IRB Considerations for a Retrospective Chart Review
The information on this web page is designed for medical students. The purpose is to help guide students through the key steps of preparing and submitting an IRB application for a retrospective chart review. This is a quick guide and is not intended to provide guidance on formulating a research question, literature searching, data analysis, or presentation/publication of results.
What is a retrospective chart review?
A retrospective chart review is a type of clinical research study in which data is collected solely from the medical record or another patient database. As a result, there is no intervention with research subjects and no interaction with research subjects. Importantly, the medical treatment or care provided to patients who are subjects in a retrospective chart review is NOT directly related to the research study. In other words, the medical care was provided to patients regardless of whether the study was being done or not, thus the methods of a retrospective chart review are only related to identifying subjects and extracting their information from the medical record. As a result, any medical treatment, and risks/benefits thereof, have nothing to do with your study from the IRB’s perspective.
Note that a retrospective chart review is NOT a study design, rather it is a study methodology. The study design for a retrospective chart review is always observational, and can be a case series, a case control study, a cohort study, or a cross-sectional study.
A chart review can be paired with a survey or an experimental (intervention) arm of a study. This quick guide only deals with the IRB considerations for the chart review portion of the study.
How do I get access to medical records?
The first step in conducting a chart review is to have a research mentor who already has access to the medical record. It is extremely unlikely that any health system will allow a medical student to run their own chart review, and most IRBs require a principal investigator that is a physician or faculty member. Thus, to conduct a chart review, which will require access to medical records, you will need a research mentor who has access to the medical records.
What is the IRB?
The IRB is a committee of faculty, staff, and laypersons that oversees human subjects research. For the purposes of this guide, be aware that medical records are considered human subjects, as a result, retrospective chart review studies require IRB review because they are considered human subjects research.
Do chart reviews require IRB review?
Yes, chart reviews must be reviewed by the IRB if they are research. Even chart reviews that you know will fall into the EXEMPT category. Chart reviews can only be determined EXEMPT by the IRB. As a result, chart review protocols must still be submitted to the IRB for this exempt determination. “Exempt” merely means that the study is minimal risk such that it does not require ongoing oversight by the IRB.
What category of exempt is a chart review?
There are different categories of Exempt status for research studies. Chart reviews generally fall under Exempt Category 4(ii) or 4(iii). These are:
4(ii) Secondary research uses of identifiable private information or identifiable biospecimen – information recorded by investigator in manner that identity of subjects cannot readily be ascertained.
4(iii) Secondary research uses of identifiable private information or identifiable biospecimen – use of identifiable information regulated under HIPAA
Note that the data to be collected for a chart review is considered a “use of identifiable private information”. Because medical records exist for clinical, and not research, purposes, the use of this data for research is considered a “secondary use”.
The choice between Exempt category 4(ii) and 4(iii) depends on whether you will collect identifiers (such as MRN) as part of your study. This will be described in further detail below.
Training
All investigators listed on an IRB application must be up to date with human subjects research training per your institution’s requirements.
At MSU, this training can be found here: https://hrpp.msu.edu/training/index.html
At other institutions, this training requirement may be different.
Online Form
In most cases, the IRB will require the submission of a written protocol document which you attach to an online form. The “IRB Protocol Elements” information below is a combination of the types of information being requested by the IRB either in the written protocol or in the online form.
At MSU, the online form is in the software “Click”. https://hrpp.msu.edu/click/index.html
Note that every member of the research team who is to be added to an IRB Protocol at MSU must log in to Click at least once. If an investigator has not ever logged into Click before, they will not show up in the system and cannot be added to the protocol. If you or someone on your research team is unable to add a person to the online protocol in Click, tell that person to log in to Click at least once.
There are different online systems used by different institutions, such as IRB Manager, SMART IRB, and other online systems.
IRB PROTOCOL ELEMENTS
Background & Significance
IRB protocols should contain a background and significance section where the investigators outline for the IRB the basic background of the study along with its significance. Remember, the IRB committee and the IRB analysts reviewing and processing your requests are not necessarily experts in your field, so you must provide them with adequate background on your study, along with the significance of the study. This will establish the importance of doing the study in the first place. It is within the rights of the IRB to decline approval of a study if they feel the risk of doing the study, no matter how minor, is more than the benefit of having the study results. That’s why it’s important to clearly explain the background and significance.
Objectives
The objectives of your study are the main outcomes of your study as you define them. They are not broad goals, such as “to cure cancer”, or vague ideas, such as “to see if drug A works”. Instead, they are specific outcomes that you will measure.
For example, if you were doing a Covid-19 vaccine trial, your objectives would be something like, “The primary objective of this study is to determine if patients who received the experimental vaccine were diagnosed with Covid-19 at a lower rate than patients who received placebo as determined by RT-PCR testing.” You can add secondary objectives as well, such as “Secondary objectives include assessing severity of illness in the vaccinated vs. placebo group. Severity is to be measured as presence of symptoms, hospitalization rate, rate of admission to ICU, and death rate.”
