7.3 Data Registries

Last Revised: 4/16/2025

1.0. Purpose

The purpose of this policy is to describe the Organization’s requirements for creation and operation of a data registry, and for research use of data from a registry.

2.0. Policy

It is the policy of the Organization that

• 2.1. Internal registries, as defined in section 3.0 below, utilized either wholly or in part for human subject research must be reviewed and approved by the IRB. All IRB approved registries must comply with the following requirements.
  • 2.1.1. The purpose and goals of the registry are clearly justified.
  • 2.1.2. The registry complies with all applicable requirements of HHS regulations at 45 CFR 46 and FDA regulations at 21 CFR 56.
  • 2.1.3. The minimum amount of protected health information (PHI) or identifiable private information (IPI) necessary to accomplish the purpose and goals of the registry are retained in the registry.
  • 2.1.4. There are acceptable safeguards to protect the confidentiality and integrity of data in the registry in accordance with the HIPAA Privacy Rule, other regulations as appropriate, and Organizational policies.
  • 2.1.5. Procedures in place for release of PHI or IPI from the registry comply with Organization privacy policies.
  • 2.1.6. As necessary, a Data Use Agreement (DUA), Data Transfer Agreement (DTA), or a Business Associate Agreement (BAA) is in place before any data is released.
• 2.2. External Data Registries (as defined in Section 3.0 below) must be reviewed by the Office of Regulatory Affairs (ORA) before PHI or IPI from persons associated with the Organization are submitted.

3.0. Definitions

• 3.1. Internal Data Registry is a repository of data housed and administered within the Organization under the oversight of the UNMC IRB. The data may include PHI, IPI or may be limited to de-identified data. For the purpose of this policy, a data registry is intended to be used wholly or in part for human subject research.
• 3.2. External Data Registry is a repository of data housed and administered at an external site normally under the oversight of an external IRB. The data may include PHI, IPI or may be limited to de-identified data. For the purpose of this policy, a data registry is intended to be used wholly or in part for human subject research.
• 3.3. Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public (for example, a medical record) (45 CFR 46.102(e)(4)).
• 3.4. Identifiable Private Information refers to private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information (45 CFR 46.102(e)(5)).

4.0. ORA and IRB Responsibilities

• 4.1. Internal Data Registries
  • 4.1.1. The IRB will review creation of an Internal Data Registry in accordance with all applicable federal regulations and HRPP policies.
    • 4.1.1.1. An expedited review process may be utilized as applicable in accordance with HRPP policy 2.3 (Expedited Review)
  • 4.1.2. The IRB will ensure that informed consent of subjects whose data is to be entered into the data registry is obtained and documented, or provide a waiver of informed consent, in accordance with 45 CFR 46.116 and 117, FDA 21 CFR 50.20 and 27, and institutional policies.
  • 4.1.3. The ORA must ensure that appropriate agreements (Data Use Agreement, Data Transfer Agreement) are fully executed prior to final release of the Data Registry.
• 4.2. External Registries
  • 4.2.1. Submission of clinical data with or without identifiers that has been collected solely for clinical purposes to an external data registry (that is utilized, either wholly or in part, for human subject research) does not constitute engagement in human subject research. It is therefore not subject to UNMC IRB approval, provided the healthcare professional submitting the data (1) is not involved with the research (aside from submitting the clinical data), and (2) will not, in the future, use data in the external registry for research in which they are participating.
  • 4.2.2. If the clinical data contains PHI, authorization for disclosure of the PHI to the External Data Registry must be obtained in accordance with 45 CFR 164.508(c), or authorization must be waived by the UNMC IRB or the Privacy Board associated with the External Data Registry in accordance with 45 CFR 164.512(i).
  • 4.2.3. In consideration of such factors as sensitivity of the data collected, the subject population, whether the registry is under the oversight of an external IRB or government entity, and Organizational requirements, Assistant Vice-Chancellor for Regulatory Affairs, in consultation with the IO, may require submission of additional information regarding administration of the registry, data security, and processes for release of data.
  • 4.2.4. If the healthcare professional submitting the data is involved with the research (for example, will be an author on manuscripts, or plans to subsequently use data in the registry for different research purposes) then the Organization is engaged, and the submission of identifiable private information constitutes research. It is therefore subject to UNMC IRB approval (per section 4.2 above) and the requirement for informed consent (per sections 4.5 and 4.6 above).

5.0. Investigator Responsibilities

• 5.1. The creation of a registry that is utilized, either wholly or in part, for human subject research is subject to IRB review, and the investigator who develops and/or maintains the registry must submit a Data Registry Application.
  • 5.1.1. If the registry will also include collection of human biological material (HBM) the Human Biological Material Banking Application must be completed instead.
• 5.2. The investigator must obtain appropriate agreements (Data Use Agreement, Data Transfer Agreement) prior to collecting data into the registry.
• 5.3. The investigator must obtain informed consent of subjects whose data is to be entered into the data registry, or obtain a waiver of informed consent, in accordance with 45 CFR 46.116 and 117, FDA 21 CFR 50.20 and 27, and institutional policies, prior to collecting data into the registry.

6.0. Research Use of Data from a Registry

• 6.1. Use of data from a Data Registry requires submission of a Medical Records application (Records Review application), and review and approval of the IRB in accordance with HRPP policies 2.2 (Full Board Review) or 2.3 (Expedited Review), or by the ORA in accordance with HRPP policy 2.6 (Exempt Research).
• 6.2. The use of PHI or IPI stored in a data registry requires informed consent of the donor, unless:
  • 6.2.1. Consent obtained at the time the data was placed into the registry was sufficiently detailed regarding the future use of the data that a reasonable person would expect that the consent would permit the types of research conducted; or
  • 6.2.2. Consent is waived under 45 CFR 46.116(f)) or 21 CFR 50.22, and, if PHI is involved, authorization is waived under 45 CFR 164.512(i).

DOCUMENT HISTORY:

 Written: 1/14/2016 (Approved: 1/14/2016) - original author not recorded

 Revised: 3/2/2018 - revision not documented

 Revised 4/16/2025 - Revised definition of data registry to be inclusive of non-clinical registries; restructured policy to focus on responsibilities of investigators and IRB/ORA; deleted description of processes more appropriate for SOPs; stylistic changes