Waiver of Informed Consent when Using Medical Records or Other

External and Internal Use

Waiver of Informed Consent when Using Medical

Records or Other Secondary Data or Specimens

UNC-CH OHRE Guidance Document

IRB Waiver of Consent Guidance version 4/19/18

Page 2 of 7

This guidance has been provided by the UNC-Chapel Hill Office of Human Research Ethics

(OHRE). This document is intended to provide guidance to investigators regarding the

information needed for the IRB to grant a full waiver of informed consent

under 45cfr46.116(d) when a study involves the use of secondary data and/or specimens.

TABLE OF CONTENTS

1 Criteria for a Waiver of Informed Consent Overview ....................................................................... 3

Additional Criteria................................................................................................................................ 3

Information to consider when responding to each criteria ................................................................... 3

1. The research involves no more than minimal risk to the subjects. ........................................... 3

2. The waiver or alteration will not adversely affect the rights and welfare of the subjects. ...... 4

3. The research could not practicably be carried out without the waiver or alteration. .............. 5

4. Whenever appropriate, the subjects will be provided with additional pertinent information

after participation. ............................................................................................................................... 6

5. The risk to privacy is reasonable in relation to the importance of the knowledge to be

gained. .................................................................................................................................................. 6

6. Please explain why it would not be possible to conduct the study with only de-identified

data. ..................................................................................................................................................... 6

2 What is not a sufficient justification? ............................................................................................... 7

IRB Waiver of Consent Guidance version 4/19/18

Page 3 of 7

1 CRITERIA FOR A WAIVER OF INFORMED CONSENT OVERVIEW

An IRB may approve a consent procedure which does not include, or which alters, some or all

of the elements of informed consent, or waive the requirements to obtain informed consent,

under 45cfr46.116(d), provided the IRB finds and documents that ALL of the following criteria

are met:

1. The research involves no more than minimal risk to the subjects;

2. The waiver or alteration will not adversely affect the rights and welfare of the

subjects;

3. The research could not practicably be carried out without the waiver or alteration;

and

4. Whenever appropriate, the subjects will be provided with additional pertinent

information after participation.

Additional Criteria

Two additional “criteria” are not specific to the waiver but must be addressed in order to

receive IRB approval:

5. The risk to privacy is reasonable in relation to the importance of the knowledge to be

gained.

6. Please explain why it would not be possible to conduct the study with only de-

identified data.

Information to consider when responding to each criteria

1. The research involves no more than minimal risk to the subjects.

Identify all risks associated with the research. Typically, a breach of confidentiality is the

primary risk associated with medical record review and with the use of existing

identifiable data or specimens. Discuss steps to minimize these risks. Specifically, discuss

the sensitivity of the data and the confidentiality protections in place to protect the data

and minimize a breach of confidentiality. This response should reflect and build upon

information provided by the investigator in sections A.9. (“Identifiers”) and A.10.

(“Confidentiality of the data”) of the application.

IRB Waiver of Consent Guidance version 4/19/18

Page 4 of 7

2. The waiver or alteration will not adversely affect the rights and welfare of the subjects.

a. Explain why the waiver will not adversely affect subjects’ rights. Patients have a

right to privacy regarding their medical records. The impact of the research on this

right must be minimized to the extent possible. Minimizing the impact can be

achieved through the use of an honest broker (such as the CDW) that extracts the

data, or by placing clear limitations on individuals within the research team who

will engage in data extraction from the medical records. The latter option requires

the investigator making the request to clearly identify the steps and/or strategies

that will be used to limit exposure of the patient’s entire medical record during

the data extraction process (for example, what training has the data extractor

completed that will reduce the likelihood of unintended exposure of elements of

the record that are not essential to the research? What methods will be used to

record the data without creating and maintaining additional hard copies of PHI?).

b. Explain how the waiver will not adversely affect subjects’ welfare. Regarding the

concept of welfare, the investigator must consider several factors depending on

the original source of the data.

i. For medical record review: Consider the impact of record review on a

patient’s ongoing clinical care; in addition, consider the psychological,

physical, social, economic, and legal implications of a breach that would

result if the private information placed in the research record became

known outside the research team. The waiver request should identify any

specific data that is considered sensitive in nature and address specific

concerns about a breach of confidentiality regarding those sensitive data.

ii. For secondary data or specimen use:

1. Data collected as part of a prior research study in which subjects

provided informed consent. Explicitly address how the proposed use of

the data/specimens is consistent with what subjects agreed to when

signing the consent form for the original study. Specifically, consider (1)

what the original consent allowed or limited regarding sharing

data/specimens with other researchers (e.g., research limited to

specific medical conditions, sharing limited to de-identified data only)

and (2) if identifiers will or will not be shared with researchers who

were not involved in the original study. The proposed secondary use

should be related to the disease, condition, or other general topic

consistent with language in the original study consent document. If the

current study involves sharing identifiers outside the study team and

this plan contradicts language in the original consent, the investigator

must address the potential adverse effect on subjects’ rights.

