University Requirements
Data holders whose archives or sources involving identifiable coded or private information are available on a restricted basis but have certain conditions for use and possession of their data. When a researcher wishes to access archives or restricted data sets that may contain identifiable or coded information about individuals, a Data Use Agreement (DUA) is required. A DUA addresses university issues such as limitations on use of the data, liability for harm arising from the use of the data, publication, and privacy rights that are associated with transfers of confidential or protected data. This DUA is contractual document between a “Data Users” (the UMBC investigator requesting access to information) and the “Data Set Source” (the organization or institution providing the data) describing the provisions used to transfer confidential or protected data that may be used for the purpose of conducting human subjects research.
The Office of Sponsored Programs (OSP) serves as the campus signatory for research-based Data Use Agreements. OSP is authorized to enter into contractual agreements, including DUAs, on behalf of UMBC to ensure compliance with appropriate policies and regulations. As investigators are not authorized to negotiate or sign these agreements on behalf of UMBC, DUAs must be submitted to OSP for final approval and sign-off. Researchers are not authorized to negotiate or sign these agreements and cannot sign DUAs on behalf of UMBC
Examples of data archives or restricted data sets where a DUA may (or may not) be required are found on the OSP Data Use Agreement FAQ site.
The IRB’s role
The IRB will review the proposed project if an investigator plans to use, study, or analyze identifiable private information for research purposes. Such data may have been collected under a previously approved human subjects use protocol (whether it be at UMBC or other institution) or available from a data source where it had collected for secondary research use purposes. This data may have restricted access use and/or procedures.
The following are instructions for preparing an application for Secondary Data Use Research:
1) Complete the Collaborative Institutional Training Initiative (CITI) training program
2) Please access the Kuali Protocols Portal to create an application describing the use of secondary use of data. The Kuali Protocol User Guide has a searchable table of contents to the specific sections of Guide to assist you in creating a protocol. The IRB will review from whom the data is obtained, the protective mechanisms planned to protect the identity of persons, and perform an evaluation of the security of procedures. Additionally, the IRB, via the ORPC, will consult with the UMBC Department of Information Technology (DoIT) to perform a risk assessment of the procedures stated in the application and/or perform an onsite inspection of data access and storage facilities.
Secondary data use research of this type would fall under expedited category 5 – research involving use of private data, documents, records or biological samples or specimens that have already been collected. Please upload to Kuali IRB all relevant protocol documents (versions of license agreements, DUA drafts, etc.).
Review and approval of this protocol will take approximately three-four weeks. The length of time a protocol will take to be approved and an approval letter received depends on the type or level of review required. The ORPC staff, working in concert with the IRB, will make every effort to work with investigators to process proposals promptly. If additional changes are needed, it can take longer depending on reviewer questions or protocol load.
Submission of an IRB application and the DUA to the Office of Sponsored Programs may be done concurrently.
The IRB may provide conditional approval of a protocol if it is needed in order to obtain a Data Use Agreement signed, but final IRB approval will not be granted until a copy of the signed Data Use Agreement is received from the investigator with required security measures in place.
HIPAA
Investigators should also consider if the HIPPA Privacy Rule applies when investigator s want to obtain, create, use, and/or disclose individually identifiable health information. Research with data that includes personal identifiers may require the use of HIPAA Authorization to use (for individual authorizations to access PHI) or a HIPAA Waiver of authorization (for request of large sample size where individual authorizations are impractical and the request meets privacy rule specifications). The Kuali protocol application requests specific information to determine if the Privacy Rule applies. In either case, the ORPC will generate an Authorization or Waiver for the investigator to upload to the Kuali protocol file.
Have a Kuali technical issue or problems with access? Contact the ORPC on this online form and we’ll send your issue to VPR Research Administrative Systems
IRB Application and Pre-review Consultation
The ORPC staff is available to answer any questions regarding the IRB submission process and IRB review of research studies. We also provide pre-review consultation to discuss all aspects of IRB review, from preparing the submission to completion of the study. The ORPC will send comments to investigators within one week if there are revisions required. Final versions are then forwarded to the IRB for review. If you have any questions, please contact us at compliance@umbc.edu.
Continuing Review
Using the dates specified in the initial protocol application, the IRB will provide a period of time to conduct the approved protocol. Aside from pre-2018 Common Rule approved protocols, expedited approvals do not require continuing review. Investigators will be informed of a continuing review requirement if protocols meet certain criteria, including, but not limited to the following: expedited protocols approved by the IRB before 01/21/2019, inclusion of vulnerable populations, studies of criminal behavior, substance abuse and/or use of mental health data. If you are notified, please access the Kuali Protocols Portal to create a Renewal Report. The Kuali Protocol User Guide has a searchable table of contents to the specific sections of Guide to assist you in creating a protocol.
Post Approval Monitoring
Studies reviewed and approved under the Expedited Review will be subject to post-approval monitoring by the ORPC to ensure that conduct of studies are in accordance with the IRB approved protocol.
Protocol Amendments
Investigators are required to inform the IRB of any changes planned for previously approved research. Kuali IRB uses the term “amendment”, rather than “modification”. Please access the Kuali Protocols Portal to create an amendment to a previously approved protocol. These changes must be submitted at least two (2) weeks beforehand. The Kuali Protocol User Guide can assist you in creating this amendment.