IRB-HSR/ NCI-CIRB Protocol Information & Application Form

IRB-HSR/ NCI-CIRB Protocol Information & Application Form

IRB-HSR #

Protocol Title:

Sponsor Protocol #:

Submission Documents

The following documents are included with this submission (please check all that apply):

Most Current NCI CIRB Approval: required

One copy of this form (NCI CIRB Protocol Information & Application Form): required

One original signed IRB-HSR/ NCI CIRB Investigator’s Agreement: required

NCI-CIRB HIPAA Authorization with Title in Header: required

UVA Radiation Safety /HIRE/RCRC Committee Approval: if applicable

New Medical Device Application: if applicable

Pharmacy Approval: if applicable- this may be an email

General Information
Yes No / Do you/will you have a contract with an outside sponsor for this protocol?
IF YES- name of group you will have contract with:
Yes No / Is this protocol funded by a Grant?
IF YES- GIRB# for Approved Grant
Yes No / Does this study involve the use of recombinant DNA, biological vectors or infectious agents?
IF YES, IBC approval required. IBC#
Yes No / Will you be using any human specimens in this protocol?
IF YES, will all collection (i.e. blood drawing) and processing (i.e. anything that involves the specimen container to be opened) occur in a UVA clinic/hospital or clinical lab?
IF NO- attach approval from the Institutional Biosafety Board IBC#:
If you need to register with the IBC go to
Yes No
Yes No / Will this study involve the use of radiation for research purposes?
IF YES, see Appendix B and submit the approval from the UVa Radiation Safety/ HIRE/ RDRC Committee as applicable.
Yes No / Does this study involve a medical device that will be used at the UVa Health System that is not currently used at the UVa Health System?
IF YES, attach New Medical Device Application Form you submitted to UVa Clinical Engineering.
If there are questions on how to complete the form contact Clinical Engineering at 982-3857
Yes No / Will the study involve the use of a drug that will be handled by the investigational pharmacy?
IF YES, submit the Sponsors Protocol and the Investigators Brochure (if applicable) to the investigational pharmacy and attach a copy of their approval. You must notify the investigational pharmacist that their approval is required.
Yes No / Does this study involve gene transfer?
IF YES, you must follow theSchool of Medicine Policy on Gene Transfer Clinical Trials.
Yes No / Do you confirm the study team will follow the Privacy Plan found in Appendix C?
Yes No / Do you confirm the study team will follow the Recruitment Plan found in Appendix D?
Prisoners
Will this protocol enroll Prisoners?
For definition of a prisoner see:

NOTE: The NCI CIRB does NOT review protocols where a prisoner may be enrolled. The protocol must be submitted via IRB On Line and reviewed by the UVa IRB-HSR.

If you do not plan to enroll prisoners, but one of your subjects becomes a prisoner after enrolling in the study, notify the UVa IRB-HSR immediately.

Conflict of Interest Information

Do any of the investigators listed on this protocol have a conflict of interest in this project? Yes No

Examples of conflict of interest:

Investigator, investigator's spouse and/or any dependents in aggregate own more than a 3% share of stock in the sponsoring company or has received more than $10,000 in income over the previous 12 months from the sponsor of the study
For projects funded by the Public Health Service: the investigator, investigator’s spouse and/or any dependents in aggregate have (1) >$5,000 in combined value of equity in and income from a publicly traded company over the previous 12 months, or (2) any ownership interest in a non-publicly traded company whose product is being used in this protocol
Investigator holds or has applied for patent on investigational drug, device or intellectual property. The IRB strongly recommends that a protocol NOT be submitted to the IRB until the patent application has been submitted.
Investigator invented the device being tested in this study, regardless of patent status
Investigator serves on an advisory board or gives lectures for the company sponsoring this protocol
A complex relationship with the sponsor, which may give the appearance of a conflict to someone outside the project
Any of the previous examples might be true for relationships with a competing companies or drug or device manufacturers.

For more information see the UVa policy Financial Conflicts of Interest for Research Investigators ().

If YES, describe the conflict of interest and its potential conflict with this protocol.

2. Does anyone listed on this protocol, their spouse or any dependents serve as a director, officer, or member of an advisory board with the sponsoring company? Yes No

IF THE RESPONSE TO BOTH QUESTIONS IS NO, PROCEED TO THE STUDY PERSONNEL SECTION.

