CITI Training

True or False: After a breach, patients should be notified.

False

True or False: An authorization or waiver of authorization is not necessary if the researcher is only looking at records of his or her own patients in a retrospective chart review and is only recording de-identified information for research purposes.

False

True or False: HIPAA permits a verbal authorization for research in certain circumstances.

False

True or False: hESC research requires collection of identifiable information.

False. There is no requirement for hESC research to collect identifiable information.

To obtain a complete waiver of authorization for a research project, the researcher must provide the Privacy Board evidence that the use and disclosure only involves information on deceased individuals.

False. This is not one of the criteria that must be met in order for the IRB or Privacy Board to approve the waiver or alteration of authorization.

Does HIPAA prohibit physicians from discussing recruitment into studies with patients for whom involvement might be appropriate?

Physicians can continue to discuss such options with their own patients, since this would be part of treatment.

The primary purpose of a Certificate of Confidentiality is to:

Protect identifiable research information from compelled disclosure.

The COI management plan aims to:

Provide procedures or extras steps to be taken to minimize the risk of bias when a COI is disclosed.

All of the following are examples of new enforcement rules under HITECH, EXCEPT:

Revocation of medical licensing by the Department of Health and Human Services

The FDA regulations governing disclosure of individual COIs require:

Applicants submitting marketing applications to disclose financial COIs of researchers who conducted clinical studies.

Risk of harm should be evaluated by these two things:

Both the magnitude (or severity) and the probability (or likelihood) of harm. Both elements must be considered. Although the probability that an individual subject could be identified is low, the magnitude of the possible harm is high given the sensitivity of the information.

These three action must be taken after a breach:

1.) Take Immediate action to stop the activity causing the breach, if applicable 2.) Conduct a detailed analysis to determine threshold of financial, reputational, or other harm that may have occurred. 3.) Notify the Privacy Official

To obtain a complete waiver of authorization for a research project, the researcher must provide the Privacy Board evidence of these three things:

1.) The use and disclosure of PHI involves no more than the minimal risk to the subject's privacy rights 2.) The reason the information being sought is necessary 3.) The reason it is not practicable to obtain an authorization

In general, ESCRO Committees specifically include this type of person:

A member of the lay public.

During an Institutional Review Board (IRB) meeting, any IRB member who may have a potential COI with a study under review should:

Disclose their potential COI and may answer questions, but recuse themselves from voting.

Risk of harm in social and behavioral sciences generally fall into these three categories:

Invasion of privacy, breach of confidentiality, and study procedures are the three categories that risks of harm in SBE research generally falls in. Invasions of privacy can occur if personal information is accessed or collected without the subjects' knowledge or consent. Confidentiality can be compromised through an unauthorized release of data, which could have a negative impact on the subjects' psychological, social, or economic status. In some cases, simply taking part in research can put subjects at risk. For example, if a researcher is conducting interviews with individual gang members, it may be necessary to find places to meet where other members of the gang could not observe the interaction.

A researcher's membership on an advisory board with an organization sponsoring research can create a COI because:

It may be difficult for the researcher to appear neutral, as the researcher may have an interest in the research's success.

A researcher calls you stating that he plans to submit a proposal to the NIH for a human subjects research study. He wants to know at what point he and his study team must submit COI disclosures to comply with the PHS regulation.

No later than the time of proposal submission.

Who should be a partner with the chair in running an efficient and compliant IRB meeting?

The IRB Administrator

Which of the following is true with respect to IRB chair time commitments?

The IRB chair's time commitment includes the IRB meetings, but may also include other activities such as expedited reviews and non-compliance issues.

What is an activity that the IRB administrator may do on behalf of the chair?

The administrator may ensure that determinations for vulnerable populations are being considered at convened meetings

What does appropriate provenance mean with regards to the embryo?

The embryo is no longer required for reproductive purposes and the donor of the embryo consented to the use of the derived hESCs.

IRB chairs must be familiar with what?

The organization's policies and procedures governing human subject protections, which should define the IRB's jurisdiction and processes which will, in turn, define the IRB Chair's responsibilities as well.

Additional safeguards that may be included in a social and behavioral study may include the removal of...

The removal of all direct identifiers from the data as soon as possible. When a possible disclosure of subjects' responses is the primary source of potential harm, collecting data anonymously may provide the best protection and removing direct identifiers is an additional safeguard. The other responses are additional safeguards, but refer to studies that may involve investigational drugs or are biomedical and not social behavioral.

Risks in social and behavioral sciences research are specific to these three things:

Time, situation, and culture. Research in the social and behavioral sciences sometimes does pose risks to subjects. Risks can be time, situation, and context specific. What may be a socially sensitive issue or topic at a given time and/or place may not be so at another time and/or place. The risk of emotional distress cannot be managed by anonymizing data, but rather by developing a plan to respond to the distress should it occur. Risks must always be minimized to the extent possible, regardless of the potential for benefit.

True or False: A researcher must provide a copy of the research authorization to the covered entity where he/she wants to look at or obtain PHI about the subject.

True

True or False: Encryption is an effective deterrent against breaches of PHI maintained electronically.

True

True or False: The cells derived from the embryos may be kept for many years.

True.

True or False: Asking women if they have had an abortion is an example of when situation and time are key to assessing risk of harm in a research study.

True. Asking women if they have had an abortion would carry very different risks in a country where abortion is a routine medical practice, a country where it is illegal, and a country in which it is legal but the issue is fraught with religious and political controversy. Purchasing tobacco products is generally illegal for persons under 18 years of age, so any assessment of the risk for teenagers will have to consider that the research focuses on an illegal activity and is assessing the subject population, not situation and time. Similarly, a survey about sexually transmitted diseases would carry different risks for middle class suburban men, clergy, and gang members and is assessing risk through the idea of subject population, not situation and time. Research on the prevalence of HIV-infected individuals in communities may stigmatize the community being studied, and the risk should be assessed as subject population, not situation and time either.

True or False: Quality of care of an IVF patient will not be affected by their decision to donate or not.

True. IVF patients who donate embryos for use in research are not considered human subjects under the Common Rule unless the investigator obtains data through interaction or intervention with the donor or obtains identifiable private information. In most cases, the identity of IVF patients who donate embryos for research purposes will not be known to the investigator. The investigator and the physician caring for the IVF patient should not be the same person to prevent conflict of interest. Consent should be obtained at the time of donation.

True or False: One major responsibility of ESCRO/SCRO/SCRO Committee is to review and approve the scientific merit of hESC research.

True. The NAS Guidelines do not specifically require annual re-review and re-approval of hES cell research. However, many ESCRO Committees perform continuing review similar to the reviews performed by IRBs. ESCRO Committees are responsible for facilitating the education of hESC research investigators.

Does HIPAA permit research authorizations to be combined with other documents?

Yes, research authorizations for may be combined with any other legal permission related to the research study, including another authorization or consent to participate.