Chapter 14: Research with Unique Regulatory considerations

Chart Reviews

Reviewing medical charts or accessing medical records for research purposes requires IRB review and approval of research and/or obtaining applicable waivers. The level of IRB review depends on the nature of the data collected, if any identifying information is recorded, and whether study data already exist (retrospective) or will be created in the future (prospective). In the iStar application, investigators are asked to provide the range of dates for the data and a list of the specific data fields that will be extracted from medical records.

Informed Consent and HIPAA Authorization Requirements 

Medical chart review and case studies may require submission to the IRB for a waiver of informed consent and/or HIPAA authorization form requirements.

Informed Consent Waiver

The IRB may authorize a waiver of informed consent for chart review research when the following criteria are met:

• The study involves no more than minimal risk to participants.
• The waiver will not adversely affect the rights and welfare of participants.
• The research could not practicably be carried out without the waiver.
• When applicable, participants are provided with additional pertinent information after participation.

HIPAA Authorization Waiver

The IRB may approve a waiver of the requirement for a Health Insurance Portability and Accountability Act (HIPAA) authorization for chart review research if the following criteria are met:

1. The use or disclosure of protected health information involves no more than minimal risk to the privacy of individuals, based on, at least, the presence of the following:
2. An adequate plan to protect the identifiers from improper use and disclosure.
3. An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research unless there is a health or research justification for retaining the identifiers or retention is required by law.
4. Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information is permitted.
5. The research could not practicably be conducted without access to and use of the protected health information and there is no intention of reaching out to contact those whose medical records are being accessed.

HIV test results, mental health diagnosis and treatment records, and drug or alcohol treatment records cannot be recorded for chart review research conducted under a waiver of HIPAA authorization. 

Case Studies

When Case Study Meets the Definition of Human Subject Research

Case studies  must be submitted to the IRB for review if the definition of “Human Subjects Research” is met, as defined in the regulations by U.S. Department of Health and Human Services (DHHS). 

DHHS Definition of Research (45 CFR 46.102) “A systematic investigation, including research development,    testing and evaluation, designed to. develop or contribute to generalizable knowledge.

While many institutions require a case study of two, three, or more cases be submitted to the IRB, USC’s requirement for IRB submission is based on the intent of the report, not on the number of cases to be reviewed.

When Case Study Is Not Considered Human Subjects Research

A case study does NOT meet the federal definition of “Human Subjects Research” if all of the following conditions are met:

• The activities are limited to only reporting the facts. There is no intention to form a hypothesis, draw conclusions or generalize findings to a population outside of the sample case(s); AND
• Identifiable information is NOT obtained from a State of California Agency (such as CA Dept. of Public Health, county registrar, etc.); AND
• There is no plan to collect information that would not normally be placed in the records.

Many journals require a letter from the IRB stating that the project was either approved by the IRB  or that IRB review was not required. If verification of IRB review is required for the purpose of submission for journal publication, the project must be submitted to the IRB via iStar.

HIPAA Privacy Rule Requirements

While a project may not require IRB review and approval, there may be implications for HIPAA compliance when accessing medical records. HIPAA forms are located on the USC Office of Culture, Ethics and Compliance website (search: HIPAA Forms)

If the research involves only the analysis of pre-existing data that have been fully de-identified to the HIPAA standard, an IRB submission is not required nor is there the need to obtain a signed HIPAA authorization form from the patient(s), because such study is not considered “human subjects research” – it does not involve an identifiable human subject, or PHI

When extracting de-identified data from medical records or other identifiable sources, for use in  research, case study, or to create a de-identified database for future research,  an application must be submitted to the IRB to obtain a Waiver of HIPAA Privacy Authorization, or IRB approval with plans to obtain a signed HIPAA authorization form from the patient(s).

If  identifiable Protected Health Information (PHI) will be accessed, but not recorded by the investigator, the HIPAA Privacy Rule applies and the investigator will need to comply with the regulatory requirements to access the PHI, which could include obtaining a:

• Waiver of HIPAA Authorization from the IRB,
• HIPAA Authorization for Research from the patient(s),
• “Request for Protected Health Information for Preparatory Research Activities” certification from the USC Office of Culture, Ethics and Compliance

A generic template HIPAA Authorization Form may be customized for case studies if necessary.  Contact the USC Office of Culture, Ethics and Compliance for details.

Case Study Involving the Deceased

The HIPAA Privacy Rule protects individually identifiable health information about a decedent for 50 years following the date of the death of the individual. Under federal regulations a covered entity can provide access to protected health information (PHI) for decent research purposes with no identifiers linked to living persons. Requests for such access must be approved by USC Office of Culture, Ethics and Compliance and requires completion of a decedent research application available on the Compliance’s website. 

Human biological materials include blood, urine, saliva, hair, nails, cells, tissue samples (fresh, frozen, or paraffin blocks), other body fluids or tissues, and molecules derived from these materials. Common sources of specimens used in research include:

• Specimens collected during previous research projects
• Stored (archived) tissue from diagnostic testing or surgery
• Tissue that is discarded during routine medical care
• Specimens obtained from repositories at USC or outside Institutions
• Specimens purchased from commercial tissue banks

The use of human biological materials in research requires review by the IRB. The level of review depends on the potential risks to participants, how the specimens were collected or will be collected, and what information is associated with the specimens. Refer to Chapter 6 – Types of IRB Submissions for the expedited and exempt review categories that specifically refer to specimens. The IRB makes the determination about the appropriate review type, not the investigator.

