major or minor violations.  
Additional Information: see the IRB-HSR website at http://www.virginia.edu/vpr/irb/HSR_docs/Forms/Protocol_Violations_%20Enrollm ent_Exceptions_Instructions.doc
irb-hsr protocol investigator agreement
1.4 what is the definition

Do not change this answer A data breach is defined in the HITECH Act (43 USC 17932) as an unauthorized acquisition, access, or use of protected health information (PHI) that compromises the security or privacy of such information. Additional Information may be found on the IRB-HSR Website: Data Breach 2. What risks are expected due to the intervention in this protocol?  
| Expected Risks related to study                                                                                                                  | Pick One      |
|--------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| participation There is a small risk that breaches  of privacy and/or confidentiality  might occur. The risk of violation  of subject privacy and | Occurs rarely |  
confidentiality is minimal due to the requirements of the privacy plan in this protocol.  
3. When will recording and reporting of unanticipated problems/adverse events begin?  
__X___After subject signs consent 4. When will the recording/reporting of unanticipated problems/adverse events end?  
_X____Subject completes participation in the protocol
irb-hsr protocol investigator agreement
5. what is your plan

Safety monitoring and aggregate review of adverse events, unanticipated problems, protocol violations and any data breach will be performed by the PI and IRB-HSR through continuation review at least annually.
irb-hsr protocol investigator agreement
6. what is your plan

| Type of Event                                                                                                                                   | To whom will it                                                                          | Time Frame for                                                                           | How reported?                                                                                                  |
|-------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------|
| be reported:                                                                                                                                    | Reporting                                                                                |                                                                                          |                                                                                                                |
| Unanticipated Problems that  are not adverse events or  protocol violations  This would include a Data  Breach.  IRB-HSR                        | Within 7 calendar  days from the time  the study team  received knowledge  of the event. | Unanticipated Problem report  form.  http://www.virginia.edu/v prgs/irb/HSR_docs/Forms/ Reporting_RequirementsUnanticipated_Problems.d oc )                                                                                          |                                                                                                                |
| Protocol Violations  (The IRB-HSR only requires  that MAJOR violation be  reported, unless otherwise  required by your sponsor, if applicable.) | IRB-HSR                                                                                  | Within 7 calendar  days from the time  the study team  received knowledge  of the event. | Protocol Violation and  Enrollment Exception Reporting  Form http://www.virginia.edu/v prgs/irb/hsr_forms.html |
| OR                                                                                                                                              | Go to 3rd bullet from the  bottom.                                                       |                                                                                          |                                                                                                                |
| Enrollment Exceptions                                                                                                                           |                                                                                          |                                                                                          |                                                                                                                |  
| Data Breach of Protected                               | The UVa                                                                                      |                                                                                                                 |                                                              |
|--------------------------------------------------------|----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------|
| Health Information                                     | Corporate  Compliance and  Privacy Office                                                    | As soon as possible  and no later than 24  hours from the time  the incident is  identified.                    | UVa Corporate Compliance and  Privacy Office- Phone 924-9741 |
| ITC: if breach  involves  electronic data              | As soon as possible  and no later than 24  hours from the time  the incident is  identified. | ITC: Information Security  Incident Reporting  procedure,  http://www.itc.virginia.ed u/security/reporting.html |                                                              |
| UVa Police if  breach includes  items that are  stolen | IMMEDIATELY.                                                                                 | Police: phone- (434) 924-7166                                                                                   |                                                              |
irb-hsr protocol investigator agreement
risk/ benefit analysis 1. what

society in general, as a result of this study? There are no expected direct benefits for individual participants in this study. However, future patients with lung or esophageal cancer may benefit as a result of information learned in this research. The risks in this study are considered minimal and related to risk to privacy and confidentiality. The risks are minimized by the privacy plan outlined in this study. The risks are outweighed by the potential benefits this could bring. We believe if this study shows a correlation between patient reported outcomes and their clinical presentation, this could potentially play a role in the development of patient specific cancer surveillance tools. 2. Do the anticipated benefits justify asking subjects to undertake the risks? The potential benefits to cancer surveillance do justify the minimal risk this study poses.
irb-hsr protocol investigator agreement
bibliography

