1. Advanced Topics in the Submission of Research Protocols to the Institutional Review Board (IRB) and the Office for the Protection of Human Subjects (OPHS) Maryann Rossi, PhD, CIM, CIP Accreditation and Education Manager OPHS ASAP Course; January 19, 2011 IRB 102

2. Participants will: Learn how the HIPAA Privacy Rule relates to research Know what Data and Safety Monitoring Plans are and when to have one Be able to identify reportable unanticipated problems and serious adverse events; know when and how to report them Understand concepts of waiver of informed consent/assent and waiver of documentation of informed consent/assent Learning Objectives

3. Organizational Plan Education Programs Conflict of Interest Investigators and Research Staff Compliance Oversight Communications System Institutional Review Board Investigational Drug Services Contracts and Grants Office for the Protection of Human Subjects Human Research Protection Program (HRPP) Components

4. Belmont Principles (1979) 1. RESPECT FOR PERSONS – Treat individuals as autonomous agents – Protections for persons with reduced autonomy 2. BENEFICENCE – Do no harm – Maximize possible benefits – Minimize possible harms 3. JUSTICE – Distribute research risks and potential benefits equally among those who may benefit from the research

5. Key PI Responsibilities Conduct research ethically and in accordance with regulations, CNMC policies, and IRB requirements Obtain and document informed consent and assent in accordance with regulatory requirements unless otherwise authorized by the IRB Protect subject privacy and data confidentiality Obtain IRB approval prior to implementing any protocol modifications Monitor the data to ensure subject safety and welfare

6. Report to the IRB unanticipated, serious events or other unanticipated problems that involve risks to subjects or others Submit Continuing Review reports on a timely basis to avoid protocol expiration Submit a final report to the IRB at study closure ***** Key PI Responsibilities (2) The PI bears the ultimate responsibility for his/her research staff and how the protocol is conducted.

7. 1 st Belmont Principle RESPECT FOR PERSONS Includes the right to privacy and confidentiality Privacy Is about people Refers to persons’ interest in controlling access to themselves Confidentiality Is about data Refers to methods for securing and sharing data

8. HIPAA Heath Insurance Portability and Accountability Act of 1996 (HIPAA) Protected Health Information (PHI) Includes individually identifiable information Covered Entities (CE): –Health Care Provider –Health Plan –Health Care Clearinghouse

9. 18 HIPAA Identifiers Name Geographic subdivisions smaller than a state (or initial 3 digits of ZIP code) All elements of dates (except year) directly related to an individual (e.g., DOB, date of admission) Telephone numbers / Fax numbers / E-mail addresses Social security numbers Medical record and health plan numbers Account numbers

10. HIPAA Identifiers (cont.) Certificate/license numbers Vehicle identifiers and serial numbers Device identifiers and serial numbers URLs and IP addresses Biometric identifiers (e.g., finger and voiceprints) Full-face photographic images Any other unique identifying number, characteristic, or code

11. Research Covered by HIPPA Uses individually identifiable health information Involves human beings, living or dead Doesn’t matter if it is or is not supported by the federal government or regulated by the FDA Research not covered by HIPAA uses only de-identified data “...health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.”

12. Implications for Research Investigator must obtain patient’s permission before using PHI –Part of the standard CNMC informed consent template Release of private information for research without patient’s authorization is a violation [some exceptions]

13. Options for Access to PHI Use only de-identified data Obtain patient’s written authorization Obtain HIPAA waiver from IRB Review data preparatory to research Decedent research Use limited data set –Data Use Agreement –Business Associate Contract (BAC)

14. Waiver of HIPAA Authorization Justification (must satisfy all 3 criteria): Use or disclosure of the PHI presents no more than minimal risk to the individual’s privacy Research cannot practicably be conducted without a waiver Research cannot be practicably conducted without access to and use of PHI

15. 2 nd Belmont Ethical Principle BENIFICENCE Includes ensuring that benefits outweigh risks Data and Safety Monitoring Plan (Greater than minimal risk studies) The research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects.

16. Data and Safety Monitoring Plan What events will be monitored? How often? Who will monitor them? – Individual investigator/independent M.D. – Internal monitoring group (study sponsor) – Independent Data Safety Monitoring Board (DSMB) To whom will the information from the monitoring be given? What are the “stopping rules,” if any?

