Skip to main content

3.12 Ethical Access

Last Revised: 3/8/5/20252026

For an abbreviated version intended for investigators, coordinators, and study teams - please visit here: Ethical Access

1.0 Purpose

The purpose of this policy is to define ethical access and to describe the Organization’s requirements to protect the privacy of potential subjects in the context of recruitment for participation in research, or for identification of potential subjects for review of medical records.

2.0 Policy

It is the policy of the Organization that

  • 2.1 Identification of potential subjects, and approach to potential subjects to obtain consent, must occur in a manner that respects the privacy of that person.
  • 2.2 Identification of potential subjects for research involving medical or other records, and obtainment of information about such subjects, must occur in a manner that respects the privacy of that person

3.0 Ethical Access for Recruitment of Subjects

For the purposes of this policy, the recruitment of subjects requires two distinct activities, each of which must respect the privacy of potential subjects: (1) obtainment of information about the potential subject which leads the investigator to believe or conclude that the person is eligible for the research, and (2) subsequent approach to the person to explain the research and obtain their consent to participate.

  • 3.1. The obtainment of information about the potential subject which leads the investigator to believe or conclude that the person is eligible for the research must occur in a manner that does not represent an invasion of their privacy. That is, the investigator must have ethical access to clinical information about the person.

    • 3.1.1. Ethical access, in this context, may occur in one or more of three ways:

      • 3.1.1.1. The researcherinvestigator has legitimate access to a potential subject’s information for clinical purposes, and therefore has legitimate access to that person’s information for identifying potential research subjectspurposes. Specifically, an investigator may have ethical access to this information in this context in one or more of the following manners:

        • 3.1.1.1.1. The investigator has an existing clinical relationship with the potential subject; that is the information has been shared with the clinician for the primary purpose of care of the individual. The potential subject may or may not know this relationship exists; for example, a specialist consulted informally by the primary provider to assist in the care of the person may never have met the person, but the clinical relationship, and hence ethical access exists. Similarly, members of a “care team” (for example, a hospital pharmacist, or nurse practitioner that rounds with the primary physician provider) have a clinical relationship and therefore have ethical access.

          Note

          that
        • 3.1.1.1.1.1. Since Nebraska Medicine and Children’s Nebraska are research institutions and clinical care may include participation in research, the “care team” does not usuallymay include a research coordinator acting(who onmay behalfor may not have a relationship with the potential subject outside of the investigator.research However,context) theacting IRBwith or expedited reviewer, or the IRB Chair or Executive Chair may extend “ethical access” to that personand under limiteddirect circumstances (for example, when the risks associated with losssupervision of confidentialityan areinvestigator.
        low and the information sought is not sensitive). In general, these circumstances would be similar to the conditions of 45 CFR 46.116(f).

    • 3.1.1.1.2. The investigator works with a provider who has an existing clinical relationship with the potential subject, and the relationship between the investigator and the provider is such that the investigator could reasonably be called upon to care for the person in a clinical setting. For example, a physician partner of the investigator within the same specialty and clinical group might have the responsibility to care for the person while on hospital service, or while taking night phone calls. Under these circumstances, for the purpose of this policy, the investigator has ethical access to information about the person they would reasonably need to know to care for that person.

    • 3.1.1.1.3. The investigator’s professional responsibilities (independent of their role as a researcher) require that they have this information. ForExamples example,include, but are not limited to, a hospital epidemiologist would have access to a list of persons with positive blood cultures, as part of hertheir duties; an Operating Room Nursing supervisor would have a list of names and diagnoses of persons scheduled for surgical procedures on a given day.

      day; a clinic front-desk person or medical assistant who is responsible for checking in and/or rooming patients.

  • 3.1.1.2. The potential subject has given express consentpermission for investigators to search medical records or other databases to determine potential eligibilityeligibility. (forThis example,express permission may arise in one or more of the following manners:

    • 3.1.1.2.1. The patient may have provided permission thru the Nebraska Medicine or Children’s Nebraska Conditions of Treatment Opt-in for Clinical Research utilizing the READi Core).Core.