Specimen research involves the potential risk of loss of confidentiality. The level of risk is determined by the type of information obtained with the specimen. Specimens are often maintained with associated medical information. Specimens are generally labeled in one of three ways:

• Identified: The specimen is directly labeled with personal identifying information (such as a name, patient number, or medical record number)
• Coded: The specimen is labeled with a code that researchers can link to personal identifying information
• Anonymous: The specimens are not labeled with direct identifiers or a code; researchers cannot retrieve any personal identifying information

Specimens that are truly anonymous carry no risk of loss of confidentiality. Specimens that have direct identifiers carry the greatest risk of loss of confidentiality. Whenever possible, investigators should obtain anonymous or coded specimens to minimize potential risks.

Investigators who obtain coded specimens but do not hold the link to identifiers and cannot obtain identifiable information about the participants are not conducting human subjects research per OHRP Guidance on Research Involving Coded Private Information or Biological Specimens. At USC, investigators may submit this type of research to the IRB using the “Coded Specimens/Data” review form in the iStar application.

Research that uses only cadaver specimens is not considered human subjects research under federal regulations. Research that uses only anonymous specimens is also not considered human subjects research. Investigators conducting research on these types of specimens do not need to submit the research to the IRB.

Newborn Dried Blood Spots (DBS)

The Newborn Screening Saves Lives Reauthorization Act of 2014, which did not allow for waiver of consent for federally funded research with newborn dried blood spots, is no longer in effective as of January 21, 2019.

As a result of this change, secondary research with non-identified newborn DBS would be treated in the same way as secondary research with any other type of non-identified biospecimen – such research is not considered research with human subjects

Non-identified newborn dried blood spot (DBS) is considered secondary research using non-identified biospecimens and therefore is not considered research with human subjects.

Human Fetal Tissue Research

In June 2019, HHS released a statement on changes to regulations and the NIH Grants Policy Statement (GPS) related to research involving human fetal tissue (HFT).

NIH notice: NOT-OD-19-128 details Requirements Regarding Proposed Human Fetal Tissue Research and applies to proposal submissions for due dates and solicitations issued on or after Sept. 25, 2019.

Research involving HFT is defined as research involving the study, analysis, or use of primary HFT, cells, and derivatives, and human fetal primary cell cultures obtained from elective abortions and includes the following:

• human fetal primary or secondary cell cultures, whether derived by the investigator or obtained from a vendor
• animal models incorporating HFT from elective abortions, including obtaining such models from a vendor
• derivative products from elective abortion tissues or cells such as protein or nucleic acid extracts
• any human extra-embryonic cells and tissue, such as umbilical cord tissue, cord blood, placenta, amniotic fluid, and chorionic villi, if obtained from the process of elective abortion.

          The definition of research involving HFT does not include the following:

• human fetal primary or secondary cell cultures, if cells were not derived from an elective abortion
• already-established (as of June 5, 2019) human fetal cell lines (e.g. induced pluripotent stem cell lines from human fetal tissue, immortalized cell lines, differentiated cell lines)
• derivative products from human fetal tissue or cells (e.g. DNA, RNA, protein) if not derived from elective abortion
• human extra-embryonic cells and tissue, including, but not limited to, umbilical cord tissue, cord blood, placenta, amniotic fluid, and chorionic villi if not derived from elective abortion
• human fetal cells present in maternal blood or other maternal sources
• embryonic stem cells or embryonic cell lines
• research on transplantation of HFT for therapeutic purposes (because of the statutory provision(s) addressing such research).

Research grant applications that propose to use HFT from elective abortions must meet    specific requirements in applications for: the cover letter, research plan, budget      justification, and budget details.

Adding HFT to an already funded project is considered a change of scope & requires a competing revision application which also must follow NOT-OD-19-028 guidance.

These requirements are in addition to the existing NIH Grants Policy Statement on Human Fetal Tissue Research (4.1.14) and NIH expectations to obtain informed consent (NOT-OD-16-033).

Application Requirements

The iStar submission application must include a detailed justification for use of HFT using this heading “Human Fetal tissue Justification”.

Contact USC Department of Contract and Grants regarding proposal budget change requirements as applicable.

Resources

• NIH: NOT-OD-19-128 – Requirements Regarding Proposed Human Fetal Tissue Research
• NIH Grants Policy Statement Human Fetal Tissue Research 4.1.14
• NIH: NOT-OD-16-033 – Informed Consent for Human Fetal Tissue Research
• HHS June 5, 2019 Statement

Secondary data analysis is research on subject information or specimens originally obtained for prior research or non-research purposes. Secondary data analysis may require IRB review depending on the source of the data and whether it contains identifiable private information.

Identifiable Information and Biospecimens for Secondary Research

An investigator who plans to analyze an existing data set of individual identifiable information should submit an application for IRB review and establish a data use agreement. If the data set contains no direct identifiers or coded identifiers, the project is not human subjects research (see Section 6.1 – Human Subjects Research: What is and What is Not)

If the data set contains identifiers, and does not contain private information, the project is not human subjects research. Otherwise, the project may be eligible for expedited review. The IRB may waive informed consent if research is minimal risk, the rights and welfare of the subjects are not adversely affected, the research could not practicably be carried out without the waiver, and, when appropriate, subjects are provided with pertinent information after participation.

