Obtaining Identified Clinical Data for Research with Stanford IRB Protocol

You only need to complete this process once per IRB protocol, unless your data requirements expand beyond the original scope of an approved protocol.

The process for obtaining Protected Health Information with a Stanford IRB has three steps.

Talk to us

We’re here to help, and the easiest way to enlist our help is to chat with us about your research needs.

If you have not yet done so, please use our online consultation services request form to contact us, describe to us your research study, and schedule a brief phone call so you can bring us up to speed.

Complete the Data Privacy Obligations Attestation in eProtocol

In eProtocol, follow the link in sections 11b/15a (or 3/5 for a Chart Review protocol) to specify the PHI and roughly categorize the clinical data in your data request. This tool generates text in your IRB privacy and confidentiality sections.

If you do not yet have a protocol, you will need to create one. And if you have an already approved protocol, you will need to start a modification. 



Wait for Privacy and IRB Approval

First the University Privacy Office will approve the data request, then the IRB must approve your protocol. The Privacy Office and/or the IRB may contact you directly during this phase if they have questions about your intended use or disclosure of the requested data elements.

Once both groups have approved your request, you are approved to use or disclose the identifying clinical data for research purposes documented in your Privacy attestation and IRB.

Once you have completed this process, you can either get back in touch with us for a custom data pull or provision a chart review yourself as follows

1. Create your search in Cohort Discovery Tool. 


2. Under 'Searches' select 'Save patients for Chart Review' and supply IRB number when prompted. 

3. Refresh the page then navigate to Patient Chart Review using the dropdown menu in the middle of the toolbar.

What to do if Privacy denies my request?

If your application is denied, you generally have two options:

  1. Modify your IRB to bring it into concordance with your data request,
  2. Modify your data request to bring it into concordance with your IRB.

In case 1 you will be modifying the text of you IRB in sections other than 11b or 15a. In case 2 you will be using the link in eProtocol to modify the data request, which will result in changes to the text in sections 11b / 15a.

For any questions please contact Stanford Privacy Office at privacy@stanford.edu

Thank you!

Please know that you have our sincerest thanks for the time and attention you have devoted to ensuring that the intended use of this highly sensitive data is fully and accurately documented.

Also please bear in mind that you are not permitted to redistribute the data set to other researchers for their research, nor are you permitted to use this data yourself for a different research project. The permissions to use the data are tied to the research project described in your IRB protocol.