IF THE RESPONSE TO QUESTION 1 or 2 IS YES, ANSWER QUESTION A-C BELOW:

Indicate where you reported the conflict:

Grants and Contracts/OSP Office (on Proposal Approval Form)

Annual Disclosure of External Financial Interests (UVA on-line system)

Development (for donated products to be used in research)

B. If the UVA Conflicts of Interest Committee has reviewed the case, submit a copy of its management plan with this protocol to the IRB. If the UVA COI Committee has not yet reviewed the case, you must complete an Exemption Request for Conflict of Interest Form (). Before submitting your disclosure form it is recommended you contact one of the persons below to discuss this financial interest:

School of Medicine / Steve Wasserman / 243-7088
Other Schools / Dave Hudson / 243-0900

C. If you have not previously disclosed this financial interest, additional time may be required for the Conflicts of Interest Committee and the IRB to consider your financial disclosure and protocol respectively. Consideration of significant financial interests related to research is one of the factors the IRB takes into consideration in reviewing protocol safety.

Appendix A: Study Personnel

PLEASE NOTE THAT ALL PERSONNEL LISTED BELOW MUST HAVE COMPLETED IRB-HSR ONLINE TRAINING IN HUMAN SUBJECT RESEARCH PROTECTION BEFORE SUBJECTS MAY BE ENROLLED.

If an individual is a UVA employee, please list his/her official UVA registered e-mail address. Do not list an alias e-mail address on IRB-HSR forms. Ex: use , not
ALL individuals having contact with subjects or their identifiable information for this protocol must be listed below.
All e-mails from the IRB-HSR regarding a protocol will be sent to the PI, Study Coordinator(s) , Department Contact and IRB Departmental Coordinator (if applicable)

Principal Investigator (*must be an attending physician at UVA):First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address

School: Department: ______Division:

Only 1 person may be listed as the PI by the IRB-HSR- please list others as sub-investigators. If the PI is NOT a faculty member, a faculty member must be listed as a sub-investigator. Students are not allowed to be the Principal Investigator.

Study Coordinator I:
First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address:

School: Department: ______Division:

Study Coordinator II:First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address:

School: Department: ______Division:

Department Contact:First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address:

School: Department: ______Division:

This is usually a person who knows how to get in touch with the PI or Study Coordinator if they’re unavailable (i.e. PI secretary/department manager). The Department Chair should not be listed as the Department Contact.

Departmental IRB Coordinator: First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address:

School: Department:____ Division:

Sponsor/Granting Agency:

Name:

Address:

Phone: Fax:

Sub-investigators:

List ALL individuals who will have contact with subjects or will have access to research data that has identifying information (e.g.-subject name or medical record number)

First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address:

School: Department: ______Division:

First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address:

School: Department: Division:

First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address:

School: Department: Division:

First name: Last name: Degree:

Phone: E-mail: Messenger Mail Address:

School: Department: Division:

Yes No Are there additional sub-investigators? If Yes, attach additional pages.

APPENDIX B: Radiation Use

Does this study involve photo acoustic imaging, breast thermograph, tomography or ultrasound for research purposes?

Yes No

IF YES, consult with Allen Goode with the UVa Radiation Safety Committee (RSC)/ Human Investigations Involving Radiation Exposure (HIRE) Committee at to obtain applicable language to insert into the consent form. You will be required to submit the RSC/HIRE Committee approval to the IRB-HSR with this form.

Does this study involve nuclear medicine (radionuclide) imaging for research purposes?

Yes No

Radionuclide imaging or nuclear medicine includes such procedures as Scintigraphy, SPECT, Positron emission tomography (PET).
If YES, you will be required to submit the Nuclear Medicine Imaging for Research Form to the RSC/HIRE Committee.
Once you have RSC/HIRE Committee approval, you will be required to submit the approval to the IRB-HSR with this form.

Does this study involve x-rays including CAT scans, fluoroscopy, or mammography for research purposes?

Yes No

IF YES, will your consent use theStandard Wording from the HIRE Committee?

IF NO-you will be required to submit the X Ray Imaging for Research Form and submit the Hire Committee approval with this form the IRB-HSR.

Does this study involve the use of radiation therapy for research purposes?

Yes No

IF YES- Send final Protocol and Consent forms to RSC/HIRE COMMITTEE-by emailing them to Allen Goode at .

You are not required to obtain their approval.

Appendix C: Privacy Plan

1. Answer the questions below (1a-1e) to describe your/central registry’s plan to protect the identifiable data from improper use and disclosure.

