Hello there,

Confidentiality and ethics in medical research is a very serious and highly regulated field, both institutionally and through the Federal government. The ethics and oversight of all human research has been codified in Title 45, Part 46 of the Code of Federal Regulations. 

Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects in such cases it is my recommendation that IRB approval or validation of exclusion from oversight of the CR and its protocols be obtained as each IRB may have unique insight and interpretation of its oversight scope.

The other consideration that must be accounted for in the CR protocols is the legal and ethical responsibility to adhere to Federal law with respect to patient health information. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) among its many provisions is most widely recognized for establishing standards regarding the confidentiality of personal medical information through the Privacy Rule. Under the HIPAA Privacy Rule, all providers, plans, and clearinghouses are prohibited from using or disclosing protected health information except as authorized by a patient or when specifically permitted by regulation. The Rule also explicitly applies to all forms of communication of health information including oral, written, electronic, or any other means. It cannot be overstated the importance of keeping these two ethical and legal codes in mind when developing and conducting an chart review.

Hope this helps, good luck

Regards

I am Chair of our IRB at NEOMED and yes, you do need the IRB to review your protocol even though your chart review may fall under Exempt Human Subjects Research.  In order to qualify for the exempt category, the data must be existing and not ongoing at the time you submit your protocol, and the data must be de-identified or anonymous.  If you are planning on-going data collection via chart reviews where the data does not exist (but will exist at a a future time), your chart review research is pushed to the next level of review and you will need to acquire informed consent from your patient subjects.  

There is a lot of information on our website that would help you out. Start with this page: Who is a human subject?

https://irb.research.chop.edu/who-human-subject