1. Siegel R, Naishadham D, Jemal A. Cancer statistics, 2013. CA Cancer J Clin 2013;63:11-30.  
2. Cancer Facts & Figures. 2013. (Accessed July 26, 2013, at http://www.cancer.org/research/cancerfactsstatistics/index.)
3. Colt HG, Murgu SD, Korst RJ, Slatore CG, Unger M, Quadrelli S. Follow-up and Surveillance of the Patient With Lung Cancer After Curative-Intent Therapy: Diagnosis and Management of Lung Cancer, 3rd ed: American College of Chest Physicians Evidence-Based Clinical Practice Guidelines. Chest 2013;143:e437S54S.  
4. Darling GE, Allen MS, Decker PA, Ballman K, Malthaner RA, Inculet RI, Jones DR,
McKenna RJ, Landreneau RJ, Rusch VW, Putnam JB. Randomized trial of mediastinal lymph node sampling versus complete lymphadenectomy during pulmonary resection in the patient with N0 or N1 (less than hilar) non-small cell
carcinoma: results of the American College of Surgery Oncology Group Z0030 Trial. J Thorac Cardiovasc Surg 2011;141:662-70.  
5. Ginsberg RJ, Rubinstein LV. Randomized trial of lobectomy versus limited resection for T1 N0 non-small cell lung cancer. Lung Cancer Study Group.see comment. Ann Thorac Surg 1995;60:615-22.  
6. LaPar DJ, Bhamidipati CM, Lau CL, Jones DR, Kozower BD. The Society of Thoracic Surgeons General Thoracic Surgery Database: establishing generalizability to national lung cancer resection outcomes. Ann Thorac Surg 2012;94:216-21; discussion 21 7. 14. Sugimura H, Nichols FC, Yang P. Survival after recurrent nonsmall-cell lung cancer after complete pulmonary resection. Ann Thorac Surg 2007;83:409-17; discussioin 17-8.  
8. 15. Taylor MD, Nagji AS, Kozower BD, Lau CL, Jones DR. Tumor recurrence after complete resection for non-small cell lung cancer. Ann Thorac Surg 2012;93:181320; discussion 20-1 9. 21. Colice GL, Rubins J, Unger M, American College of Chest P. Follow-up and surveillance of the lung cancer patient following curative-intent therapy. Chest 2003;123:272S-83S  
APPENDIX: Legal/Regulatory Recruitment The following procedures will be followed:
- Finders fees will not be paid to an individual as they are not allowed by UVa Policy.  
- All recruitment materials will be approved by the IRB-HSR prior to use. They will be submitted to the IRB after the IRB-HSR has assigned an IRB-HSR \# to the protocol.  
- Only those individuals listed as personnel on this protocol will recruit and or conduct the consenting process with potential subjects.
irb-hsr protocol investigator agreement
retention incentives

Any item used by the sponsor/ study team to provide incentive to a subject to remain in the study, other than compensation identified in the Payment section, will be submitted to the IRB for review prior to use. The IRB-HSR will provide the study team with a Receipt Acknowledgement for their records. Retention incentive items are such things as water bottles, small tote bags, birthday cards etc. Cash and gift cards are not allowed as retention incentives.
irb-hsr protocol investigator agreement
clinical privileges the following procedures

- Investigators who are members of the clinical staff at the University of Virginia Medical Center must have the appropriate credentials and been granted clinical privileges to perform specific clinical procedures whether those procedures are experimental or standard.  
- The IRB cannot grant clinical privileges.  
- Performing procedures which are outside the scope of the clinical privileges that have been granted may result in denial of insurance coverage should claims of negligence or malpractice arise.  
- Personnel on this protocol will have the appropriate credentials and clinical privileges in place before performing any procedures required by this protocol.  
- Contact the Clinical Staff Office- 924-9055 or 924-8778 for further information.
irb-hsr protocol investigator agreement
sharing of data/specimens

Data and specimens collected under an IRB approved protocol are the property of the University of Virginia. You must have "permission" to share data/ specimens outside of UVa other than for a grant application and or publication. This "permission" may come in the form of a contract with the sponsor or a material transfer agreement (MTA) with others. A contract/ MTA is needed to share the data outside of UVa even if the data includes no HIPAA identifiers and no code that could link the data back to a HIPAA identifier.  
- No data will be shared outside of UVa, beyond using data for a grant application and or publication, without a signed contract/MTA approved by the SOM Grants and Contracts office/ OSP or written confirmation that one is not needed.  
- No specimens will be shared outside of UVa without a signed contract/MTA approved by the SOM Grants and Contracts office/ OSP or written confirmation that one is not needed.
irb-hsr protocol investigator agreement
prisoners