Material Transfer Agreements (MTAs)

Transfer of materials among collaborators requires the use of Material Transfer Agreements (MTAs). MTAs ensure USC’s rights are protected when specimens or reagents are shared with colleagues or private entities.

An MTA is a research contract between a provider and recipient of research materials which governs the terms and conditions under which the material may be used. An MTA protects the intellectual and other property rights of the provider and generally addresses:

• Limits on the use of the research materials, inventions, and results
• Prohibitions on the redistribution of the material
• Conditions of use, including prohibitions of use in animals or humans
• Conditions for publication, usually with provisions that the manuscript must be seen by the donor before submission for publication
• A hold-harmless cause, meaning that the donor has no liability resulting from the use of the material

There are two main types of MTAs: incoming and outgoing. MTAs at academic Institutions fall into these categories:

• Transfers between academic or non-profit research Institutions
• Transfers from industry to academia
• Transfers from academia to industry

USC is a member of the Uniform Biological Material Transfer Agreement which was

developed by the NIH to encourage the signatory Institutions to share research materials.

MTAs need to be reviewed to ensure compliance with USC policies, principles and guidelines, and all MTAs must be signed by an authorized representative of USC.

Review and approval of MTAs is conducted by the Senior MTA Administrator of the USC Stevens Institute (https://stevens.usc.edu/researchers/mta-cda/).

Additionally, IRB review and HIPAA consideration may apply when human specimens that contain identifiable subject information are transferred among Institutions.

The banking of specimens/data refers to the creation of tissue banks and/or databases (repositories) to collect, store, and distribute human specimens and data for future research purposes. Repository activities involve three components:

• Collection of specimens/data
• Storage and management of the specimens/data
• Distribution of specimens/data to “recipient” investigators for use in future research projects

Research Repositories

If specimens or data were collected for research purposes, it is a research repository. Collection of specimens/data, repository storage or data management, and use of specimens or data are all considered research activities and require IRB review and approval.

Repository Data Not Considered Human Research

If specimens or data were originally collected for non-research purposes AND were added to the repository/database without any identifiers or links to identifiable private information, it is a “non-research” repository/database. Studies using specimens/data from non-research repositories or databases are considered Not Human Subjects Research (Refer to Section 6.1 – What Is Not Human Subjects Research).

Specimen/data repositories may include two kinds of specimens/data: (1) those collected with the expressed purpose of distribution to other investigators, and (2) those collected by individual investigators with no original intent to share with others, but which are later shared as part of a repository. Any collection which contains specimens/data that are potentially identifiable, either directly or indirectly with a code, and are distributed to someone other than the named investigator(s) making the collection, regardless of the original intent, is considered to be a repository requiring IRB oversight.

Establishing a Repository at USC

Investigators who collect directly or indirectly identifiable specimens/data require IRB review at the institution of collection (even if different from the site of the repository). Under most circumstances, written informed consent from the subject is required and HIPAA authorization may be required. See Section 9.5 – Basic Elements of Informed Consent for consent requirements.

An investigator may establish a repository for their individual use or with the intention to share the data.

Distribution of Specimens/ Data from a USC Biorepository

Investigators must follow the operating procedures and distribution conditions described in the approved IRB application. These conditions must consider the privacy of the individuals from whom the specimens/data came, the sharing options dictated by participants in the informed consent, and the intent of the person to whom the specimens/data are sent. The recipient of the specimens/data must abide by the conditions specified. Research website page See USC Biorepository Policy
http://policy.usc.edu/biorepositories/

Storing Specimens / Data Outside of USC

If a USC investigator wishes to send specimens/data to a repository located at an external Institution or organization, the investigator must include a copy of the external site’s IRB approval letter and a Data Use Agreement for operation of the repository in the USC IRB submission.

The IRB at the external site where the repository is located must approve and maintain oversight of a protocol that: (a) specifies the conditions under which data and specimens may be accepted and shared with other researchers and (b) ensures adequate privacy protections for subjects contributing to the repository.

Helpful Link

• • USC Biorepository Policy:
    http://policy.usc.edu/biorepositories/

• • HRPP Website – Biospecimen & Data Repositories

• • OHRP “Issues to Consider in the Research Use of Stored Data or Tissues”
    http://www.hhs.gov/ohrp/policy/reposit.html

• • Research Repositories, Databases, and the HIPAA Privacy Rule
    https://privacyruleandresearch.nih.gov/research_repositories.asp

NIH-funded studies that generate large-scale human genomic data are subject to the NIH Genomic Data Sharing (GDS) Policy. According to the GDS Policy, investigators who intend to use research or clinical specimens collected or cell lines created after January 25, 2015, to generate genomic data may only do so with consent, even if the data are generated from specimens that are de-identified. NIH-designated data repositories will not accept genomic data derived from specimens or cell lines collected or created after January 25, 2015, without consent. NIH strongly encourages investigators seeking consent to include consent for future research use and broad sharing of genomic and phenotypic data generated from the specimens or cell lines.

