Compliance Overview

The Cohort Discovery Tool lets you see patient counts and some simple summary statistics, but most research projects then wish to delve deeper and either conduct online chart review or work with structured datasets extracted from the clinical research data repository.

In order to work with detailed clinical data for research purposes at Stanford Medicine, you must explain your project and its intended use of clinical data to the Research Compliance Office, also known informally as "the IRB."

There are four options to consider:

  1. Create a new IRB protocol, managed online at This is the appropriate avenue for investigator-initiated research projects. It is also worth noting that an approved IRB protocol with an associated Data Privacy Attestation is required for self-service provisioning of online chart review.

  2. Modify an existing IRB protocol. This option also supports self-service provisioning of online chart review.

  3. Apply for a new determination from the Research Compliance Office that your project does not constitute "Human Subjects Research." The Research Informatics Center requires that all projects using this compliance avenue be sponsored by Hospital Clinical Quality Improvement. While chart review of de-identified data is possible using a determination, this is not yet a self-service process.

  4. Add yourself to an existing approved chart review project

If you have further questions about which avenue to pursue, please contact the Research Compliance Office using the contact information on this page:

If you decide to pursue option 1 and create a new IRB protocol, the compliance process required by the Privacy Office is documented in our step by step guide "New Chart Review Protocol."

If you decide to pursue option 2 and modify an existing IRB protocol, the compliance process required by the Privacy Office is documented in our "Modify Existing Protocol" page.

If you decide to pursue option 3 and use a Determination, the compliance process required by the Privacy Office is documented at "Using De-identified Data for Research."

While you are still at the "Preparatory to Research" phase of your investigation, e.g., organizing a new research consortium or seeking grant funding, you can use the Cohort Discovery Tool to count how many patients meet your criteria. You can also use the Chart Review Tools in de-identified mode. Chart Review only imperfectly de-identifies clinical documents so there is a risk of exposure to patient identifiers, but HIPAA does permit viewing identifiers for preparatory to research activities.  Just be sure to remember to contact the IRB once you are ready to launch your research.

Approvals Process

As indicated in the flow diagram below, in the case of research approvals, there are two distinct set of approvals required before you can use an IRB to self-provision a cohort for chart review. After the Privacy Office approves your Data Privacy Attestation, there is typically a 1-2 week delay before the IRB can review and approve the protocol itself.

One business day after both Privacy and IRB approvals are in place, your IRB number can be used for self-service chart review. This one-day delay occurs because IRB data is only shared with STARR once a day.

When the intent is not research, joint IRB-Privacy approval of the DPA is not required.

This video offers a walkthrough of the research compliance process with the Data Privacy Attestation electronically linked to an IRB protocol online in eProtocol.