Study Design
This section can be very short. An example might be: “Retrospective cohort study”.
That’s it. Note, again, that “retrospective chart review” is not a design, it’s a method. Therefore, “retrospective chart review” may not be enough without more info on the design (i.e. case series, case control, cohort study…).
Recruitment Methods
For a retrospective chart review, there is no recruitment of subjects. Simply state this in the IRB application or write N/A.
Inclusion and Exclusion Criteria
The IRB will ask you to describe your research subjects. Inclusion criteria refers to the characteristics of patients that make it so they may be included in your study. Here is an example:
“Patients aged 18 and older who received Roux en Y gastric bypass surgery at Smith Memorial Hospital between the dates of January 1, 2019 and January 1, 2022.”
Note that description includes location and dates, along with the clinical and patient characteristics that qualify the patient for inclusion. There may be quite a few criteria in this list.
Exclusion criteria are characteristics of the patients that would exclude the patient from the study EVEN IF they meet the inclusion criteria.
Example: “Patients who received prior weight loss surgery” or
“Patients who did not have a follow-up visit at 6- and 12- months post-surgery”.
Study Endpoints
For a chart review, the study endpoint is simply the measurement you are using for the primary (and secondary, if necessary) outcomes in your study. For example, let’s say you were doing a retrospective study in a cohort of patients with Parkinson’s disease and you were interested in seeing if their exercise level helped in slowing progression of disease. Assume that you have a log of physical activity for these patients over a period of time. The endpoints in this study would be the measures of clinical progression of Parkinson’s in these patients. There could be multiple endpoints, as Parkinson’s has both motor and cognitive symptoms. As such, endpoints may be stability or balance, tremor, or measures of dementia.
Note that study endpoints may be vastly different for more risky studies, such as RCTs, and may include safety endpoints and effectiveness endpoints.
Study Procedures
The procedures of a chart review include:
- How the patients will be identified
- Who will collect the data and from where (i.e. the EMR)
- Whether identifiers will be collected, and which identifiers
- Where the data will be stored (i.e. spreadsheet, database, REDCap, etc.), this includes where both the data sheet AND identifiers are stored
- How you will protect the data (i.e. password protected, secure storage drive), including both data sheet and identifiers (if applicable)
- Who will have access to the data
- How data will be shared with others (such as statisticians, if applicable)
Some notes on the above items. The procedures of a chart review are mostly grabbing data from the EMR or other source of data and storing this data securely somewhere. This can occur by hand (i.e. student collects data directly from the EMR), through the use of an honest broker, with the help of the Health IT department, and so on.
On Identifiers
Of particular importance is the issue of identifiers. When it comes to chart review studies, the term “identifiers” refers to HIPAA identifiers. Here is a list of them, per the HHS (https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html):
- Names
- All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census:
(1) The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and
(2) The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000
- All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
- Telephone numbers
- Vehicle identifiers and serial numbers, including license plate numbers
- Fax numbers
- Device identifiers and serial numbers
- Email addresses
- Web Universal Resource Locators (URLs)
- Social security numbers
- Internet Protocol (IP) addresses
- Medical record numbers
- Biometric identifiers, including finger and voice prints
- Health plan beneficiary numbers
- Full-face photographs and any comparable images
- Account numbers
- Certificate/license numbers
- Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section [Paragraph (c) is presented below in the section “Re-identification”]
Be aware that if you have a data sheet with protected health information (PHI) and identifiers, and you let someone not authorized view this sheet, you have committed a HIPAA violation. Because of this, a strategy to protect data must be part of your research protocol.
There are two ways to protect confidentiality of patient data in a chart review.
- Do not collect identifiers
- Utilize codes to allow re-identification
If you collect data without identifiers (#1 above), this is called safe harbor de-identification. If there are no identifiers in your data set, and the covered entity (hospital, clinic, practice…) has no reasonable basis to expect that individual patients can be identified from the data, then it is not subject to HIPAA privacy rules. This type of data can be shared with statisticians.
If you do collect identifiers (#2 above), you do not want to include those in the same data sheet as the health information. You would instead utilize a “correlation tool” or “key to identifiers”. In this strategy, you remove identifiers from the data, and place them in a separate file which only has identifiers. You then give each subject a code (i.e. P1, P2, P3…) which you enter into both sheets. On one sheet, you have a patient code linked to identifiers, in the other sheet you have a patient code linked to the patient’s health and demographic data. In this way, you can utilize the code to re-identify the patient.
Here is a link to an example of a basic correlation tool and data collection sheet to illustrate this concept.
