Obtaining Identified Clinical Data for Research with Stanford IRB Protocol

You only need to complete this process once per IRB protocol, unless your data requirements expand beyond the original scope of an approved protocol.

The process for obtaining Protected Health Information with a Stanford IRB has three steps.

Talk to us

We’re here to help, and the easiest way to enlist our help is to chat with us about your research needs.

If you have not yet done so, please use our online consultation services request form to contact us, describe to us your research study, and schedule a brief phone call so you can bring us up to speed.

Complete the Data Privacy Obligations Attestation in eProtocol

If you do not yet have an eProtocol, you will need to create one. If you have an already approved eProtocol, you will need to submit a modification to add a Data Privacy Attestation.

In eProtocol, follow the link in section 11b or 15 (Waiver of Authorization or Waiver of Authorization for Recruitment) to specify the PHI and roughly categorize the clinical data in your data request. For a Chart Review protocol, follow the link in section 3a or 5 (Waiver of HIPAA Authorization).

Once you create the Data Privacy Attestation, please open the protocol in Edit mode and once again click the link in section 11b/15 or 3a/5 to import the attestation into the protocol. The tool will generate text in section 11b/3a. Be sure to click the save icon.  

Wait for Privacy and IRB Approval

First the University Privacy Office will approve the data request, then the IRB must approve your protocol. The Privacy Office and/or the IRB may contact you directly during this phase if they have questions about your intended use or disclosure of the requested data elements.

Once both groups have approved your request, you are approved to use or disclose the identifying clinical data for research purposes documented in your Privacy attestation and IRB protocol.

Once you have completed this process, you can either get back in touch with us for a custom data pull or provision a chart review yourself as follows

1. Create your search in Cohort Discovery Tool. 


2. Under 'Searches' select 'Save patients for Chart Review' and supply IRB number when prompted. 

3. Refresh the page then navigate to Patient Chart Review using the dropdown menu in the middle of the toolbar.

What to do if Privacy denies my request?

If your application is denied, you generally have two options:

  1. Modify your IRB protocol to bring it into concordance with your data request,
  2. Modify your data request to bring it into concordance with your IRB protocol.

In case 1, you will need to modify your IRB protocol in sections other than 11b/3a or 15/5. In case 2, you will be using the link in eProtocol to modify the data request, which will result in changes to the imported text in sections 11b/3a.

For any questions please contact Stanford Privacy Office at privacy@stanford.edu

Thank you!

Please know that you have our sincerest thanks for the time and attention you have devoted to ensuring that the intended use of this highly sensitive data is fully and accurately documented.

Also, please bear in mind that you are not permitted to redistribute the data set to other researchers for their research, nor are you permitted to use this data yourself for a different research project. The permissions to use the data are tied to the research project described in your IRB protocol.