8.1.1 - Procedure for Access to Protected Health Information (PHI) by OUCOD Researchers

Introduction: Maintaining a system of human participant research compliance is a critical aspect of research conducted at academic institutions. Toward that end, this procedure outlines the actions that OUCOD faculty, staff, residents and students must adhere to for the conduct of human subjects research. This procedure also specifies disciplinary actions that may be imposed in instances of non-compliance.

Prerequisites: None

Procedure:

1. 1. The faculty person who is designated as the Principal Investigator of the IRB application will send an email to the Dean for Research and Innovation containing the IRB protocol, the names and titles of key personnel, the approval notice from IRB and data management plan (if any), for the proposed human subjects research project.
2. 1. 1. The Dean for Research and Innovation will upload the approved IRB protocol, approval notice and data management plan (if any) to the Intranet - Special Groups - Research IRB folder.
3. 1. 2. Once the Dean for Research and Innovation has reviewed the IRB protocol, approval notice and data management plan, he will email the Director of Compliance and the Compliance Coordinator, and CC the Principal Investigator, to notify them the documents have been added to the Research IRB Intranet folder.
          
4. 2. The Principal Investigator will provide the parameters of PHI being requested for their study via an email to the Director of Compliance and the Compliance Coordinator so that only the approved PHI is released for study purposes. Depending on the patient management system, the Director of Compliance or the Compliance Coordinator will:
      1. axiUm or OMS Vision - reply all to the email, including Dentistry IT Services Informatics using the cod-di@ouhsc.edu email address, identifying the Principal Investigator and other key personnel, who are named in the IRB protocol, and providing parameters of PHI that the Principal Investigator may access.
      2. Principal Investigator will go to Informatics to acquire any necessary reports created, as designated by the IRB protocol, to the file share designated by Dentistry IT Services.Graduate Orthodontics - reply all to the email, including the Ortho II and Paper Records Administrators, identifying the Principal Investigator and other key personnel, who are named in the IRB protocol, and providing parameters of PHI that the Principal Investigator may access.
5. 1. 1. 1. Principal Investigator will go to the Graduate Orthodontics Records Administrators to have any necessary reports created or paper records copied, as designated by the IRB protocol, to the file share designated by Dentistry IT Services.
             
6. 3. The Principal Investigator will use password protection to safeguard the electronic files or reports containing PHI that will be used for the duration of the study. All paper records will be kept secure at all times, as stipulated in OUHSC guidelines.
       
7. 4. The Principal Investigator is responsible for informing the Dean for Research and Innovation and the Director of Compliance about a change in key personnel on the study within 30 days.
       
8. 5. The Principal Investigator is responsible for obtaining confirmation of the deletion of data or removal of access for all study-related PHI from key personnel prior to graduation, change in participation in the study, or termination of employment, and will forward the confirmation to the Dean for Research and Innovation and the Director of Compliance.
       
9. 6. Disciplinary Actions: In addition to reporting to the OUHSC Office of HIPAA Compliance, faculty, staff, residents and students will be subject to disciplinary actions ranging from temporary suspension to termination of their employment, as determined by the Dean of the College of Dentistry in consultation with the Dean for Research and Innovation.