IRB Waiver of Consent Guidance version 4/19/18

Page 5 of 7

2. Data collected for administrative or other non-research purposes and

consent was not obtained. Consider how a subject may feel about their

data being used for research purposes. Consider whether the research

purpose is consistent with the original intent of the individual who

provided the data. Consider the expectation of privacy associated with

the original data provision and the sensitivity of the research. If the

sensitivity of the research topic is inconsistent with the expectation of

privacy of the individual (for example, using photos of college

applicants in a study of risky sexual behavior), the research could be

done but consent could not be waived.

3. The research could not practicably be carried out without the waiver or alteration.

Carefully consider the principle of Respect for Persons within the context of the proposed

study. Is the study entirely retrospective or does it involve prospective data collection

that might offer an opportunity to consent subjects and obtain HIPAA authorization?

Describe the real (not presumed) barriers to obtaining consent, understanding that

having limited financial resources to support the consent process does not justify the

waiver. Answer the following questions:

a. Is contact information of potential subjects readily available?

b. Is the contact information likely reliable? Consider the age of the records and the

likelihood that the contact information is outdated.

c. Are potential subjects likely to be deceased or lost to follow-up?

d. How many records are required to review? Would the resources required to

obtain consent from all subjects exceed reasonable expectations of any research

team? (For example, the study is a case-control cohort design involving

hospitalized patients, and the sample size estimate indicates 200,000 cases are

needed to answer the research question.)

e. Are subjects geographically dispersed? Consider the feasibility of the research

team obtaining consent from individuals located outside the local catchment area.

f. Will subjects be burdened? Consider whether the consent process:

i. Necessitates an unreasonable time burden on subjects.

ii. Creates additional risk to subjects in the form of the collection of

unnecessary identifiable information (i.e. name, phone number, signature

on a consent or HIPAA form).

IRB Waiver of Consent Guidance version 4/19/18

Page 6 of 7

4. Whenever appropriate, the subjects will be provided with additional pertinent

information after participation.

a. Submit a debriefing form if the waiver request is specific to the use of deception

or withholding information.

b. Describe why this criterion is not applicable for fully retrospective studies.

c. For secondary analysis of prospectively collected data, consider providing subjects

a brochure or information sheet that includes information such as:

i. that subjects’ data will be included in the research

ii. what data will be included in the research

iii. the purpose of the research

iv. ow they may reach the investigator if they have questions/concerns about

the research

v. instructions for having their data withdrawn if they wish

vi. how they may reach the IRB in case they have questions or concerns about

their rights as a research subject

5. The risk to privacy is reasonable in relation to the importance of the knowledge to be

gained.

Briefly, recap the risk to privacy by discussing the nature of the data (sensitive or not)

AND justify this risk with a clear assertion of the greater public good that the research will

realize. Be specific about the nature of the knowledge to be gained.

6. Please explain why it would not be possible to conduct the study with only de-

identified data.

Non-identified information should be used whenever possible in order to respect

subjects’ interests in protecting the confidentiality of their data and/or biospecimens.

Clearly describe why identifiers are needed (e.g., to link data across time, IDs are

variables of interest, etc.).

IRB Waiver of Consent Guidance version 4/19/18

Page 7 of 7

2 WHAT IS NOT A SUFFICIENT JUSTIFICATION?

1. This is a retrospective chart review only with no more than minimal risk. This only speaks

to risk level and does not provide information about any other criteria.

2. Since there is minimal risk and an observational study it would be pointless to obtain

consent. This only speaks to risk level and does not provide information about any other

criteria.

3. Requiring informed consent will slow down the process and I need to graduate in 6

months. This only addresses cost, convenience, and speed to the investigator.

Convenience cannot be used to justify the waiver.

4. Requiring informed consent will lead to a lower participation rate and will bias the data.

Although this may be true, biasing of data is an issue inherent to all research. In addition,

this justification implies that participants could be consented which means that it is not

impracticable and not giving subjects an opportunity to say make a decision to participate

if practicable, violates the principal of respect for persons.

5. Requiring informed consent would place undue cost and burden on the research team.

Although this may be true, it is the responsibility of the researcher to be qualified and

have the resources to conduct the research the proposed. As previously mentioned, cost,

convenience, or speed to investigators alone is not acceptable as a justification to not

obtain consent from subjects.