    • 3.1.1.2.2. The patient may have consented to be included in a registry of potential research subjects.

      Note: This registry may be part of another therapeutic or non-therapeutic research study, or may be as a separate Data Registry protocol which includes permission for review of the electronic health record or other records to determine potential eligibility for future research.

    3.1.1.2.3. The potential subject has provided verbal or other permission for a member of the research team to review of the electronic health record or other records, to determine potential eligibility for a specific research protocol.

    Note: “Permission” in this context does not need to be formal or written, and can be obtained by anyone with a clinical relationship with the potential subject (for example, clinic staff).

    3.1.1.3. The IRB or an expedited reviewer has waived the requirement for the potentialethical subject’s consentaccess by finding that

    • 3.1.1.3.1. the waiver of the ethical access requirement constitutes no more than minimal risk to the person’s privacy

      privacy; and

    • 3.1.1.3.2. the waiverIRB or expedited reviewer judges that a reasonable person would not object to limited review of the ethicalelectronic accesshealth requirement will not adversely affect the person’s rightsrecord, or welfare

      other records, to determine eligibility; and

    • 3.1.1.3.3. it iswould be impracticable to identify or recruit persons without the waiver (for example, it is impracticable to have someone with ethical access identify or recruit persons)

      Note that waiver of the requirement to obtain the potential subject’s consent to have access to the their information to determine eligibility does not imply that the requirement for consent to participate in the research is also waived.

      .

    3.2. Subsequent approach to the potential subject to explain the research and obtain their consent to participate must also occur in a manner that respects the person’s privacy, and that minimizes the perception of dissemination of private information outside the clinical context (despite “ethical access” as described above.)context. “Approach to the potential subject” may refer to physical approach to the potential subject (that is, a face-to-face contact), verbal contact (via telephone or other means of communication) or written contact (by letter or email addressed personally to the potential subject).

    • 3.2.1. Physical approach: Potential subject may be approached by a member of the investigatorresearch team if at least one of two conditions applies:

      • 3.2.1.1. The investigatormember of the research team approaching the potential subject has an existing clinical relationship with the potential subject.subject, Inor contrastmust be able to requirementsexplain above,to the potential subject mustwhy bethey awarehave ofethical thisaccess existing(as relationship;described thatabove); is, the person must already know the investigator in their clinical role; orOR
      • 3.2.1.2. Someone with an existing clinical relationship has approached the potential subject, introduced the existence of the research study, and asked permission for a member of the investigatorresearch (or their representative)team to approach the potential subject to discuss the research.

      Other personnel who may have access as described above (investigator with existing clinical relationship but who has never met the potential subject, or persons who have other professional access to identifiable information) may not directly approach the potential subject without introduction by a care provider and the express permission of the potential subject. Under limited circumstances, the IRB may approve approach by such persons without prior introduction.

    • 3.2.2. Verbal Contact

      • 3.2.2.1. Verbal contact initiated as a result of identification through existing clinical relationship will follow the same pattern as for physical approachapproach, as described above.
      • 3.2.2.2. Verbal contact initiated based on the Conditions of Treatment Form designation (“opt-in” designation) must also follow procedures described in HRPP policy 3.6 (Subject Recruitment Through Direct Invitation) (which specifies the content and format of communication and frequency and timing of messages.

    • 3.2.3. Written Contact

      • 3.2.3.1. Written contact must follow procedures described in HRPP policy 3.6 (Subject Recruitment Through Direct Invitation) (which specifies the content and format of communication, identification of recipient and sender, return contact information, and frequency and timing of messages).

    4.0 Ethical Access for Review of Medical Records

    • 4.1. For research that involves review of medical or other records, and where consent of the subject has been waived under HHS or FDA regulations, the requirement for ethical access will still apply to identification of potential subjects, as above.