If the original protocol/ IRB application stated that no prisoners would be enrolled in this study and subsequently a subject becomes a prisoner, the study team must notify the IRB immediately. The study team and IRB will need to determine if the subject will remain in the study. If the subject will remain in the study, the protocol will have to be re-reviewed with the input of a prisoner advocate. The prisoner advocate will also have to be involved in the review of future continuations, modifications or any other reporting such as protocol violations or adverse events. Prisoner- Individuals are prisoners if they are in any kind of penal institution, such as a prison, jail, or juvenile offender facility, and their ability to leave the institution is restricted. Prisoners may be convicted felons, or may be untried persons who are detained pending judicial action, for example, arraignment or trial. For additional information see the OHRP website at http://www.hhs.gov/ohrp/policy/populations/index.html
irb-hsr protocol investigator agreement
compensation in case of injury

If a subject requests compensation for an injury, the study team should notify the IRB-HSR (9249634/2439847) the UVa Health System Patient Relations Department (924-8315). As a proactive courtesy, the study team may also notify UVa Health System Patient Safety and Risk Management (924-5595). On request, the study team should provide the Risk Management Office with the following information/documents:
- Subject Name and Medical Record Number  
- Research medical records
- Research consent form
- Adverse event report to IRB
- Any letter from IRB to OHRP
irb-hsr protocol investigator agreement
subject complaints

During a research study, the study team may receive complaints from a subject. If the study team is uncertain how to respond to a complaint, or is unable to resolve it with the subject, the study team may contact the IRB-HSR (924-9634/243-9847), the UVa Health System Patient Relations Department (924-8315).
irb-hsr protocol investigator agreement
request for research records from

If the study team receives a request for research records from a search warrant or subpoena, they should notify UVa Health Information Services at 924-5136. It is important to notify them if information from the study is protected by a Certificate of Confidentiality.
irb-hsr protocol investigator agreement
appendix recruitment

Recruitment includes identifying, review of records to determine eligibility or any contact to determine a potential subjects interest in the study. *The UVa HIPAA covered entity is composed of the UVa VP Office of Research, the Health System, School of Medicine, School of Nursing, Nutrition Services (Morrison's), the Sheila C. Johnson Center, the Exercise and Sports Injury Laboratory and the Exercise Physiology Laboratory.  
1. How do you plan to identify **potential subjects?**
- To "identify" a potential subject refers to steps you plan to take to determine which individuals would qualify to participate in your study. This does NOT
include steps to actually contact those individuals.  
- If your study involves more than one group of subjects (e.g. controls and cases or subjects and caregivers) note below which groups are being identified by the given method.  
- Check the methods you plan to utilize:
a. __X__ Chart Review/ Clinic Schedule Review/ Database Review from a  
  
database established for health care operations (departmental clinical database) or quality improvement. DHHS: Study team requests Waiver of Consent to identify potential subjects. HIPAA: Allowed under Preparatory to Research if PHI to be accessed.  
b. ____ Review of a database that was established to keep data to be used for future research such as the CDR, departmental research database or use of data from a separate current active research protocol. DHHS: Study team requests Waiver of Consent to identify potential subjects. HIPAA: Allowed under Preparatory to Research if PHI to be accessed.  
Page 16 of 29 Version Date: 07/31/2014  
Keep in mind that PHI in the medical record may only be accessed by individuals who work under the UVa HIPAA covered entity; which means they meet one of the following criteria: --a UVa student working in the UVa HIPAA Covered Entity* --a faculty or staff member in a PAID appointment in the UVA HIPAA Covered Entity*  
Keep in mind that PHI in the medical record may only be accessed by individuals who work under the UVa HIPAA covered entity; which means they who meet one of the following criteria: --a UVa student working in the UVa HIPAA Covered Entity* --a faculty or staff member in a PAID appointment in the UVA HIPAA Covered Entity* The information from which you are obtaining potential subjects must also have an IRB protocol approval. If this item is checked, enter the IRB \# below. IRB\# ________________
If obtaining information from the Clinical Data Repository (CDR) insert IRB \# 10797 c. ____ Patients UVa health care provider supplies the UVa study team with the patients contact information without patients knowledge OR / potential subject is a patient at UVa and will be identified by their health care provider during an appointment at UVa Medical Center. DHHS: Study team requests Waiver of Consent to identify potential subjects. HIPAA: Allowed under Preparatory to Research if PHI will be shared by the health care provider.  
d. ____ Patient obtains information about the study from their health care provider. The patient contacts the study team if interested in participating. DHHS: NA HIPAA: Allowed under Health Care Operations If this choice is checked, check 3d-INDIRECT CONTACT below.  
e. ____ Potential subjects will not be directly identified. They will respond to an advertisement such as a flyer, brochure etc. If this choice is checked, check 3d- INDIRECT CONTACT below. DHHS & HIPAA: NA
f. _____ Potential subjects have previously signed a consent to have their name in a registry/database to be contacted for future studies of this type.  
IRB\# of **registry/ database:** ________________ DHHS & HIPAA: NA
g. ____ Other: Specify Answer/Response:
Page 17 of 29 Version Date: 07/31/2014 IMPORTANT Keep in mind that PHI may only be given to individuals who work under the UVa HIPAA covered entity; which means they meet one of the following criteria: --a UVa student working in the UVa HIPAA Covered Entity* --a faculty or staff member in a PAID appointment in the UVA HIPAA Covered Entity* If item \# a, b or c is checked above and if this protocol involves the use of protected health information do you confirm the following to be true?  
- The use or disclosure is sought solely to review protected health information as necessary to prepare the research protocol or other similar preparatory purposes.  
- No PHI will be removed from the UVa covered entity.  
- The PHI that the researcher seeks to use or access is necessary for the research purposes.  
YES
irb-hsr protocol investigator agreement
2. how will potential subjects