17. Unanticipated Problems Unanticipated Problems Involving Risks To Subjects or Others Examples: Serious Adverse Events (SAEs) Protocol deviations Inadvertent disclosure of PHI Serious and continuing noncompliance

18. Adverse Events Most are not unanticipated problems –Adverse events expected in the context of known toxicities or side effects of the research procedures AND/OR –Due to the natural history of the underlying diseases and conditions Some are unanticipated problems Unanticipated problems include events that are not adverse events

19. OPRP Guidance; October 11, 2005 UPIRTSOs and AEs

20. Serious Adverse Events (SAEs) An untoward medical occurrence during research –E.g., Serious side effects due to study drug or procedure Hospitalization and/or prolongation of hospitalization of subject Results in the persistent or significant disability or incapacity of subject Death of subject

21. Reporting Internal SAEs (Those Occurring at CNMC) Report deaths within 24 hours Report other serious and unexpected events that are possibly, probably and very likely/certainly related < 5 days after learning of the events If the event at CNMC is serious or if CNMC is the Coordinating Center, report within 5 days, regardless of its relationship to study intervention

22. Reporting External SAEs (Those Occurring at Other Sites) Report events that are serious, unexpected and related within 30 days of learning of them

23. Protocol Deviation A one-time, unintentional action or process that departs from the IRB-approved study protocol, involves one incident, and is identified after the event occurs. Significant deviation: Directly or potentially disrupts the study progress, compromising study design and results or compromising the safety and welfare of study participants

24. Example: Informed Consent Irregularities MINOR Deviation: Subject/Parent did not receive a copy of the signed consent form. Upon discovery, a copy is given to the subject at the next visit, or mailed if the subject has since completed the study. SIGNIFICANT Deviation: Subject was enrolled without subject/parent signing an informed consent form. Upon discovery, the subject should immediately be consented.

25. Reporting Protocol Deviations Significant deviations must be submitted to the IRB within 10 business days of being identified.

26. 1 st Belmont Ethical Principle RESPECT FOR PERSONS Includes provisions for obtaining informed consent/assent Treat individuals as autonomous agents Right to know Right to choose Right to privacy and confidentiality Right to withdraw Additional protections for persons with reduced autonomy

27. Regulatory Requirements – Basic Elements of IC State that the activity is research Describe purpose and duration of study Describe procedures Identify experimental procedures Identify risks Identify benefits Disclose any alternatives to participation

28. Basic Elements of IC (cont.) Describe the extent of confidentiality Explain any available compensation and medical treatment for injury State whom to contact about study questions State whom to contact about subjects’ rights State whom to contact in the event of an injury State that participation is voluntary; right to refuse or withdraw

29. Waiver of Informed Consent/Assent Research poses no more than minimal risk Definition: The probability and magnitude of harm or discomfort anticipated in the proposed research are not greater, in and of themselves, than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests [in a healthy person]

30. Waiver of Informed Consent/Assent (cont.) Subjects’ rights and welfare are not adversely affected by waiver Research could not be practicably conducted without waiver Subjects will be provided with pertinent information after participation, if applicable CRF 46.102(i)

31. Documentation of Informed Consent/Assent Consent/Assent forms must be approved by IRB; must have approval stamp and expiration dates Forms must be signed and dated by subject or subject’s legally authorized representative (LAR) Pediatric research: Minor increase over minimal risk, no direct benefit requires signatures of both parents

32. Pediatric Risk Categories Not greater than minimal risk More than minimal risk with the prospect of direct benefit to the child Minor increase over minimal risk with no prospect of direct benefit Not otherwise approvable, but with potential to understand, prevent or alleviate a serious problem

33. Documentation of IC (cont.) Person obtaining consent must sign and date forms after the subject/LAR Copy is given to subject/LAR Re-consent required when subject reaches age of majority (age 18) and when substantive changes are made

34. Waiver of Documentation of Informed Consent Consent form is the only record linking subject to data and breach of confidentiality is major risk OR Activity involves no more than minimal risk and involves no procedures for which consent is normally required (surveys, blood draws) HOWEVER, documentation should be provided to subjects who request it

35. IRBear IRB EAR Welcome to IRBear The Institutional Review Board Electronic Application Review System

36. IRBear IRBear Overview Electronic system for submitting, approving, tracking, and managing IRB protocol submissions Available 24/7 from anywhere you can access the Internet http:www.irbear.org Uses Smart Forms which present study staff with only those questions that are applicable and relevant to the protocol These are the first steps toward making all submissions to the IRB and the entire review process PAPERLESS (no hard copies required)

37. IRBear IRBear Welcome Page www.irbear.org

38. IRBear Logging In to IRBear 1.User Name = First initial and last name 2.Default Password = User Name You will be required to reset your password the first time you log in. 3.To help maintain system security, do not select “Remember me”

39. Logging in takes you to your Personal Page

40. Intranet Resources http://intranet.cnmc.org/RESEARCH/DEFAULT.ASPX IRB submission forms HRPP policies and procedures CITI training information Educational presentations HRPP newsletter Staff contact information