Secondary research is common across many areas of human subjects research. Researchers may use existing medical records, survey responses, databases, educational records, registries, or other previously collected information to answer new research questions.
Because the information already exists, researchers sometimes assume that secondary research does not require IRB review. However, that is not always the case.
Depending on the type of information being used and how the research will be conducted, a study involving secondary data may qualify for Exempt Category 4 under the federal regulations. Understanding the requirements of this category can help researchers prepare their IRB submissions and better understand whether an exemption may apply.
What Is Exempt Category 4?
Exempt Category 4 applies to certain secondary research involving identifiable private information or identifiable biospecimens.
Secondary research generally involves using information or biospecimens that were previously collected for another purpose. Rather than interacting with participants to collect new information, the researcher is analyzing existing materials.
For example, a researcher may want to:
- Analyze existing medical records
- Use data from a previously completed survey
- Examine information from an existing database
- Conduct research using educational or administrative records
- Analyze data that was originally collected for another research study
- Use previously collected biospecimens for a new research purpose
Whether the research qualifies for Exempt Category 4 depends on the specific circumstances and the criteria outlined in the regulations.
Simply using existing information does not automatically make a study exempt.
When Might Secondary Research Qualify for Exempt Category 4?
There are several pathways under Category 4 that may allow qualifying secondary research to be exempt.
One pathway involves the use of identifiable private information or identifiable biospecimens that are publicly available.
Another pathway may apply when the researcher records information in a way that prevents the investigator from readily identifying the individuals whose information is being used. Under this pathway, the investigator generally cannot contact or re-identify the participants.
Category 4 may also apply to certain research involving identifiable health information that is regulated under HIPAA, including research that uses information subject to HIPAA authorization or waiver requirements.
There is also a pathway for certain research conducted by or on behalf of a federal department or agency using information collected or generated by the government for nonresearch purposes.
Because these pathways have specific requirements, researchers should carefully consider which one, if any, applies to their study.
What Does “Identifiable” Mean?
One of the most important considerations in secondary research is whether the information being used is identifiable.
Identifiable information may include direct identifiers, such as names or medical record numbers, as well as combinations of information that could allow an individual’s identity to be readily ascertained.
The presence of identifiable information does not automatically prevent a study from qualifying under Category 4. However, the way information is accessed, recorded, and handled can affect whether the exemption criteria are met.
For example, a researcher may need access to identifiable information to locate relevant records but record only a limited dataset for research purposes.
The details matter.
Researchers should clearly explain to the IRB:
- What information will be accessed
- Whether the information contains identifiers
- Whether identifiers will be recorded for research purposes
- Who will have access to the information
- How the information will be stored
- Whether participants could be readily identified from the research data
Publicly Available Information
Some secondary research may qualify under Category 4 when the identifiable private information or identifiable biospecimens being used are publicly available.
However, researchers should not assume that information found online is automatically considered publicly available for purposes of the exemption.
The source of the information, the expectations surrounding access, and the nature of the information may all be relevant considerations.
For example, information that can be freely accessed by the general public may be treated differently from information that requires registration, membership, approval, or special access.
Researchers should provide the IRB with clear information about where the data comes from and how it will be accessed.
Recording Information Without Readily Identifiable Information
Another Category 4 pathway may apply when researchers record information in a manner that does not allow them to readily identify the individuals whose information is being used.
Under this pathway, the investigator cannot contact or re-identify the individuals.
This distinction can be important.
A researcher may access a source containing identifiable information but record the research data without names or other information that would allow the individuals to be readily identified.
For example, a researcher conducting a chart review may review records containing identifiable information but record only the variables necessary for the research analysis.
The IRB will need to understand exactly what information the researcher can access and what information will actually be recorded for the study.
Secondary Research and HIPAA
Some secondary research involving protected health information may also qualify under Category 4 when the applicable HIPAA requirements are satisfied.
HIPAA and the Common Rule are separate regulatory frameworks. A study involving protected health information may need to meet both the applicable human subjects research requirements and the relevant HIPAA requirements.
Depending on the study, researchers may need:
- HIPAA authorization from participants
- A waiver or alteration of HIPAA authorization
- To use a limited data set with an appropriate data use agreement
- To use information that has been appropriately de-identified
The specific pathway depends on the information involved and how it will be used.
Researchers should not assume that receiving an exemption determination automatically resolves all HIPAA requirements.
Examples of Research That May Qualify
Every study must be evaluated based on its specific details, but examples of secondary research that may potentially qualify under Category 4 include:
- A retrospective review of existing medical records
- Analysis of previously collected survey data
- Research using an existing educational database
- Analysis of publicly available datasets
- Research using de-identified information obtained from a third party
- A study using previously collected information when the researcher records data without readily identifiable information and meets the other applicable requirements
Whether a particular study qualifies depends on how the information is obtained, accessed, recorded, and used.
Common Misunderstandings About Category 4
“The data already exists, so it does not need IRB review.”
Not necessarily.
Existing data can still involve identifiable private information or identifiable biospecimens. The fact that the information was previously collected does not automatically mean the new research use is exempt.
“If I remove names, the study is automatically exempt.”
Not necessarily.
The way information is recorded is only one part of the analysis. The IRB may also need to consider what information the researcher can access, whether individuals can be readily identified, and whether the other requirements of the applicable exemption pathway are met.
“Secondary research never involves human subjects.”
That is also not necessarily true.
Research involving existing information may still meet the definition of human subjects research depending on whether investigators obtain or use identifiable private information or identifiable biospecimens.
What Should You Include in Your IRB Submission?
A clear and complete application can help the IRB understand whether Category 4 may apply to your research.
Be prepared to describe:
- The source of the information or biospecimens
- Why and how the information was originally collected
- What information the research team will access
- Whether the information is identifiable
- What information will be recorded for research purposes
- Whether the research team will contact participants
- Whether participants could be re-identified
- How information will be stored and protected
- Whether HIPAA applies
- Whether any agreements or permissions are required to access the information
It can also be helpful to clearly explain the flow of information from the original source to the research team.
Exempt Does Not Mean No Responsibilities
Even if a study qualifies for an exemption, researchers still have important responsibilities.
Researchers must continue to protect the privacy of individuals and maintain appropriate safeguards for confidential information. Other requirements, including HIPAA, institutional policies, data use agreements, and applicable state or local laws, may also apply.
Researchers should also remember that changes to an exempt study may need to be reviewed depending on the nature of the changes and the policies governing the research.
Understanding Exempt Category 4
Exempt Category 4 can provide a pathway for certain types of secondary research, but eligibility depends on the details of the study.
The source of the information, whether it is identifiable, how the researcher records the information, and whether other regulatory requirements apply can all affect whether the research qualifies.
Before beginning secondary research, researchers should carefully evaluate the study procedures and provide the IRB with a clear explanation of the information being used.
For a broader overview of exempt research and all eight exemption categories, visit our guide to Understanding Exempt Research.
Disclaimer: This article provides general educational information and is not a substitute for an IRB’s review or determination regarding a specific research study.