To "contact" a potential subjects refers to the initial contact you plan to take to reach a potential subject to determine if they would be interested in participating in your study. This may include direct contact by such methods as by letter, phone, email or in-person or indirect contact such as the use of flyers, radio ads etc.  
If your study involves more than one group of subjects (e.g. controls and cases or subjects and caregivers) note below which groups are being contacted by the given method. Check the methods below you plan to utilize:
a.____Direct contact of potential subjects by the study team via letter, phone, direct e-mail. Members of study team ARE NOT health care providers of patients. Information will not be collected from psychotherapy notes.  
Note: Letter, phone, direct email scripts must be approved by IRB prior to use. See IRB-HSR Website for templates. DHHS/HIPAA: Study team requests a Waiver of Consent and Waiver of HIPAA Authorization to contact potential subjects.  
Keep in mind that if PHI was collected during the identification phase that contact with potential subjects may only be performed by individuals who work under the UVa HIPAA covered entity; which means they meet one of the following criteria:
a UVa student working in the UVa HIPAA Covered Entity* a faculty or staff member in a PAID appointment in the UVA
HIPAA Covered Entity* b.____Potential subjects will be approached while at UVa Hospital or Health Clinic by a person who is NOT a member of their health care team. Information will not be collected from psychotherapy notes. DHHS & HIPAA: Study team requests a Waiver of Consent and a Waiver of HIPAA Authorization to contact potential subjects.  
Keep in mind that contacting individuals in a clinical setting may only be performed by individuals who work under the UVa HIPAA covered entity; which means they meet one of the following criteria: a UVa student working in the UVa HIPAA Covered Entity*
irb-hsr protocol investigator agreement
you should share the following

- Your name
- Who you are: physician, nurse etc. at the University of Virginia.  
- Why you want to speak with them
- Ask if you have their permission to explain the study to them
- If asked about how you obtained their information use one of the following as an option for response.  
- DO NOT USE THIS RESPONSE UNLESS YOU HAVE OBTAINED
PERMISSION FROM THEIR UVa PHYSICIAN:
- Your doctor, Dr. insert name wanted you to be aware of this research study and gave us permission to contact you.  
- We obtained your information from your medical records at UVa.  
- Federal regulations allow the UVa Health System to release your information to researchers at UVa, so that we may contact you regarding studies you may be interested in participating. We want to assure you that we will keep your information confidential.  
- IF THE PERSON SEEMS ANGRY, HESITANT OR UPSET, THANK THEM
FOR THEIR TIME AND DO NOT ENROLL THEM IN THE STUDY. YOU MAY ALSO REFER THEM TO THE IRB-HSR AT 924-9634.  
Page 19 of 29 Version Date: 07/31/2014 A faculty or staff member in a PAID appointment in the UVA HIPAA Covered Entity* c.__X__Direct contact of potential subjects by the study team by approaching in person at UVa or via letter, phone, direct e-mail. Members of study team contacting potential subjects ARE health care providers of patients.  
If you are not approaching them in person but using a letter, phone call or direct email please note that the letter, phone, direct email scripts must be approved by IRB prior to use. See IRB-HSR Website for templates. DHHS: Study team requests a Waiver of Consent to contact potential subjects HIPAA: Allowed under Health Care Operations.  
d.____ Indirect contact (flyer, brochure, TV, broadcast emails, patient provided info about the study from their health care provider and either the patient contacts study team or gives their healthcare provider permission for the study team to contact them.) The indirect method used (flyer, brochure, TV, broadcast emails) must be approved by the IRB prior to use. The IRB does not need to review any DHHS & HIPAA: NA
e. ____ Potential subjects are not patients. The study does not include obtaining subjects health information. Subjects will be contacted directly via email, phone, letter or presentation in group setting with consent then obtained individually in a private setting. If you are not approaching them in person but using a letter, phone call or direct email please note that the letter, phone, direct email scripts must be approved by IRB prior to use.  
See IRB-HSR Website for templates. DHHS: Study team requests a Waiver of Consent to contact potential subjects. HIPPA: NA
3. **Will any additional information be obtained from a potential subject during**
"prescreening"? NO
4. **Do you plan to ask the subjects to do anything, other than answering questions,**
for the study prior to signing a consent?  
NO
Page 20 of 29 Version Date: 07/31/2014 type of script to use when the potential subject responds to the indirect method.  
5. **How will the consenting process take place with either the prospective subject, the**
subject's legally authorized representative or parent/legal guardian of a minor ( if applicable)?  
Subjects will be approached at UVA about participation in this study. A member of the study team will review the informed consent with the subject, and facilitate a discussion of the study procedures, risks/benefits, and alternatives. Subjects will be told that their participation is voluntary - and they do not have to participate in this study. Subjects will also be informed that their decision to participate or not participate will not influence the medical care they receive at UVA. Subjects will be given the opportunity to take the consent home for consideration if they desire, and questions will be answered. The physician investigator will be available to address questions; however consent will be primarily obtained by the study coordinators. Subjects who wish to participate will be asked to sign the consent form prior to any data being collected. A copy of the signed consent form will be given to the subject.  
6. Will subjects sign a consent form for any part of the study? yes 7. Will the study procedures be started the same day the subject is recruited for the study?  
Subjects will be recruited in the thoracic surgery clinic during routine visits. Subjects may be asked to complete the questionnaires/survey on the same day as they are signing informed consent, however, will be given the option of completing the baseline questionnaires at a later date as time permits.
irb-hsr protocol investigator agreement
>if yes explain in detail