1a. How will data be stored?

Choose only one of the following options:

Data, which may include health information or other highly sensitive data will be stored with HIPAA identifiers.

You MUST choose this option if case report forms will include such items as initials.

Data, which may include health information or other highly sensitive data will NOT be stored with any HIPAA identifier except date(s). This means:

Documents such as case report forms will have NO HIPAA identifiers except dates (e.g. no initials or medical record #)
HIPAA identifiers, except dates will be stored in a different place than the health information/specimens. A code such as subject # 1 will be used to link the identity of the individual (HIPAA identifiers) with the persons health information.
EXAMPLE:The HIPAA identifiers with the code (e.g.- John Doe=subject #1) will be stored in one location (computer drive ,paper file, memory stick, CD) and the health information (diagnosis, radiology results)will be stored in a different location (different computer drive, paper file in a different file cabinet, memory stick).

1b. Will specimens be stored by the UVa study team?

If YES, the following security precautions will be implemented:

Specimens will be kept in a locked freezer/ or locked room

Choose only one of the following options:

Access to the freezer/room will be limited to authorized personnel. Specimens with HIPAA identifiers will never be shared outside of UVa without the written permission of the subject.

Specimens will be stored with a code and no HIPAA identifiers.

1c. Will any of the data be stored electronically by the UVa study team?

Yes No

►IF YES, will it include any HIPAA identifiers with health information or other highly sensitive data?

►IF YES, where will it be stored?

Health Systems Computing Services (HS/CS) managed server that is configured to store data regulated by HIPAA.

Information Technology Services (ITS) managed server that is configured to store data regulated by HIPAA.

Server managed by the principal investigator’s department or school that is configured to store data regulated by HIPAA or highly sensitive data. The Principal Investigator should verify with their department that the server they plan to use is configured to store data regulated by HIPAA.

1d. Will any of the data be collected or stored in hard copy format by the UVa study team (e.g. on paper) ?

Yes No

►IF YES, where will it be stored?

Case report forms will be stored in a secure area with limited access.

Questionnaires/ surveys will be stored in a secure area with limited access.

Other -specify:

1e. The following procedures will also be followed.

Only investigators for this study and clinicians caring for the patient will have access to the data. They will each use a unique log-in ID and password that will keep confidential.
Each investigator will sign the University’s Electronic Access Agreement forward the signed agreement to the appropriate department as instructed on the form.

If you currently have access to clinical data it is likely that you have already signed this form. You are not required to sign it again.

UVa Institutional Data Protection Standards will be followed

Identifiable data is considered to be “Highly Sensitive”. A Limited Data Set is usually considered to be “Moderately Sensitive” and de-identified data is usually considered to be “Not Sensitive”.

If identifiable data (data with health information and HIPAA identifiers) is transferred to any other location such as a desktop, laptop, memory stick, CD etc. the researcher must follow the University’s “Electronic Storage of Highly Sensitive Data Policy”.Additional requirements may be found in the Universities Requirements for Securing Electronic Devices.
If identifiable health information is taken away from the UVa Health System, Medical Center Policy # 0218 will be followed.
The data will be securely removed from the server, additional computer(s), and electronic media according to the University's Electronic Data Removal Policy.
The data will be encrypted or removed if the electronic device is sent outside of UVa for repair according to the University's Electronic Data Removal Policy.
If PHI will be faxed, researchers will follow the Health System Policy # 0194.
If PHI will be emailed, researchers will follow the Health System Policy # 0193 and UVa Institutional Data Protection Standards .
The data may not be analyzed for any other study without additional IRB approval.
If you are using patient information you must follow Health System Policy # 0021.

Summary of Requirements to Comply with UVa Health System, Medical Center and University Policies and Guidance as noted above:

Highly Sensitive Data is:

-personal information that can lead to identify theft if exposed or

-health information that reveals an individual’s health condition and/or history of health services use.

PHI- a type of Highly Sensitive Data, is health information combined with a HIPAA identifier

LIMIT- Limit the HIPAA identifiers to the minimal amount needed- e.g. use initials instead of name, use a code instead of initials, limit amount/type of health information collected, and collect and share only those items you state you will in this protocol.
SECURE- Secure Highly Sensitive Data

Because single-use electronic devices and media, such as desktops, laptops, memory sticks, CDs, smartphones etc., can be easily lost or stolen, the University strictly limits the circumstances under which Highly Sensitive Data may be stored on them.In accordance with the University’s Electronic Storage of Highly Sensitive Data Policy, you must obtain written approval from your Department AND VP or Dean prior to moving data to single use devices or media by using the Highly Sensitive Data Storage RequestForm.

