The CSU IRB reviews all research projects involving human subjects. The definitions of “Research” and “Human Subject” come from the US Department of Human and Health Services (HHS).

HHS Definition of Research – Both must be true:

• The activity is a systematic investigation: an activity that involves a prospective plan which incorporates data collection, either quantitative and/or qualitative, and data analysis to answer a question

               AND

• The activity is designed to develop or contribute to generalizable knowledge: designed to draw general conclusions (i.e., knowledge gained from a study may be applied to populations outside of the specific study population), inform policy, or generalize findings.

HHS Definition of Human Subject–

The research involves living individuals about whom an investigator will obtain either of the following:

Data through intervention or interaction with the individuals. Intervention includes both physical procedures by which data are gathered (for example, venipuncture) and manipulations of the subject or the subject’s environment that are performed for research purposes. Interaction includes communication or interpersonal contact between investigator and subject.

Identifiable private information.

Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record). Private information must be individually identifiable (i.e., the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects.

IRBs are frequently presented with questions regarding when Quality Improvement (QI), Demonstration Projects, and other similar activities also meet the definition of human subject research and require IRB review and approval.  While many QI and demonstration activities do not meet the definition of human subject research under the Common Rule or FDA, it is essential to understand that some projects may.  This is the case when the QI or demonstration activity is designed to accomplish a research purpose as well as the purpose of improving the quality of care or demonstrating the success/value of a program.  The following materials are included to assist the investigator and the IRB in assessing whether or not individual projects require IRB review and approval.

The intent to publish is an insufficient criterion for determining whether a QI or demonstration activity involves research.  Planning to publish does not necessarily mean that the project fits the definition of research; people seek to publish descriptions of non-research activities for a variety of reasons, if they believe others may be interested in learning about those activities.  Conversely, an activity may involve research even if there is no intent to publish the results.

To determine whether or not IRB review and oversight applies, the following questions should be addressed in order:

1. Does the activity involve research?
2. Does the research activity involve human subjects?
3. Does the human subjects research qualify for an exemption? (Note: At most institutions, the authority to determine a project exempt is assigned to individuals within the Human Research Protection Program and/or IRB )

Anonymized data may have previously been identifiable, but have since been de-identified, and a code or link no longer exists. An investigator has NO means for linking anonymized data back to a subject.

Anonymous data is data which was never linked to an individual. Coded data are not anonymous.

Data are coded when a link will exist between a unique code and an individual subjects’ identifiers such as name, medical record number, email address or telephone number. Generally, the study is collected with a “STUDY ID”, and a key is maintained where the STUDY ID is associated with the subject’s identifiers. As long as a link exists, data are considered indirectly identifiable and not anonymous, anonymized or de-identified.

A record in which identifying information is removed.

Under the HIPAA Privacy Rule, data are de-identified if:

1. the data do not include any of the 18 identifiers (of the individual or his/her relatives, household members, or employers) which could be used alone or in combination with other information to identify the subject. Note that even if these identifiers are removed, the Privacy Rule states that information will be considered identifiable if the covered entity knows that the identity of the person may still be determined.
2. Expert Determination Method

Information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual, and that the individual can reasonably expect will not be made public (e.g., a medical record).

Examples of Identifiable Private Information

• Names
• Date of Birth
• Medical Record Numbers
• Email Addresses
• Street Addresses
• Photographs
• Audio or Video Recordings
• IP Addresses

A set of data in which most of the protected health information has been removed. The following identifiers of the individual or of the individual’s relatives, employers or household members must be removed:

1. Names;
2. Addresses, other than town or city, state, and zip code;
3. Telephone numbers;
4. Fax numbers;
5. Electronic mail addresses;
6. Social security numbers;
7. Medical record numbers;
8. Health plan beneficiary numbers;
9. Account numbers;
10. Certificate / license numbers;
11. Vehicle identifiers and serial numbers (including license plate numbers);
12. Device identifiers and serial numbers;
13. Web universal Resource Locators (URLs);
14. Internet Protocol (IP) address numbers;
15. Biometric identifiers, including finger and voice prints; and
16. Full face photographic images and any comparable images.

PHI is individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes individually identifiable health information in education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv), and employment records held by a covered entity in its role as employer.