Subjects will be given adequate time to consider participation in this observational study. Subjects will be given the opportunity to take the consent home and consider participation at a later date.
irb-hsr protocol investigator agreement
>if yes explain in detail

enough time to make an informed decision. Study team members will emphasize to subjects that participation in this observational study is voluntary and that they do not have to participate in order to receive care for their condition. Subjects will be given time to read the consent and ask questions, and will not be asked to sign the consent until their questions have been answered.  
8. Is there the potential to recruit economically or educationally disadvantaged subjects, or other vulnerable subjects such as students or employees?  
Yes IF YES, what protections are in place to protect the rights and welfare of these subjects so that any possible coercion or undue influence is eliminated?  
Study team members will emphasize to subjects that participation in this observational study is voluntary and that they do not have to participate in order to receive care for their condition and their jobs or grades will not be affected as stated in the consent form.  
9. Do you need to perform a "dry run" of any procedure outlined in this protocol?  
No
irb-hsr protocol investigator agreement
appendix privacy plan for studies

1. **Answer the questions below (1a-1f) to describe the plan to protect the identifiable data from**
improper use and disclosure.  
1a. How will data be collected?  
2.__X___ Collection of data via web-based format (e.g. online consent/online surveys, online CRF's)
4.__X__ Directly to a Health Systems Computing Services (HS/CS) managed server that is configured to store data regulated by HIPAA.
irb-hsr protocol investigator agreement
7.x paper

►If you checked item 1.2 or 3 will the data include any of the HIPAA identifiers listed below? ANWER QUESTION IN TABLE BELOW  
| HIPAA Identifiers YES NO HIPAA Identifier  X 1. Name X 2.Postal address information, other than town or city, state, and zip code X 3. Telephone numbers 4. Fax numbers 5. Electronic mail addresses 6. Social Security number X 7. Medical Record number 8. Health plan beneficiary numbers 9. Account numbers 10. Certificate/license numbers 11. Vehicle identifiers and serial numbers, including license plate numbers 12. Device identifiers and serial numbers 13 Web Universal Resource Locators (URLs) 14. Internet Protocol (IP) address numbers 15. Biometric identifiers, including finger and voice prints 16. Full face photographic images and any comparable images  17. Any other unique identifying number, characteristic, code that is derived from or  related to information about the individual (e.g. initials, last 4 digits of Social Security #,  mother's maiden name, first 3 letters of last name.) 18. Any other information that could be used alone or in combination with other  information to identify an individual.   |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
irb-hsr protocol investigator agreement
1b. how will data be