    4.2. Once identified, review of the medical or other records may be performed by any person authorized in the IRB application, under the supervision of the Principal Investigator.

    Note: it is the responsibility of the PI to assure that all persons accessing medical and other records have adequate training in maintaining patient confidentiality.

    5.0 Investigator Responsibilities

    • 5.1. Investigators must describe how they have ethical access in the appropriate sections of the relevant IRB application, or justification for waiver of the requirement.

      • 5.1.1. If the investigator does not have ethical access for the purposes of recruitment, the investigator may add a co-investigator with the appropriate access, whose role would be to introduce the potential subject to the investigator (as per above).

      • 5.1.2. If the investigator wishes to use a research coordinator acting on their behalf, justification must be provided.

      • 5.1.3. If the investigator does not have ethical access for the purposes of review of medical records, the investigator may

        • 5.1.3.1. add a co-investigator with the appropriate access, whose role would be to identify potential subjects and gather de-identified data for the investigator.investigator; ThisOR
        role
      • 5.1.3.2. can also be taken byutilize an “honest broker”, whose role would be to identify potential subjects and gather de-identified data for the investigator (per HRPP policy 3.4; Use of Protected Health Information in Research); orOR
      • 5.1.3.2.3. provide justification for waiver of ethical access

    6.0 IRB Responsibilities

    • 6.1. The IRB (or the expedited reviewer) will evaluate ethical access as part of its determination whether or not the research satisfies the criteria for approvalapproval, (especially 45 CFR 46.111(a)(7) and 21 CFR 56.111(a)(7); “When appropriate, there are adequate provisions to protect the privacy of subjects”)
    • 6.2. If the investigator requests a waiver of ethical access, the IRB (or the expedited reviewer) must determine whether the criteria for waiver of ethical access (as described above) have been met.
    • 6.3. The IRB (or the expedited reviewer) must determine that access to medical records also satisfies requirements of the HIPAA Privacy Rule per HRPP policy 3.4 (Use of Protected Health Information in Research).

    DOCUMENT HISTORY:

     Written: 4/16/2018 (Approved: 4/16/2018) - original author not recorded

     Revised: 11/20/2018 - revision not documented

     Revised: 2/18/2019 - revision not documented

     Revised: 3/5/2025 - Specified criteria for waiver of ethical access (section 3.1.1.3); removed citations to pre-2018 Common Rule; formatting and stylistic changes.

     Revised 8/5/2026 - Clarified that “Investigator” includes all members of the research team who are authorized to interact with human subjects per the IRB application section I; revised to allow research coordinator “acting with and under direct supervision of an investigator” to be considered part of the “care team” and therefore to have ethical access since they have an existing clinical relationship (section 3.1.1.1.1.1); added “clinic front-desk person or medical assistant who is responsible for checking in and/or rooming patients” as an example of professional responsibilities (independent of their role as a researcher) allowing ethical access (section 3.1.1.1.3); revised section 3.1.1.2 to better describe situations where potential subjects provide “permission” for investigators to search medical records or other databases to determine potential eligibility; added option for potential subject to provide “verbal or other permission” for a member of the research team to review of the electronic health record or other records, and clarified that “permission” in this context does not need to be formal or written (section 3.1.1.2.3); modified conditions for waiver of ethical access to delete “will not adversely affect the person’s rights or welfare” and substituted “a reasonable person would not object to limited review of the electronic health record, or other records, to determine eligibility” (section 3.1.1.3.2); in the context of physical approach to a patient, deleted the requirement that the potential subject be aware of the existing relationship with the member of the research team, and substituted “must be able to explain to the potential subject why they have ethical access” (section 3.2.1.1); better defined the role of the honest broker (section 5.1.3.2); added reference to FDA regulations at 21 CFR 56.111(a)(7); stylistic changes.

    Back to top