The MedStar Health Research Institute (MHRI) is designated as the Executive Agent for administration of and policy development for research conducted at all MedStar facilities and research conducted at other sites by MedStar associates. Georgetown University (GU) and MedStar Health (MedStar) use the same electronic (eIRB) system to manage their respective Human Research Protection Programs and the IRB review process. While both institutions use a common eIRB system (Huron), it is important to remember that there are two separate IRB systems. Although we work to harmonize the process and procedures across these two IRB systems, there are some requirements and processes that may differ. These include, but may not be limited to, the need for Georgetown University to comply with the Catholic Directive, establishing accounts in the Huron eIRB system, compliance training requirements, and disclosing outside interests/review and management of financial conflict of interest.
The following includes information specific to the MHRI IRB and MedStar requirements and guidance for the IRB process. Please contact the GU IRB office for information regarding the Georgetown IRB system and process.
All research involving human subjects must have Institutional Review Board (IRB) approval before any research activity may begin (this includes exempt and nonexempt human subjects research). In some cases, it may be necessary to obtain a determination for projects that are considered not human subjects research. These may include Quality improvement projects that do not include research components, evidence based clinical projects, or other projects that may be considered not human subjects research. For additional information, see the section “New Project Submissions” below.
All projects requiring or requesting a formal determination must be submitted through the Huron eIRB system at gumedstarirb.georgetown.edu/IRB. This includes all new protocols, requests for reliance on external IRBs or single IRBs, modifications, and continuing review of currently active projects.
Before November 16, 2018, MHRI used InfoEd to manage the IRB application process. InfoEd was closed to new proposals in November 2018 when this process transitioned to the Huron eIRB system. Protocol records and critical documents have been maintained in archived form but are accessible only to ORI and IS staff.
If you have questions about or require access to protocol records or documents for applications submitted before November 16, 2018, or any questions related to the MHRI IRB process or procedures, please get in touch with the Office of Research Integrity at MHRI-ORIHelpDesk@medstar.net.
IRB policies and procedures have been updated and consolidated into the MedStar Health Human Research Protections Program Policies and Procedures Manual (Effective December 15, 2022). The manual is available on StarPort on the Policies page under Research Integrity. Please refer to these policies for the procedures of record.
Case managers for IRB submissions
ORI administrators are assigned to assist specific departments. In addition, MHRI has a dedicated coordinator for IRB reliance agreements (use of external IRBs).
If you have a question/issue regarding a protocol or require pre-submission assistance, please get in touch with the appropriate ORI administrator or coordinator listed below. If you are unsure who to contact, please email the Office of Research Integrity at MHRI-ORIHelpDesk@medstar.net.
Case report forms
The MHRI IRB has determined that a case report of less than three (3) patients does not meet the DHHS definition of research or the FDA definition of clinical investigation found at (45 CFR 46.102(d)(pre-2018)/45 CFR 46.102(l)(1/19/2017)) and (21 CFR 46.102(c)) respectively. Based on that determination, case reports of three (3) or fewer patients are not subject to IRB review requirements and do not require IRB approval.
Case reports for publication may be considered a disclosure of protected health information (PHI) and, therefore, must be prepared in accordance with HIPAA. Please review the guidelines below to determine if a patient’s authorization is required. Frequently Asked Questions on case reports are available below as well.
Questions related to this determination can be directed to MHRI ORI at MHRI-ORIHelpDesk@medstar.net. Questions related to HIPAA requirements should be directed to firstname.lastname@example.org or the corporate Privacy Director at email@example.com.
Is this research?
The Health and Human Service Regulations (Common Rule) define research as follows [45 CFR 46.102(e)]:
Research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Activities that meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program that is considered research for other purposes. For example, some demonstration and service programs may include research activities. For purposes of this part, the following activities are deemed not to be research:
- Scholarly and journalistic activities (e.g., oral history, journalism, biography, literary criticism, legal research, and historical scholarship), including the collection and use of information, that focus directly on the specific individuals about whom the information is collected.
- Public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority. Such activities are limited to those necessary to allow a public health authority to identify, monitor, assess, or investigate potential public health signals, onsets of disease outbreaks, or conditions of public health importance (including trends, signals, risk factors, patterns in diseases, or increases in injuries from using consumer products). Such activities include those associated with providing timely situational awareness and priority setting during the course of an event or crisis that threatens public health (including natural or man-made disasters).
- Collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes.
- Authorized operational activities (as determined by each agency) in support of intelligence, homeland security, defense, or other national security missions.
The U.S. Food and Drug Administration (FDA) regulations defines Clinical Investigation* as follows [21CFR56.102 (c)]:
A Clinical Investigation means any experiment that involves a test article [a drug, biologic, or medical device for human use] and one or more human subjects and either
Must meet the requirements for prior submission to the FDA
Need not meet the requirements for prior submission to the FDA but the results of which are intended to be later submitted or held for a research pr marketing permit
This does not include nonclinical laboratory studies.