___X__ Data, which may include health information, or other highly sensitive data will be stored with HIPAA identifiers. _____ Data, which may include health information, or other highly sensitive data will NOT be stored with any HIPAA identifier except date(s). This means:
- Documents such as case report forms will have NO HIPAA identifiers except dates (e.g.  
no initials or medical record \#)
- HIPAA identifiers, except dates will be stored in a different place than the health information/specimens. A code such as subject \# 1 will be used to link the identity of the individual (HIPAA identifiers) with the persons health information.  
1c. Will specimens be stored by the UVa study team?  
N/A 1d. Will any of the data be stored electronically? Yes
►**IF YES, will it include storage of any health information or other sensitive data?**
Yes  
| HIPAA Identifiers YES NO   | HIPAA Identifier                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| X                          | 1. Name                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| X                          | 2.Postal address information, other than town or city, state, and zip code                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| X                          | 3. Telephone numbers 4. Fax numbers 5. Electronic mail addresses 6. Social Security number                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| X                          | 7. Medical Record number 8. Health plan beneficiary numbers 9. Account numbers 10. Certificate/license numbers 11. Vehicle identifiers and serial numbers, including license plate numbers 12. Device identifiers and serial numbers 13 Web Universal Resource Locators (URLs) 14. Internet Protocol (IP) address numbers 15. Biometric identifiers, including finger and voice prints 16. Full face photographic images and any comparable images  17. Any other unique identifying number, characteristic, code that is derived  from or related to information about the individual (e.g. initials, last 4 digits of  Social Security #, mother's maiden name, first 3 letters of last name.) 18. Any other information that could be used alone or in combination with  other information to identify an individual. (e.g. rare disease, study team or company has access to the health information  and a HIPAA identifier or the key to the code) |  
1e. If you answered YES to any HIPAA identifier above, where will the data be stored?  
___X__ a Health Systems Computing Services (HS/CS) managed server that is configured to store data regulated by HIPAA.  
1f. Will any of the data be collected or stored in hard copy format by the UVa study team?  
Yes
irb-hsr protocol investigator agreement
>if yes where will it

___X__ case report forms will be stored in a secure area with limited access.  
1g. The following procedures will also be followed.  
- Only investigators for this study and clinicians caring for the patient will have access to the data. They will each use a unique log-in ID and password that will keep confidential.  
- Each investigator will sign the University's Electronic Access Agreement forward the signed agreement to the appropriate department as instructed on the form. If you currently have access to clinical data it is likely that you have already signed this form. You are not required to sign it again.  
- UVa University Data Protection Standards will be followed http://itc.virginia.edu/security/dataprotection.  
- If identifiable data is transferred to any other location such as a desktop, laptop, memory stick, CD etc. the researcher must follow the University's "Electronic Storage of Highly Sensitive Data Policy". Additional requirements may be found in the Universities Requirements for Securing Electronic Devices.  
- If identifiable health information is taken away from the UVa Health System, Medical Center Policy \# 0218 will be followed.  
- The data will be securely removed from the server, additional computer(s), and electronic media according to the University's Electronic Data Removal Policy.  
- The data will be encrypted or removed if the electronic device is sent outside of UVa for repair according to the University's Electronic Data Removal Policy.  
- If PHI will be faxed, researchers will follow the Health System Policy \# 0194.  
- If PHI will be emailed, researchers will follow the Health System Policy \# 0193 and UVa Institutional Data Protection Standards .  
- The data may not be analyzed for any other study without additional IRB approval.  
- If you are using patient information you must follow Health System Policy \# 0021.
irb-hsr protocol investigator agreement
summary of requirements to comply