You additionally are responsible for applying all security safeguards covered in that policy, including but not limited to password protecting and encrypting any document on a single access electronic device.

If you use your smartphone to send email and your phone is not managed was not purchased and/or set up for you by the Health System, you cannot send Highly Sensitive Data via email.

In addition, do not use Outlook Web to send your email if it contains sensitive data.
Also, you are not allowed to auto forward your email to outside email systems like Gmail or Yahoo.
Do not save any email attachment containing Highly Sensitive Data to a single use device.

You are allowed to access Highly Sensitive Data stored on the University or Health Systems network via a VPN, however you cannot download any of the information onto your desktop or laptop.

Store files containing Highly Sensitive Data on a network drive specifically designated for storing this type of data, e.g. high-level security servers managed by Information Technology Services or the “F” and “O” managed by Heath Systems Computing Services. You may access it via a shortcut icon on your desktop, but you are not allowed to take it off line to a local drive.

If data will be collected and/or viewed via a website, it is critical that the website and associated data file are set up in a highly secured manner. Do not attempt without assistance from:

University Side:

Health System: Web Development Center: (434-243-6702)

Encrypt any electronic file containing Highly Sensitive Data that is not on a network drive specifically designated for this purpose. . See encryption solutions guidance.
Password protect any electronic device containing Highly Sensitive Data.
Lock up hard copies of Highly Sensitive Data.

PROTECT- Protect Highly Sensitive Data
Do not leave a hard copy file open on your desk when not using it and secure your computer when not attended.
Have discussions in private.
If you lose Highly Sensitive Data, you must report it in accordance with the Information Security Incident Reporting Policy.
Do not share Highly Sensitive Data with those not on the study team or those who do not have a need to know.
Do not share with sponsor unless subject has already signed a consent form or IRB has approved waiver of consent.
If faxing Highly Sensitive Data within UVa

Verify fax numbers before faxing, and use fax cover sheets with a confidentiality statement.
If printing to a central printer, ensure that names and identifiers on the documents are given to the correct patient.
If faxing Highly Sensitive Data outside of UVa to the sponsor or CRO
the receiving fax machine is in a restricted-access location,
the intended recipient is clearly indicated,
the recipient has been alerted to the pending transmission and is available to pick it up immediately.
Verify fax numbers before faxing, and use fax cover sheets with a confidentiality statement.
If printing to a central printer, ensure that names and identifiers on the documents are given to the correct patient.

Highly Sensitive Data may not be stored in a Drop Box.
If you plan to store data in the Cloud, you must consult with UVa Information Technology Services (ITS) to verify all essential security measures are in place. If you have a contract to use the cloud, the contract must include required security measures as outlined by ITS.
DO NOT email health information with name, medical record number or Social Security number to or from an email address that does not have an *HS in the address. May use subject initials if within the UVa HIPAA covered entity: The "UVA HIPAA covered entity" includes the hospital, health system, School of Medicine School of Nursing and the VP for Research Office.
Be aware: PHI collected without consent/ HIPAA authorization will NOT be allowed to leave UVa in an identifiable form unless the disclosure is tracked with Health Information Services.
Any Highly/Moderately Sensitive Data sent outside of UVa (e.g. to sponsor) that was obtained under a consent must be encrypted and password protected.

If your electronic device is sent outside of UVa for repair, all institutional data, whether Highly Sensitive or not, must be either encrypted or removed.
If transporting Highly/Moderately Sensitive Data in paper format from one UVa building to another, take the following steps to protect it:
Put paper inside a closed container such as a briefcase, or sealed envelope to limit the chance of a losing a piece.
Do not leave Highly Sensitive Data unattended in a public area if it is not locked up.

When the study is complete, all electronic files containing Highly/Moderately Sensitive Data must be stored on a network drive specifically designated for that purpose. They may not be stored on a single use device such as a CD.

STOP, THINK and BE CAREFUL-
If this was your Highly Sensitive Data how would you want it protected?
There are significant monetary fines to the individual and the institution for loss or misuse of sensitive data.
Your job may also be on the line.

2. Describe your/central registry’s plan to destroy the HIPAA identifiers at the earliest opportunity consistent with the conduct of the research and in accordance with any stipulations in the research sponsor contract and UVa records management guidelines.