Standard Operating Procedure 903: Records Access
I. Scope
The Institutional Review Board is a body established in federal regulations. Its records, including but not limited to protocol submissions, investigator correspondence, participant contacts, budgets, meeting minutes, expenditures, noncompliance records, audits, and training records, are housed within the Human Research Protection Program. HRPP records are maintained to support regulatory oversight of human subjects research and often contain confidential, proprietary, or sensitive information. The HRPP will disclose records to external parties only when disclosure is required by applicable law or valid legal process. Records will be disclosed to internal parties as described below. Careful management and control of these records is of the utmost importance to ensuring the Human Research Protection Program is able to conduct its work and maintain both researcher and public trust. At no time will any records subject to a Certificate of Confidentiality be disclosed to any party outside of the University.
II. Records Access
A. Authorized Bases for External Disclosure
HRPP records may be disclosed outside the institution only under one of the following circumstances:
- A valid judicial subpoena, court order, or other legally enforceable process requiring production of records. In the absence of a valid judicial subpoena, court order, or other legally enforceable process, the HRPP will decline such requests and refer the requesting entity to the institution’s Office of General Counsel. The HRPP does not voluntarily provide research oversight records for the purpose of supporting law enforcement or civil enforcement activities unrelated to the institution’s regulatory obligations regarding human subjects research.
- A valid request made pursuant to applicable public records or open records laws, as determined by the institution’s designated public records officer or appropriate Legal Affairs representative.
- Federal regulatory oversight activities conducted by agencies with statutory authority over human subjects research compliance (e.g., regulatory inspections or audits), when such access is required under applicable regulations.
B. Internal Records Requests – Auditing & Compliance Monitoring
Utah State University’s Human Research Protection Program cooperates with requests from all internal units with an auditing or compliance monitoring function. This includes, but is not limited to, units such as Internal Audit, the Controller’s Office, Sponsored Programs, Sponsored Programs Accounting, Research Integrity & Compliance, the Institutional Animal Care and Use Committee, University Ethics & Compliance Services, Legal Affairs, the Sorenson Center for Clinical Excellence Privacy Office, and Information Technology. Investigators generally will not be notified when records are provided as a result of these internal requests. Only the Executive Director of Human Research Protections, the IRB Chair, IRB Vice Chair, or Vice President for Research shall release records of this nature.
C. Internal Records Requests – Supervising & Performance Management
Utah State University’s Human Research Protection Program cooperates with requests from supervisors to assess the performance of an individual in their direct line of reporting. Such requests must be completed in writing, by the supervisor, identifying the business or supervisory need the request supports. At least two members of the HRPP Leadership (The Vice President for Research, the IRB Chair, IRB Vice Chair, and/or Executive Director of Human Research Protections) shall review these requests and document their approval before the records can be shared. High-level details are provided through this process (e.g. number of active protocols, number of closed protocols, titles and approval dates of protocols, etc.); more specific requests such as numbers of participants enrolled or copies of informed consent documentation should be tied to an audit or monitoring function. Only the Executive Director of Human Research Protections, the IRB Chair, IRB Vice Chair, or Vice President for Research shall release records of this nature.