NIH also recognizes that in some circumstances broad sharing may not be consistent with the consent of the research participants whose data are included in the dataset. If the research that involves the generation of genomic and phenotypic data is part of a larger study, such as a clinical trial, and a participant declines to consent to future research use and broad sharing of their data, the participant should not be excluded from the larger study on that basis. If future research use and data sharing are intrinsic to the study, investigators may decline to enroll participants who are unwilling to provide consent for future research use and broad data sharing.

Guidance for Consent under the GDS Policy

This guidance provides information to be tailored to individual studies and conveyed to prospective participants during the consent process in order to meet GDS Policy expectations. This document will be updated, as appropriate.

In order to meet the expectations for future research use and broad sharing under the GDS Policy, the consent should capture and convey in language understandable to prospective participants information along the following lines:

• Genomic and phenotypic data, and any other data relevant for the study (such as exposure or disease status) will be generated and may be used for future research on any topic and shared broadly in a manner consistent with the consent and all applicable federal and state laws and regulations.
• Prior to submitting the data to an NIH-designated data repository, data will be stripped of identifiers such as name, address, account and other identification numbers and will be deidentified by standards consistent with the Common Rule. Safeguards to protect the data according to Federal standards for information protection will be implemented.
• Access to de-identified participant data will be controlled, unless participants explicitly consent to allow unrestricted access to and use of their data for any purpose.
• Because it may be possible to re-identify de-identified genomic data, even if access to data is controlled and data security standards are met, confidentiality cannot be guaranteed, and reidentified data could potentially be used to discriminate against or stigmatize participants, their families, or groups. In addition, there may be unknown risks.
• No direct benefits to participants are expected from any secondary research that may be conducted.
• Participants may withdraw consent for research use of genomic or phenotypic data at any time without penalty or loss of benefits to which the participant is otherwise entitled. In this event, data will be withdrawn from any repository, if possible, but data already distributed for research use will not be retrieved.
• The name and contact information of an individual who is affiliated with the institution and familiar with the research and will be available to address participant questions.

In order to meet the NIH expectations under the GDS Policy, for research projects for which the IRB has granted a waiver of some or all of the required elements of informed consent under 45 CFR 46.116(d), or consent is not required because the activity is not subject to 45 CFR 46, investigators will still need to seek or document consent for future use and broad sharing of genomic and phenotypic data. At minimum, the information described above should be provided to prospective participants. Investigators may request exceptions to the NIH consent expectations for compelling scientific reasons.
Additional guidance for institutions and investigators can be found on the GDS Policy website at http://grants.nih.gov/grants/gwas/index.htm

NIH Management of Genomic Summary Results Access

NIH has released guidance that allows unrestricted access to genomic summary results for most studies supported by NIH. For detailed information refer to: November 01, 2018 Guidance for Genomic Summary Results Access

NIH Policy for Data Management and Sharing

On October 29, 2020, the National Institutes of Health (NIH) issued the Final NIH Policy for Data Management and Sharing. This policy, which will become effective January 25, 2023, is  summarized by the NIH as follows:

This policy establishes the requirements of submission of Data Management and Sharing Plans and compliance with NIH Institute, Center, or Office (ICO)-approved Plans. It also emphasizes the importance of good data management practices and establishes the  expectation for maximizing the appropriate sharing of scientific data generated from NIH-funded or conducted research, with justified limitations or exceptions. This Policy  applies to research funded or conducted by NIH that results in the generation of scientific data.

Genetic information is uniquely personal information. Disclosure of genetic information has the potential to influence employment, insurance, finances, education, family relationships, and possibly self-perception. Therefore, genetic information collected during research must be carefully managed to protect individuals or groups from stigmatization, discrimination, or psychological harm.

Research involving analysis of genetic material can be broadly categorized as genetic testing or genetic research.

Investigators who are conducting genetic research must address the following topics in the iStar application and informed consent form:

• • Availability of a geneticist or genetic counselor to counsel participants who receive results of genetic testing

• • When appropriate the consent will include whether the research will, or might include whole genome sequencing (i.e., sequencing of a human germline or somatic specimen with the intent to generate the genome or exome sequence of the specimen.

• • The informed consent must include a statement regarding whether clinically relevant research results, including individual research results, will be disclosed to subjects, an if so, under what circumstances.

• • Participants’ rights to opt out of genetic research, to opt out of future research on their genetic specimens, and to request destruction of genetic specimens

Secondary Subjects in Genetic Research

Family members who are not enrolled as participants but about whom information is collected are called “secondary subjects”. Participants may be asked to describe the age, gender, health information, social history, and relationship of family members. The privacy of these secondary subjects must be protected, even though they are not enrolled as participants. The IRB may require informed consent from secondary subjects or may grant a waiver of informed consent for secondary subjects.

In Genetic research investigators sometimes incidentally learn sensitive information about members of the subjects’ family. Subjects and subjects’ family members may or may not want the information known. Investigators conducting genetic research in families must plan ahead for this situation and state whether or not the information will be revealed to participants.

Human Gene Transfer Research (“Gene Therapy”)

Human gene transfer “gene therapy,” refers to the process of transferring specially engineered genetic material (recombinant DNA or RNA derived from recombinant DNA) into a person. Gene transfer research has additional reviewing, reporting, and consent form requirements because of the high-risk nature of the technology.