*The terms research, clinical research, clinical study, study, and clinical investigation are deemed to be synonymous for the purposes of FDA regulations.
Does my research meet the regulatory requirement for involving human subjects?
In most cases it is easy to determine if research involves human subjects. In some cases, it may not be clear who should be considered the subjects of the research under the Common Rule. Please see below for the regulatory definitions of Human Subjects and an example for consideration under the Common Rule definition.
The Health and Human Service Regulations (Common Rule) define Human Subject as follows [45 CFR 46.102I]:
Human subject means a living individual about whom an investigator (whether professional or student) conducting research:
(ii) Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or
(ii) Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.
Example: An investigator is conducting a study on pediatric sleep disorder. The child is admitted to the hospital for overnight observation and data collection. The investigator will also interview one or more of the child’s care givers for additional data collection.
In this example it is easy to identify the child as a study subject. If the investigator interviews the child’s mother, is she also a study subject? It depends:
If the investigator collects data only about the child (when sleep disturbance started, details about the child’s behavior etc.) then no the mother is not a study subject.
If the investigator collects data about both the mother and the child (what are the mothers sleep habits, how does the child’s sleep disturbance impact the mother etc) then yes, the mother is also a subject of the study.
The U.S. Food and Drug Administration (FDA) regulations defines Human Subject as follows [21CFR56.102 (e)]:
Human subject means an individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy individual or a patient.
Does HIPAA apply to my study?
When research involves the used and disclosure of Protected Health Information HIPAA authorization is required. In most cases research requiring HIPAA authorization also requires research consent. In these cases MedStar Health uses a combined consent / HIPAA authorization form. Please see the Informed Consent Template which includes HIPAA authorization language.
In some cases, such as with Secondary Use of Data (typically but not limited to records review) consent may not be required but HIPAA still applies. In these cases you will need to request a waiver of HIPAA authorization. This request should be included in you research protocol and should address the following items. Please note: These items are designed to address the specific regulatory criteria for a waiver of HIPAA authorization and should be included in the protocol without modification.
Request for a Waiver of HIPAA Authorization: regardless of IRB review category, research involving Protected Health Information (PHI) requires HIPAA authorization from the participant or a Waiver of HIPAA Authorization for the use or disclosure of PHI. The following elements from 45 CFR 164.512 (i) (1) (i) must be met for the IRB to waive the requirement:
A waiver of HIPAA authorization is being requested the following must be addressed:
Discuss how the use or disclosure of protected health information in the research involves no more than minimal risk to the privacy of individuals, based on, at least, the presence of the following elements
- Describe the plan to protect any identifiers from improper use and disclosure
- Describe the plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law
- Provide assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be otherwise permitted (Example: This study involves reviewing non-sensitive data. The only risk to this study is confidentiality risk, which is minimized through using standard HIPAA provision and data security. All MedStar HIPAA policies will be followed. Study documents are saved on password protected drives, no identifiable data will be transferred from the covered entity and access is restricted to personnel listed on the IRB-approved study.)
- Discuss how the research could not practicably be carried out without the requested waiver or alteration.
- Discuss how the research could not practicably be conducted without access to and use of the protected health information (Note: There may be ethical, scientific or logistical rationales to justify the practicability standard such as (i) the consent procedure would itself create additional threats to privacy that would otherwise not exist, by identifying an individual as having or experiencing what is being studied by virtue of their signature on a consent form identifying the condition or event or (ii) there is a risk of inflicting significant psychological, social or other harm by contacting individuals or families or (iii) scientific validity would be compromised if consent were required because it would introduce bias to the sample selection by limiting the inclusion to those individuals who consented to use of their data when researchers may need to understand the experience of all eligible participants. For example, a study assessing flu outbreaks and its relationship to vaccination rates needs to understand the health and vaccination status of all individuals in a region or a study of conditions in the ICU with a limited population such that obtaining a valis result would not be possible if some patients decline consent; or (iv) a logistical rationale are these subjects still accessible, still being seen in the clinic? Are they lost to follow up? Are the numbers so large that it would not be practical or feasible to contact every possible individual?
- Discuss how the use or disclosure of protected health information in the research involves no more than minimal risk to the privacy of individuals, based on, at least, the presence of the following elements
18 identifiers that constitute PHI - Protected Health Information
(Note: If all of the following 18 identifiers are removed, then the data is considered de-identified and may be used/disclosed without restriction.)
All geographic subdivisions smaller than a state, including: street address, city, county, precinct, ZIP Code, and their equivalent geographical codes, except for the initial 3 digits of a ZIP Code if, according to the current publicly available data from the Bureau of the Census.
All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older.
Social security number
Medical record number
Health plan beneficiary number
Vehicle identifiers and serial numbers (including license plates)
Device identifiers and serial numbers
Biometric identifiers, like fingerprints and voiceprints
Full-face photos and any comparable images
Any other unique identifying number, characteristic, or code
- A waiver of HIPAA authorization is being requested the following must be addressed:
Is a formal determination needed?
