Obtaining Identified Clinical Data for Research with Stanford IRB Protocol

Unless your data requirements expand beyond the original scope of the approved protocol, you only need to complete this process once per IRB protocol.

There are three steps to obtaining Protected Health Information with a Stanford IRB protocol:

Talk to us

We’re here to help, and the easiest way to enlist our help is to chat with us about your research needs.

If you have not yet done so, please use our online consultation services request form to contact us, describe to us your research study, and schedule a brief phone call so you can bring us up to speed.

Complete the Data Privacy Attestation in eProtocol's My Dashboard

If you do not yet have an eProtocol, you will need to create one. If you already have an approved eProtocol, you will need to submit a Modification to add a Data Privacy Attestation.

In eProtocol, follow the link in section 11b or 15 (Waiver of Authorization or Waiver of Authorization for Recruitment) to specify the PHI and roughly categorize the clinical data in your data request. For a Chart Review protocol, follow the link in section 3a or 5 (Waiver of HIPAA Authorization).

Once you create the Data Privacy Attestation, please open the protocol in "Edit" mode and click the link in section 11b/15 or 3a/5 to import the attestation into the protocol. The tool will generate text in section 11b/3a. Be sure to click the "Save" icon.  

Wait for Privacy and IRB Approval

First, the Stanford Privacy Office will approve the data request and then the IRB must approve your protocol. The Privacy Office and/or the IRB may contact you directly during this phase if they have questions about your intended use or disclosure of the requested data elements.

Once both groups have approved your request you are approved to use or disclose the identifying clinical data for the research purposes documented in your Privacy Attestation and IRB protocol.

Once you have completed this process, you can either get back in touch with us for a custom data pull or provision a chart review yourself by following the steps below:

  1. Open the Cohort Discovery Tool. (Please note that you will need to VPN into the Stanford network if accessing STARR/STRIDE off campus.)
  2. Fill in the desired search criteria (Demographics, Clinical Events, etc.) under "Searches" and click on the "Count" button in the upper left toolbar to calculate how many patients are in the cohort.
  3. Type the Cohort Name and the IRB Number in the popup window.
  4. Click "Create"
  5. Click your browser's refresh button so the newly created cohort will be available to view.
  6. Navigate back to the top toolbar that says "Anonymous Patient Cohort Finder" and select "Patient Chart Review" under the STRIDE Tools menu.
  7. Go to the Patient Chart Review tool and click on the black triangle below the Stanford Medicine logo to load patient charts from the newly created cohort. Please note that there is a 24-hour delay before you can search patient charts in a newly created cohort.

How do I proceed if Privacy denies my request?

If your application is denied, you generally have two options:

  1. Modify your IRB protocol to bring it into concordance with your data request,
    or
  2. Modify your data request to bring it into concordance with your IRB protocol.

In case 1, you will need to modify your IRB protocol in sections other than 11b/3a or 15/5. In case 2, you will be using the link in eProtocol to modify the data request, which will result in changes to the imported text in sections 11b/3a.

For any questions please contact Stanford Privacy Office at privacy@stanford.edu

Thank you!

Please know that you have our most sincere thanks for the time and attention you have devoted to ensuring that the intended use of this highly sensitive data is fully and accurately documented.

Also, please bear in mind that you are not permitted to redistribute the data set to other researchers for their research, nor are you permitted to use this data yourself for a different research project. The permissions to use the data are tied to the research project described in your IRB protocol.