Sample Correlation Tool and Data Collection Sheet
If you want to use codes, you need to explain why you should be allowed to do this. Here is some sample language that explains why one might want to re-identify subjects in a chart review:
“The use of a correlation tool is being requested to allow re-identification of subjects. This request is being made for two main reasons. 1) In the case of data transcription errors (e.g. age of 350 years), researchers will be allowed to go back into the EMR to correct the errors. 2) Upon submission of the work for publication, it is often a reviewer request to strengthen the study by the inclusion of additional data in the study. With a correlation tool, investigators can go back into the EMR to collect additional data to improve the study.”
Monitoring Data for the Safety of Participants
This section can be completed by writing “N/A”.
As a chart review, you will not be interacting or intervening with subjects in any way. You are doing a secondary analysis of data collected for medical care, as such your chart review study has no bearing on subject safety.
Withdrawal of Subjects
Simply answer “Retrospective chart review, no possibility of subject withdrawal”.
Statistical Plan
In this section, you will have to describe your statistical plan, which can include a discussion or rationale for your sample size determination. If you need help with this section, please contact a statistician (see here for MSU CSTAT help - https://research.chm.msu.edu/students-residents/statistical-help).
Risks and Benefits
For a chart review, there are no direct benefits to subjects and the main risk is to data confidentiality. In other parts of the protocol, you will state what the data confidentiality procedures are, so you don’t have to repeat them here.
Provisions to Protect the Privacy of Subjects
There are no privacy risks with a retrospective chart review. Privacy = people. State something like this in your application, “This is a retrospective chart review, there are no privacy risks because there will be no interaction or intervention with subjects.”
Provisions to Protect the Confidentiality of Data
There are data confidentiality risks. In this section, you would describe how you are protecting the data. Some key things to mention include:
- Data will be stored securely (password protected, secure storage drive, use of REDCap, etc.)
- Only investigators listed on the IRB will have access to data files
- Correlation tool (or key to identifiers) will be used and stored separately from data files
- Correlation tool will be destroyed at final publication/presentation of study (if you plan to do this)
Medical Care or Compensation for Injury
Answer “N/A”, the reason being you are not interacting or intervening with subjects.
Cost to Subjects
“N/A” for the same reason as above.
Consent Process
For a chart review, you will be requesting a “waiver of informed consent”. Here is some sample language on why you would be granted a waiver:
“A waiver of informed consent is requested because this is a minimal risk retrospective chart review in which no patient interaction will occur. Obtaining informed consent will require contacting each patient directly, increasing the risks to patient privacy. Further, obtaining a signed consent form will increase the risks to data confidentiality due to creation of an additional document containing a patient identifier. Also, requiring informed consent will result in a certain number of patients who will be lost to follow up, or who might not agree to be in the study, thereby reducing the sample size and reducing the impact of this study. Further, a reduced sample size may require contacting additional potential participants to meet our enrollment goals, and/or expansion of the time frame for inclusion of study subjects, thereby introducing more risk to privacy and confidentiality. Patient rights and welfare will not be affected in any way by this study.”
Vulnerable Populations
Describe any vulnerable subjects that are purposely included in your study. Here is a list of potential vulnerable subjects:
- Children
- Pregnant women
- Prisoners
- Students
- Human fetuses
- Neonates
- Individuals with physical disabilities
- Individuals with mental disabilities or cognitive impairments
Note that this is not a comprehensive list.
In the IRB application, you must describe vulnerable populations if they are purposely included. Thus, if you are doing a study on pregnant women and their exposure to environmental pollutants at work, you would describe this population. However, if your study was on adults 18-65 years old who have asthma, you may have pregnant women as part of your study, but you do not have to describe them as a vulnerable population because you are not purposely including them in your study.
Vulnerable populations are described here because they are vulnerable to coercion or undue influence, and you are being asked to explain any additional safeguards to protect them. In the case of a chart review, if you have vulnerable populations, there are generally no additional safeguards in place. This is because you are not interacting with subjects or intervening in any way. As such, simply state that no additional safeguards are in place beyond the data protection procedures already described.
Sharing Results with Subjects
For a chart review, state that results will not be shared with subjects.
References
Include a list of references in your protocol.
Attachments
Attach all documents requested by the IRB. This may include a blank version of your data collection sheet or a blank version of your correlation tool (if applicable). Since you are requesting a waiver of informed consent, you will not have to attach an informed consent form. Likewise, you will not have to attach any recruitment materials or messages to participants because you will not be interacting with subjects in any way.
After Submission to the IRB
At MSU, only the PI can submit the IRB application. If you are not the PI of the study, and you are ready to submit your IRB application, please notify your PI to do so.
Once submitted, check the IRB page in Click regularly for comments. If you would like your application to be reviewed and approved quickly, respond to all questions in a timely manner. Responding to an IRB question in Click also requires the PI to submit that comment. If you are not the PI, and you want to respond to an IRB question, let your PI know they have to submit response or comment.
Good luck!
*Content developed by Mark D. Trottier, PhD
