Irb waiver process tamu

An official website of the United States government

Here’s how you know

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

U.S. Dept. of Health & Human Services

IRB-HIPAA Waiver Documentation FAQs

Guidance for IRB-HIPAA Waiver Documentation FAQs Web Page

Issued by: Centers for Medicare & Medicaid Services (CMS)

Issue Date: January 01, 2020

My IRB didn’t approve my study, they exempted it from review. What does that mean?

Under the guidelines for the IRB review, a study may be exempted from review if the study has minimal risk to participants or it doesn’t qualify as human subjects research. This IRB outcome is acceptable to satisfy the CMS RIF DUA request requirements for IRB review and a waiver of informed consent; however, the IRB will still need to provide a HIPAA waiver of individual authorization.

My IRB says that my study is exempt and that they don’t need to provide a HIPAA waiver. What now?

CMS requires that a researcher provide documentation from an IRB that waiver of informed consent for human subjects participation has been obtained AND provide a waiver of individual authorization for release of health data (HIPAA waiver) for all RIF DUA requests . You must specifically request that the IRB provide documentation to satisfy both requirements – the Common Rule and HIPAA. Examples of acceptable language can be found in this ResDAC article.

I received approval from my IRB, but the notification they sent me doesn’t mention anything about a waiver of informed consent or a HIPAA waiver. What should I do?

You will need to communicate with the IRB about the need for documentation to satisfy both the requirement of a waiver of informed consent and a HIPAA waiver of individual authorization. CMS requires these for all RIF DUA requests. We have some examples of acceptable language. If you require further assistance, contact ResDAC.

If I am using participants, such as patients in my health system or an acquired list of patients, who are giving documented consent to participate, do I still need to have an IRB review my study?

Yes. IRB review is required. Depending on your consent contents, the IRB may acknowledge that it meets the Privacy Rule or HIPAA authorization requirements instead of providing a waiver of individual authorization (HIPAA waiver).

The data that I’m requesting don’t include identifiers, so how could I possibly obtain consent?

Even though the standard identifiers are not included in RIF data, the data files are, by definition, identifiable.

My IRB approval is expired or expires in a couple months. Is that OK?

No. You will need to provide an updated approval or renewal letter from your IRB. The DUA request review process takes time, so we recommend that your IRB expiration date be at least 4 months after your final, completed DUA request packet is submitted by ResDAC to CMS for review. Your ResDAC Executive Advisor will assist you with making sure the expiration date is far enough in the future, or submitting a renewal, if needed.

My organization doesn’t have an IRB. Now what?

You may use an independent IRB to review your study, which may charge a fee. The same type of documentation is required, including documentation that satisfies the Common Rule and a HIPAA waiver. Make sure to use a registered IRB.

I’m a graduate student working on a dissertation, but my school’s IRB won’t review my study because I’m not currently enrolled in classes. What do I do?

You may use an independent IRB to review your study, which may charge a fee. The same type of documentation is required, including a waiver of consent and a HIPAA waiver. Make sure to use a registered IRB.

Can you recommend an independent IRB?

No, we are unable to provide recommendations. However, a web search should reveal many options. Verify that the IRB meets the Common Rule requirements for IRBs and will provide the necessary documentation. Details about the Common Rule requirements for IRB membership, function, and operations may be found here: https://www.hhs.gov/ohrp/regulations-and-policy/regulations/45-cfr-46/index.html. The Department of Health and Human Services has a list of all registered IRBs here: https://ohrp.cit.nih.gov/search/irbsearch.aspx?styp=bsc

Do I have to wait for my IRB review results before I submit my draft request documents to ResDAC?

No. We can proceed with the ResDAC review while the IRB review is in process. We will accept requests if the study has been submitted to the IRB. The complete IRB documentation is required prior to submission of your request to CMS.

I received some documentation from my IRB, but I’m not sure if it meets the requirements. How can I tell?

You may submit the documentation to ResDAC and an Executive Advisor will review it and let you know if additional documentation or information is needed. You may also look at the examples to see if the documentation has the required components.

Do you have examples of IRB documentation and HIPAA waiver?

The study title on the IRB documentation is different from the study title I’m using for my DUA request. Is that a problem?

Yes. If the study titles are different, provide us with an explanation. We can review and let you know if a revised approval from the IRB with the correct study title is needed.

The Principal Investigator listed on the IRB documentation is different from the Principal Investigator we are listing for my study. Is that a problem?

Yes. If the PI is not consistent, provide us with an explanation. We can review and let you know if revised IRB documentation is needed.

I’m a graduate student working on my dissertation, but my school’s policy is that students cannot be listed as the Principal Investigator with the IRB. What do I do?

If your faculty advisor is listed as the Principal Investigator (as is usually the case under this type of policy), then provide that explanation when you submit your documentation to ResDAC. For other situations, contact ResDAC to discuss.

I have IRB documentation from a similar study that I am working on or completed. Can I use that for this DUA request?

No. You will need to have the IRB review the current study. Past approval does not equal current or future approval. DUAs are study-specific, so you must provide documentation that this particular study has been reviewed by the IRB.

My organization/institution will access the data through the Virtual Research Data Center (VRDC) environment. Do we need an IRB review?

Yes, researchers that receive physical data and those that access data in the VRDC must have IRB review and provide the required documentation.

Do all organizations need IRB review for each new RIF DUA request?

Yes. All organizations (academic, non-profit, and for-profit) requesting a research DUA for RIF data must have IRB review and provide the required documentation.

HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the guidance@hhs.gov.

DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.

Date Published: 9/15/2020