All research involving human subjects must have IRB approval before research activities may begin.
If your project fits the regulatory definition of both research and human subject a formal determination is required.
In many cases it is recommended that you obtain a formal determination even if you think your project would not be considered research involving human subjects.
For example, in recent years publication of results from Quality Improvement (QI) projects has become more common. It is important to remember that QI projects may also include research components and require IRB approval. Others may be considered Not Human Subjects Research (NHSR). In any case, if there is a possibility of sharing results through presentation or publication the conference organizer or publisher may require documentation of a formal determination (either IRB approval or an NHSR determination). That determination may only be made before the project begins.
For those reasons it is generally recommended that a formal determination be obtained before starting a Quality Improvement project to ensure that it is not considered research and obtain documentation of approval.
General IRB guidance
- Guidance for using the eIRB system can be found on the MHRI website here.
- IRB policies and procedures are being updated as part of the new system. All policies currently in place are available on StarPort, on the Policies page under Research Integrity. Please refer to these policies for the procedures of record.
MHRI IRB Quick Guidance for Humanitarian Use Devices (HUD)
Quick reference guide for research involving deception or incomplete disclosure
Doctorate of Nursing Practice (DNP) student projects
DNP projects may require submission through the MHRI Hurons system. Typically the student will first submit the project to their DNP programs IRB. The determination of that IRB will help decide if a submission to MHRI is needed as follows:
- If the DNP program IRB issues a Not Human Research (NHSR) determination, a submission through the MHRI Huron system is not required.
- If the DNP program IRB determines the project fits the regulatory definition of research involving human subjects, a submission through the MHRI IRB system is required.
- If the DNP program IRB does not issue NHSR determinations and declines to review the project, a submission through the MHRI IRB system is required.
If the DNP project must be submitted through the Huron system who should be listed as the PI on the application and who should be listed as members of the study team?
- If the DNP student is a MedStar associate (currently employed by MedStar): The student may serve as PI on the project at the discretion of Nursing Leadership. If Nursing Leadership determines the student may not function as PI another appropriate MedStar associate (employee) should be listed as PI.
- If the DNP student is not a MedStar associate (not employed by MedStar): Another nurse or appropriate MedStar associate (employee) must be designated as the PI for the project.
If the DNP project must be submitted through the Huron system, which investigators may or may not be included in the study team list?
- The MHRI ORI/IRB will issue a determination for MedStar only. For this reason, only MedStar associates may be included in the Huron application. If the DNP student is not a MedStar associate their activity on the project will be covered by their DNP program IRB determination.
Please contact ORI with any questions regarding the requirements for submission through the MHRI Huron system.
In addition, the requirements described above DNP projects must have approval from the facility at which the activity will be conducted and approval from Nursing Leadership. Please also see the Nursing Research Council guidance on requirements for DNP projects.
New project submission
All research involving human subjects conducted by MedStar Associates MUST be submitted for review through the Huron eIRB System before any research activity is initiated.
Under MHRI policy, a formal submission through the eIRB system is also required for research that meets the criteria for approval under Exempt categories as described in 45 CFR 46.104.
At this time, projects considered Not Human Subjects research do not require a formal submission by policy or regulations. It is, however, recommended that a protocol be written and submitted for consideration. This allows for a formal determination, by someone other than the PI or other team members, to:
- Confirm that the project does not fit the DHHS or FDA regulatory definitions of research involving human subjects.
- Allows ORI to issue a letter documenting the formal determination, which can be used when submitted for publication or presentation at a conference if needed.
Please note: As with research involving human subjects, this determination must be issued before the start of the project. ORI cannot issue a formal determination after the project has been started.
As all submissions are received and processed through the Huron system, all team members must have an active account in the Huron system. MedStar Health associates will need a request submitted to IS to establish the account. This request must be submitted through the Identity IQ system. Once established IS will contact the associate by email with instructions to access the system
All team members must complete CITI compliance training related to human subjects research. All MedStar associates must complete the MedStar-specific training, even if they have completed similar training at another institution. Please note, if you have completed CITI training for another institution, you will receive credit towards MedStar training for modules that were completed for the prior institution. You will only be required to complete modules that are required by MedStar that the prior institution did not require. Please log in to your CITI account (if you have one), associate that accounts with MedStar, and follow the instructions for required training.
See Huron Guide for additional details.
Modification of approved applications
Modifications to approved applications must also be submitted through the Huron eIRB system. Modifications may be created by any study team member but may only be submitted by the PI or PI Proxy role.
See Huron Guide for additional details.
Continuing review of approved applications
Continuing Review applications must also be submitted through the Huron eIRB system. These may be created by any study team member but may only be submitted by the PI or PI Proxy role.
See Huron Guide for additional details.
Requesting a planned protocol deviation
Reporting an unanticipated deviation
Immediately reportable events
Data registries and specimen repositories