-personal information that can lead to identify theft if exposed or -health information that reveals an individual's health condition and/or history of health services use.  
Protected Health Information (PHI) a type of Sensitive Data, is health information combined with a HIPAA identifier Identifiable Health Information under HIPAA regulations is considered to be Highly Sensitive Data A **Limited Data Set** (LDS) under HIPAA regulations is considered to be *Moderately Sensitive* Data. The only HIPAA identifiers associated with data: full dates and or postal address information including town or city, state, and zip code De-identified or Anonymous data is considered to be NOT Sensitive Data  
| Summary Table                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                                                                                                                                                                                      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Highly Sensitive Data                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Moderately Sensitive Data                                                                                                                                                                            |
| (Identifiable Health Info per HIPAA )                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | (Limited Data Set per HIPAA)                                                                                                                                                                         |
| General Issues                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | General Issues                                                                                                                                                                                       |
| Discussions in private Do not share with those not on the study team                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Do not share with those not on the study team                                                                                                                                                        |
| or those who do not have a need to know.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | or those who do not have a need to know                                                                                                                                                              |
| Password protect                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Password protect                                                                                                                                                                                     |
| Physically secure, do not leave unattended,  turn off File Sharing; turn on firewalls; use up  to date antivirus and antispyware; delete data  securely                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Physically secure, turn off File Sharing; turn  on firewalls; use up to date antivirus and  antispyware; delete data securely                                                                        |
| Encrypt See encryption solutions guidance.  Files on Health System Network drives are  automatically encrypted. If not stored there it  is study teams responsibility to make sure data  is encrypted.  If device sent out for repair, encrypt or                                                                                                                                                                                                                                                                                                                                                                           | If device sent out for repair, encrypt or                                                                                                                                                            |
| remove data                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | remove data                                                                                                                                                                                          |
| Store files on a network drive specifically  designated for storing this type of data, e.g.  high-level security servers managed by  Information Technology Services or the "F"  and "O" managed by Heath Systems  Computing Services. You may access it via a  shortcut icon on your desktop, but you are not  allowed to take it off line to a local drive such  as the desktop of your computer (e.g. C drive)  or to a Single Use Device*. May access via VPN Do not share with sponsor or other outside  group before consent is obtained or the IRB  has granted appropriate approvals and  contract/ MTA is in place | Do not share with sponsor or other outside  group before consent is obtained or the IRB  has granted appropriate approvals and  contract/ MTA is in place                                            |
| If collected without consent/ HIPAA  authorization will NOT be allowed to leave  UVa HIPAA covered entity unless disclosure is  approved by the IRB and the disclosure is  tracked in EPIC                                                                                                                                                                                                                                                                                                                                                                                                                                  | If collected without consent/ HIPAA  authorization will NOT be allowed to leave  UVa HIPAA covered entity unless disclosure is  approved by the IRB and an MTA is in place  prior to sharing of data |
| Single Use Device                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Single Use Device                                                                                                                                                                                    |
| Do not save to single use device* without                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                      |  
| Esophageal Cancer  written approval of your Department AND VP  or Dean.  If approval obtained, data must be password  protected and encrypted. Do not save an email attachment containing  HSD to a single use device ( e.g. smart phone)  E Mail                                                                                                                                              | E Mail                                                                                                                                |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
| Do not share via email with Outlook Web/ or  forward email using other email vendors like  Gmail/ Yahoo  Do not send via email on smart phone unless  phone is set up by Health System  Email may include name, medical record  number or Social Security number only if  sending email to or from a person with * HS in  their email address. NOTE: VPR& IRB staff do not meet this criteria! | In addition to sharing LDS, may include  initials if persons sending and receiving email  work within the UVa HIPAA covered entity.** |
| FAX                                                                                                                                                                                                                                                                                                                                                                                            | FAX                                                                                                                                   |
| Verify FAX number before faxing                                                                                                                                                                                                                                                                                                                                                                | Verify FAX number before faxing                                                                                                       |
| Use Fax Cover Sheet with Confidentiality                                                                                                                                                                                                                                                                                                                                                       | Use Fax Cover Sheet with Confidentiality                                                                                              |
| Statement                                                                                                                                                                                                                                                                                                                                                                                      | Statement                                                                                                                             |
| Verify receiving fax machine is in a restricted                                                                                                                                                                                                                                                                                                                                                | Verify receiving fax machine is in a restricted                                                                                       |
| access area                                                                                                                                                                                                                                                                                                                                                                                    | access area                                                                                                                           |
| Verify intended recipient is clearly indicated                                                                                                                                                                                                                                                                                                                                                 | Verify intended recipient is clearly indicated                                                                                        |
| Recipient is alerted to the pending  transmission and is available to pick it up  immediately                                                                                                                                                                                                                                                                                                  | Recipient is alerted to the pending  transmission and is available to pick it up  immediately                                         |
| Electronic Data Collection & Sharing                                                                                                                                                                                                                                                                                                                                                           | Electronic Data Collection & Sharing                                                                                                  |
| (e.g. online case report forms, smart phone  app, electronic consent using tablet etc.) MUST consult with ISPRO or Health System  Web Development Office  University Side: vams@virginia.edu  Health System: Web Development Center:  434-243-6702  Contract must include required security  measures.  May NOT be stored in places like Drop Box,                                             | May be stored in places like Drop Box, UVa                                                                                            |
| UVa Box, Colab.                                                                                                                                                                                                                                                                                                                                                                                | Box, Colab.                                                                                                                           |
| LOST OR STOLEN:                                                                                                                                                                                                                                                                                                                                                                                | LOST OR STOLEN:                                                                                                                       |
| Must report in accordance with protocol/ in  accordance with the Information Security                                                                                                                                                                                                                                                                                                          |                                                                                                                                       |  
Incident Reporting Policy
* Single Use Device - examples include smart phone, CD, flash drive, laptop, C drive of your computer,
**The UVa HIPAA covered entity is composed of the UVa VP Office of Research, the Health System, School of Medicine, School of Nursing, Nutrition Services (Morrison's), the Sheila C. Johnson Center, the Exercise and Sports Injury Laboratory and the Exercise Physiology Laboratory.  
2. Describe your/central registry's plan to destroy the HIPAA identifiers at the earliest opportunity consistent with the conduct of the research and in accordance with any stipulations in the research sponsor contract and UVa records management guidelines.  
___X__The HIPAA identifiers (except full dates and or address information if needed) will be destroyed as soon as all publications are complete. This wording would allow the researcher to keep HIPAA identifiers until all queries/ request for additional information from publisher are addressed.  
3. **Do you confirm that you will not reuse the identifiable data (HIPAA identifiers or health** information) or disclose any of this information to any other person or entity except as outlined in this protocol, except as required by law, for authorized oversight of the research study, or use it for other research unless approved by the IRB-HSR? Yes
irb-hsr protocol investigator agreement
this means that after the