At the institutional level, human gene transfer must be reviewed by the IRB and Institutional Biosafety Committee (IBC). For additional information on research involving recombinant DNA, see the USC IBC website. The USC IRB and Biosafety Committee will determine whether individual human gene transfer trials may benefit from review by the NIH Recombinant DNA Advisory Committee (RAC).

Federal Oversight: FDA, NIH, RAC

FDA

The FDA determines whether a sponsor may initiate study of a gene transfer product and, ultimately, whether it is safe and effective for human use. Sponsors of gene transfer products must test their products extensively and meet FDA requirements for safety, purity, and potency before they can be administered to humans or sold in the United States.

NIH

Institutions that receive NIH funding must comply with: NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules. NIH Guidelines articulate standards for investigators and Institutions to follow in order to ensure the safe handling and containment of recombinant DNA and products derived from recombinant DNA. *

Recombinant DNA Advisory Committee (RAC)

The Recombinant DNA Advisory Committee is a federal committee that provides recommendations to the NIH Director related to basic and clinical research involving recombinant or synthetic DNA.

Review of individual human gene transfer protocols are limited to cases in which the IBC and or an IRB determine that a protocol would significantly benefit from RAC review and meets one or more of the following criteria:

1. • The protocol uses a new vector, genetic material, or delivery methodology that represents a first-in-human experience, thus presenting unknown risks;

1. • The protocol relies on preclinical safety data that were obtained using a new preclinical model system of unknown and unconfirmed value; or

1. • The proposed vector, gene construct, or method of delivery is associated with possible toxicities that are not widely known and that may render it difficult for oversight bodies involved in the review at an initial site(s) to evaluate the protocol rigorously.

• • NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules

All females who are of child-bearing potential being considered for participation in a research study, in which there is a possibility of harm to a fetus from the study interventions, must have a negative pregnancy test before undergoing any study-related activities with a potential risk to a fetus. Protocols where the study interventions themselves do not pose a potential risk to a fetus, even if the interventions the individual may undergo for routine or standard care are greater than minimal risk, (for example, a study where the intervention was the collection of blood samples following surgery that is part of the individual’s routine care) would not require pregnancy testing or the use of contraception.

Although in most cases exclusion of pregnant women from research studies is justifiable based on uncertainty about fetal risks or on the potential effect of the physiological changes accompanying pregnancy on measures and outcomes of interest, there may be circumstances where the potential benefits to mother and/or fetus outweigh the risks—for example, in the case of a potentially life-threatening condition in the mother that poses a greater risk to a fetus than study interventions. Such cases must be considered by a convened IRB with appropriate expertise present prior to the onset of any study activities.

Confidentiality is the most sensitive aspect of AIDS research from the perspective of the rights and welfare of the subjects. Improper disclosure could have severe consequences for research participants, by threatening family relationships, job security, employability, or ability to obtain credit or insurance. In light of these risks, special precautions should be taken to preserve confidentiality. Limits to confidentiality should be carefully explained to potential subjects so they can make fully informed decision about participating.

The protocol must clearly state who is entitled to see records with identifiers, both within and outside the project. This statement must take into account the possibility of a review of records by the funding agency and by FDA officials if the research is subject to FDA regulations 21 CFR 50. The informed consent form must disclose that positive HIV tests will be reported to public health agencies.

California Law and HIV Research

The California Health and Safety Code (Section 121075-121125) provides additional protections for research records in studies relating to HIV or AIDS.

“Confidential research records” includes any data in a personally identifying form (such as name, social security number, address, employer or other information that could, directly or indirectly, lead to the identification of the individual research subject) developed or acquired by any person in the course of conducting research relating to AIDS.

Confidential research records developed or acquired by any person in the course of conducting research, or a research study relating to AIDS, shall be confidential and shall not be disclosed by any person in possession of the research record, nor shall these records be discoverable, nor shall any person produce any confidential research record except in the following situations:

• Confidential research records may be disclosed in accordance with the prior written consent of the research subject to whom the confidential research records relate, but only to the extent, under the circumstances, to the persons and for the purposes the written consent authorizes. Any disclosure made pursuant to such prior written consent shall contain the following statement:

  This information has been disclosed to you from a confidential research record the confidentiality of which is protected by state law and any further disclosure of it without specific prior written consent of the person to whom it pertains is prohibited. Violation of these confidentiality guarantees may subject you to civil or criminal liabilities.

Confidential research records may be disclosed without prior written consent to:

• • Medical personnel for a medical emergency, as relevant
  • The California Department of Health Services for the conduct of a special

The content of any confidential research record shall be disclosed to the research subject, the legal representative of the research subject if the research subject is a minor, or the personal representative of a deceased research subject to whom the record pertains within 30 days after a written request is made for such records by the research subject or the legal representative.

For additional information on California laws, please visit: The Center for HIV Law & Policy

Policy on Informing Subjects about HIV Serostatus

It is the policy of the IRB, as required by the Public Health Service (PHS), that when HIV testing is conducted as part of a research project, individuals whose test results are associated with personal identifiers must be informed of their test results and be provided with the opportunity to receive appropriate counseling. Individuals may not be given the option to “not know” the results, either at the time of consenting to be tested or thereafter. This policy does not apply to testing situations in which subjects consent to be tested and where results cannot be linked to individual subjects by anyone other than the subjects themselves.

Counseling

Any person tested for HIV infection should receive the results of their tests and counseling in a timely fashion from an individual qualified to provide test counseling and partner notification services.

Exceptions to Informing Subjects about HIV Serostatus

• • Individual Subjects
    When there are compelling and immediate reasons that justify not informing an individual of their positive HIV test results – the details of the exception shall be documented by the responsible individual(s). The investigator must promptly report the exception to the IRB without identifying the individual.

• • Protocol Design
    An exception to informing subjects of their test results may be permitted with the
    advance approval of the IRB

Survey research is a research method that obtains data through the use of questionnaires, interviews, and focus groups. Survey research may involve greater than minimal risk. For example, a survey or interview that asks questions about sensitive topics (childhood abuse, sexual functioning, immigration status) are not minimal risk if identifiers are kept. These questions may cause emotional stress, discomfort, or may have legal or social implications, and therefore may require full IRB review. See also Online Surveys – 14.11.

Social Media Emergence and Dominance

Social media (SM) are web-based/mobile based online systems that enable the creation and global sharing of information and ideas from the very personal to the political and philosophical. SM also enables collection of large amounts of data that can be used for research, increasing the power to understand humans. Human subject regulations apply to social media studies in the same way that they apply to other data collection studies. Therefore, investigators must exercise caution, as described below.

Social Media Differences from Traditional Research

Research in SM spaces involves techniques and policies found in traditional research, except:

• • Entry platform requires terms and conditions in corporate legal language.

• • Data volumes are exceptionally large and global in scope.

• • Privacy protections in SM company user agreements provide exceptions that enable marketing and commercialization of data.

• • SM platforms may enable tracking and re-identification.

• • Online identities may be easily created, faked, or programed (bots) and minors
    cannot be verified.

Protecting Social Media Data

Social media data must be carefully protected because it has the potential to cause embarrassment, reputational damage, or prosecution. When possible, data relating to sensitive topics should be de-identified or encrypted.

Definitions

1. • Social media: Web or mobile-device based services that provide ways for users to interact, such as, discussion groups, or other information sharing services that support messaging, video, sound and image posting; commenting and other social medial platforms for interaction, etc. Social media sites include, but are not limited to, Twitter, LinkedIn, Snapchat, Facebook, Instagram, Pinterest, or internet blog sites.

1. • Interaction: Includes communication, or interpersonal contact, between the study team and human subjects. The interaction can include, for example, interviews, focus groups, dialogue across a LISTSERVE or newsgroup, or any exchange via social media.

• • Intervention: Both physical procedures by which data are gathered (e.g., education program, drug treatment) and manipulations of the human research participant (e.g., providing information or responding to postings) or the human research participant’s social media environment (i.e., curation of content, deception) that are performed for research purposes (adapted from 45 CFR 46.102).

Manipulations of internet environments may include testing of different website interfaces or provision of different responses to web queries.

Expectations

Expectations are explained below for two types of social media research: “observational” and “participatory.”

1. Observational research: Research that involves data collection techniques that are observational in nature. There is no direct contact with human subjects about whom data are collected. Examples include: Twitter feeds, Facebook profiles or postings, information from chat rooms, etc. Depending on the Terms and Conditions of the site, it might not be permissible to conduct automated data collection methods (i.e., scrapping, crawl, cache content).

   Observational data may be public or private. Public data are obtained from public sites, available to all users. Private data are obtained from SM companies or other data holders and may include data that are concealed from ordinary users. Private data are governed by additional policies or agreements associated with the provider of the data.

   • • Investigators must follow all agreed to terms of service of the site.
   • • The study team must not use a false identity or deception to collect data.
   • • The terms of the study, agreement of use (data use agreement), and whether
       the data is public or private, dictates whether the investigator must de-identify the data (de-identification includes not identifying or recording usernames,
       paraphrasing instead of using direct quotes, etc.).
   • • Investigators should not elicit information from other sources to establish the
       identity of individuals, such as those that use pseudonyms to conceal their
       identity.
   • • In some cases, this research is not considered to be human subjects research,
       but caution is recommended. Submit an IRB application if there is any question whether a study qualifies as human subject research.
2. Participatory research: Research that actively engages the SM user. Some examples include game or role playing or the researcher manipulating the online environment with the intent to assess reactions or responses. In an IRB submission the researcher must:
   • • identify how the actions of the research may impact the SM user.
   • • explain if vulnerable populations, such as minors, will be observed or
       enrolled, especially for communities or sites that use pseudonyms.
   • • indicate whether data will be collected about secondary subjects those who have not directly consented but have interacted with a research subject and
       whether they will be de-identified
   • • if possible, screen for minors, prisoners, and other vulnerable populations,
       especially if the platform lends itself to vulnerable populations participating.
   • • explain how subjects’ confidentiality will be protected (see the definition of
       confidentiality above).
   • • indicate how subjects’ consent will be obtained or explain why not applicable.
   • • indicate how anonymity of data will be obtained or explain why not applicable.
   • • provide an example of what the prospective subjects will see (i.e. a “screen
       shot”).
   • • ensure that the site’s published terms of service permit the research to be
       conducted. If there is no mention of research in the terms of service, the PI should contact the administrator of the site. Whether or not the site responds, the study must be reviewed by the IRB.
3. Recruiting through social media: SM research may involve interaction and/or intervention of the subject’s environment; in which case it is considered human subjects research. Recruitment tools include web ads, Twitter streams, Facebook posts on personal feeds, blog postings, YouTube videos, and push methods. Many social media platforms do now allow clinical trial requirement. The PI must submit an application before conducting the research. To the extent possible, the study should screen for minors. To exclude minors, the researcher may state the minimum age of participants on a web page, information sheet, and/or consent document at the outset of the study. Individuals should be able to press a “not eligible, please discontinue” button (give the location) if they are not yet 18 years old, or an “I agree to participate and certify that I am 18 years of age or older” button.