- You cannot contact the subject by any method (you cannot call them, send a letter, talk to them in person about the study, etc.) without additional IRB approval
- You cannot use the data for any research that is not already described in your IRB protocol without additional IRB approval (if you change your hypothesis you must modify your protocol)
- You cannot share your research data with another researcher outside of your study team without additional IRB approval
- Any health information with HIPAA identifiers will be shredded or discarded by using recycling bins for confidential material found in clinic settings. For large item disposal of confidential material contact Environmental Services at 2-4976 or University Recycling at 25050.  
TABLE A: HIPAA Identifiers (Limited Data Set)  
1. Name 2. Postal address information, other than town or city, state, and zip code 3. Telephone numbers 4 Fax numbers  
| 5. Electronic mail addresses 6. Social Security number 7. Medical Record number 8. Health plan beneficiary numbers 9. Account numbers 10. Certificate/license numbers 11. Vehicle identifiers and serial numbers, including license plate numbers 12. Device identifiers and serial numbers 13. Web Universal Resource Locators (URLs) 14. Internet Protocol (IP) address numbers 15. Biometric identifiers, including finger and voice prints   |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
irb-hsr protocol investigator agreement
appendix sponsor sponsor information

1. **Explain the sponsorship for this study.**
This study is funded via a contract with ALLIANCE (cooperative group for clinical trials), which has a grant from PCORI to conduct this study. Do you confirm that you will obtain a contract/ material transfer agreement with the sponsor via the School of Medicine Grants and Contracts Office or the Office of Sponsored Programs (OSP) ospnoa@virginia.edu? Yes
irb-hsr protocol investigator agreement
appendix transfer of data outside

1. **Will any data be sent outside of UVa to any person at another institution other than the**
sponsor or the FDA (e.g. researcher outside of UVa)? Yes (data to be input in the PROMIS system) If YES, answer questions \# 2-5:
2. **What will be shared?**
Patients will complete questionnaires as described in this protocol via a webbased PROMIS system. Questions are about physical, psychological, and emotional well-being.  
3. Who will it be shared with? **PROMIS** 4. **What will they do with the data**? Store data for researchers in this UVA Research study.  
5. Will data be sent back to UVa? We can pull our own data from the PROMIS
database.  
| 6.   | What identifiers will be sent with the data? YES NO 1. Name 2.Postal address information, other than town or city, state, and zip code 3. Telephone numbers 4. Fax numbers 5. Electronic mail addresses 6. Social Security number 7. Medical Record number 8. Health plan beneficiary numbers 9. Account numbers 10. Certificate/license numbers 11. Vehicle identifiers and serial numbers, including license plate numbers 12. Device identifiers and serial numbers 13 Web Universal Resource Locators (URLs) 14. Internet Protocol (IP) address numbers 15. Biometric identifiers, including finger and voice prints 16. Full face photographic images and any comparable images  17. Any other unique identifying number, characteristic, code that is derived from or related to  information about the individual (e.g. initials, last 4 digits of Social Security #, mother's maiden  name, first 3 letters of last name.) x 18. Any other information that could be used alone or in combination with other information to  identify an individual. (e.g. rare disease, study team or company has access to the health information and a HIPAA  identifier or the key to the code)   |
|------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
irb-hsr protocol investigator agreement
7. how will data be

_x___ Web Based Data Entry (e.g website, database, registry): Encrypted and
irb-hsr protocol investigator agreement
password protected

If checked, do you confirm that you have verified with host site that data will be sent and stored in an encrypted fashion (e.g. via Secure FX, Secure FTP, HTTPS, PGP)? Yes