What is in the Terms and Conditions?

In exchange for using the platform, users have agreed to abide by a set of conditions. Terms and conditions are usually lengthy and unread by users. Terms and conditions often contain clauses on how user data may be accessed by third parties (researchers, advertisers, developers).

Informed Consent Considerations

Consent is a voluntary agreement to participate in research. Informed consent enables subjects to understand the benefits, risks, and procedures of participating in research. There may be logistical barriers to obtaining consent for social media data. If it is not feasible to obtain consent, the IRB submission should justify waiving the consent requirement (by requesting and justifying waiver of consent in iStar).

Researchers should inform participants about the privacy protections of the study as well as how subject data may be shared per the terms of a social media platform.

Study participants who choose to share private information on a social media platform, beyond the scope and terms of a research study, cannot be provided privacy protections from the primary investigator, IRB or USC for such information.

Obtaining Data from a Vendor/Social Media Platform

• • Check the platform terms and conditions to determine whether they allow or prohibit the sharing of data sets. The IRB submission and consent must indicate whether the data will be shared.

• • Investigators who obtain confidential information from social media companies are responsible to the extent possible for assuring that privacy obligations to company users are not violated.

• • In situations in which the researcher does not have a user’s expressed, opt-in consent to link subjects’ social media identity to an off-line identifier, any connection must be based only on information that a SM user would reasonably expect to be used for that purpose.

Obtaining Data from Third parties

Using datasets obtained from commercial vendors or using a dataset from others who have agreements with social media sites carries inherent and differing problems related to the scope of the consent, potential inclusion of secondary subjects, and the possibility of skewed or cherry-picked data. The researcher obtaining the data should be able to describe the origin of the data set in the IRB submission.

Best practices for social media data

Researchers should….

• • thoroughly assess the risks to subjects prior to collecting data.

• • only collect essential data needed to answer the research questions.

• • protect subjects’ anonymity by not using direct text quotes in publication or data
    sharing.

• • never re-identify data when anonymity has been promised.

• • comply with state/local laws (such as the General Data Protection Regulation
    (GDPR) for European Economic Area (EEA) data, including informed consent requirements and how consent should be documented, age at which consent can be obtained, and how the social media data will be used.

• • if research involves subjects in foreign countries, the law of that territory must be followed.

Examples of Social Media Policies for Research Data Sets

Some SM companies provide private data sets to universities and others for use in research. Example company policies include:

TWITTER POLICY FOR DATA USAGE*

• • Twitter is accessible to all (with some exceptions such as banned users or government policy)

• • Users own tweets

Researchers must agree to:

• • • Never derive or infer, or store derived or inferred, information about a Twitter user’s: Health (including pregnancy), Negative financial status or condition, Political affiliation or beliefs, Racial or ethnic origin, religious or philosophical affiliation or beliefs, sex life or sexual orientation, trade union membership, alleged or actual commission of a crime…

• • • In situations in which the data recipient do not have a user’s express, opt-in consent to link their Twitter identity to an off-Twitter identifier, Twitter requires that any connection drawn be based only on information that a user would reasonably expect to be used for that purpose.
      https://developer.twitter.com/en/developer-terms/more-on-restricted-use-cases

      *The above refers to Twitter terms of service accessed on 12/18/208

FACEBOOK POLICY FOR DATA USAGE

• • • Users own the content they create and share*. However, Facebook classifies some user information as “public”: age range, language and country, name, gender, username and user ID (account number), profile picture, cover photo and networks.

Researchers obtaining data from Facebook are required to have:

• • At least one faculty Principal Investigator (PI) who assigns academic
    researchers to the project.

• • A Facebook sponsor that agrees to work with the faculty PI to lead the
    research effort.

• • A clear project outline, with timeline for completion, and proposed
    outcomes.

• • A written agreement between Facebook and the University or other
    user, covering such items as Intellectual Property (IP) and expectations
    regarding publication.

• • Agreement to Facebook Research ethics terms.

https://www.facebook.com/legal/terms

*Facebook terms grant Facebook a non-exclusive, transferable, sub- licensable, royalty-free, and worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of user content.
The above refers to Facebook terms of service accessed on 12/18/208.

Human subjects research that is designed to recruit participants or collect data through the internet must be reviewed by the USC IRB. Research activities taking place on the Internet are subject to, and will be evaluated based on the same standards (45 CFR 46.111) that govern all research involving human subjects.

Conducting research using the internet includes the use of the web as a tool for research, the locale or venue for research, and the collection of data for research about the internet. These tools include many sites and apps such as Facebook, Twitter, Skype, YouTube, and data capture sites such as Amazon Mechanical Turk and Quintiles. All are accessible with smart phones, tablets and laptops.

Primary Requirements for Internet Data Collection

Web-based data collection methods may include the use of existing data, observations, remote measurement tracking, interventions, and survey/interview procedures.

In order to receive IRB approval, the researcher must demonstrate:

• • Risks to participants are minimized, and are reasonable in relation to anticipated benefits;

• • Selection of participants is equitable;

• • Informed consent will be sought from each participant and appropriately
    documented;

• • Participant data will be collected to protect participant privacy, monitored as
    needed to ensure participant safety, and maintained in a manner that protects participant confidentiality; and

• • The investigator will comply with applicable terms of agreement set forth by the platform being used for research.

Protocol Design and Internet Research

IRB applications for online research must describe recruitment strategies, informed consent procedures, privacy protections and additional areas described below.

Recruitment

The identification and contact of potential research participants are possible through various social media platforms and surveys. Online recruitment takes place in many forms. Examples include websites devoted to clinical trial, electronic flyers posted on social media site, posts to online forums, blogs and group discussion boards.

Recruitment materials for non-exempt studies must be submitted to the IRB for review. Submission of recruitment materials is not required for exempt studies.

Informed Consent

Informed consent conducted over the internet should include all required elements of an informed consent. Researchers must request and justify any waiver of signed consent in the iStar application. It is recommended that an internet-based survey include “I agree” / “I do not agree” buttons on the website allowing participants to click their choice.

Participant privacy

Privacy protection may differ depending upon whether the online research site is conducted considered a public space (i.e. Twitter) or a private space (i.e. password protected forums). Research utilizing data that are both existing and public is not considered human subjects research and does not require IRB review. Data accessible only through special permission are generally not considered public.

Data confidentiality and security

Data being collected through the internet should be in an encrypted format to ensure that any data intercepted during transmission cannot be decoded and individual responses cannot be traced to an individual respondent. All databases storing sensitive and identifiable information must be protected, regardless of whether they are created and maintained by commercial firms or by individuals. Participants should completely log off the computer when finished to help maintain privacy.

Researchers are cautioned that encryption standards vary from country to country and that there are legal restrictions regarding the export of certain encryption software outside US boundaries. The investigator is responsible for assuring the security and privacy policies of the vendor are consistent with the USC Information Security Policy

Sample integrity

To ensure the integrity of the sample, the researcher must make sure they are accessing their target population. Participants should be offered check boxes to indicate that they meet the inclusion criteria however, the researchers will not be able to confirm the validity of this information. Researchers conducting research which excludes minor participants should describe the procedures to be employed to authenticate that the participants are adults.

Participant Withdrawal

The researcher must prepare a plan to handle the data of participants who want to drop out of the study. The consent should indicate whether the data can be destroyed if a participant decides to withdraw. If data is collected anonymously, the researcher may not be able to identify the participant’s data to destroy it.

Compensation

When providing compensation, the following are recommended to maintain anonymity:

• • electronic gift cards or certificates sent via email

• • cash/gift card sent through the postal service (note: using the
    subject’s mailing address prohibits research being anonymous)

• • do not link compensation to contact information

Minors in Internet Research

Researchers working with children online are also subject to the Children’s Online Privacy Protection Act (COPPA). COPPA establishes the following requirements for the collection of personal information from a child:

• • provide notice about how the information on minors will be used

• • obtain verifiable parental consent

More information on COPPA and Children’s Privacy can be found on the FTC website.

The IRB may require the use of information sheets when child assent and/or parental permission are waived. The researcher must provide a plan for obtaining parental permission when applicable though verification may be difficult.

Online Surveys

Survey research is one of the most common forms of web-based research. Researchers are advised to format survey instruments in a way that will allow subjects to refuse to answer specific questions

Investigators should review confidentiality measures and data security policies when using an online survey tool and make sure that they are described in the protocol. When using an online anonymous survey, the researchers should ask the vendor to withhold the IP addresses of the participants. For assistance, contact the USC Office of the Chief Information Security Officer.

USC provides REDCap (Research Data Capture): a secure web application for building and managing online surveys and databases. Visit USC Information Technology Services – Research Software.

Additional Internet Research Guidance

Sexual Orientation and Gender Identity (SOGI) are relevant to most research. Information about it should be collected and SOGI of subjects should be considered in developing a protocol. This consideration is fundamental to upholding the principles of justice and respect for persons. Understanding that demographic data collection needs to be tailored to the needs of the specific research and planned analysis – SOGI can be a factor in how risks impact the study population of interest and can even impact what the risks of participation are for subjects. 

The following resources are provided as guidance for incorporating SOGI into your research: 

Learning Resources — Collecting Sexual Orientation and Gender Identity Data, National LGBTQIA+ Health Education Center, The Fenway Institute

Best Practices for Asking Questions to Identify Transgender and Other Gender Minority Respondents on Population-Based Survey, The Williams Institute, UCLA, School of Law