Skip to main content

1.17 Retention of Research Records

Last Revised: 12/17/2025

1.0 Purpose

The purpose of this policy is to describe the requirements for retention of research records by the investigator.


2.0 Policy

It is the policy of the Organization that

  • 2.1. All records associated with non-exempt human subject research must be retained securely, for at least seven years beyond the completion or closure of the study, or longer as required by sponsors. If records include subject identifiers, those identifiers must be retained with the research records.
  • 2.2. All records associated with exempt human subject research must be retained securely for at least three years beyond the completion or closure of the study.

3.0 Required Records

  • 3.1. Research records include:
    • 3.1.1. All applications, other forms, communications, reports and other documents created in, or stored in, RSS.
    • 3.1.2. Subject files including original signed consent documents and relevant research data (including but not limited to case report forms, laboratory or radiograph results, clinical notes not also stored in an Electronic Health Record, completed questionnaires and other research data).
    • 3.1.3. All communications between the investigator and the sponsor or funder, or, for multisite studies, between the local investigator and other investigators or coordinating center(s).
  • 3.2. For applications and reports generated within RSS (for example, the IRB Application, Request for Change, Continuing Review, Incident Reports) the presence of the information within RSS constitutes “retention” of the record for the purpose of this policy.

4.0. PI Responsibilities

  • 4.1. PI or designee will ensure that research records associated with non-exempt human subject research will be retained securely, for at least seven years beyond the completion or closure of the study, or longer as required by sponsors. If records include subject identifiers, those identifiers must be retained with the research records.
  • 4.2. PI or designee will ensure that research records associated with exempt human subject research will be retained securely for at least three years beyond the completion or closure of the study.
  • 4.3. If the research involves use of protected health information subject to the HIPAA Privacy Rule, the PI must also maintain records of all disclosures of PHI for at least 7 years after (whichever is later): (1) the last subject has completed their participation in the study; or (2) the date of the last disclosure of identifiable health information from study records, if disclosures continue after all subjects have completed the study (45 CFR 164.528).

5.0. Department, College or Institute Responsibilities

  • 5.1. If the PI resigns or otherwise departs from the Organization before the end of the designated retention period, the PI’s department, College or Institute is responsible for maintaining the research records.
    • 5.1.1. If a student who is the PI of the research departs from the Organization before the end of the designated retention period, the student’s faculty advisor is responsible for maintaining the research records.
  • 5.2. If the PI is a volunteer faculty, then the Dean or other person taking responsibility for assuring the PI fulfills his/her responsibilities (as described in HRPP 1.26 [PI Qualifications and Responsibilities]) is responsible for maintaining the research records.

ADDENDUM

Under the HIPAA Privacy Rule, subjects have the right to ask the Organization for an accounting of certain disclosures of their identifiable health information for a period dating 6 years from the date of the last covered disclosure. To ensure that the Organization can meet this accounting requirement, investigators must retain study records, along with records of all disclosures of study information, for at least 7 years after either of the following (whichever is later) (1) the last subject has completed his or her participation in the study; or (2) the date of the last disclosure of identifiable health information from study records, if disclosures continue after all subjects have completed the study {45 CFR 164.528}

DHHS regulations require that, “records relating to research which is conducted shall be retained for at least 3 years after completion of the research.” {45 CFR 46.115(b)}

FDA requires that sponsors and investigators participating in research subject to IND regulations retain “records and reports required by this part for 2 years after a marketing application is approved for the drug; or if an application is not approved for drug, until 2 years after shipment and delivery of the drug for investigational use is discontinued and the FDA so notified.” {21 CFR 312.57(c)}

FDA requires that sponsors and investigators participating in research subject to IDE regulations retain the records “for a period of 2 years after the latter of the following two dates: The date on which the investigation is terminated of completed, or the date that the records are no longer required for purposes of supporting a premarket approval application or a notice of completion of a product development protocol.” {21 CFR 812.140(d)}


DOCUMENT HISTORY:

 Written: 12/28/2015 (Approved: 12/28/2015) - original author not recorded (original policy #3.5)

 Revised: 2/2/2018 - revision not documented

 Revised: 2/18/2019 - revision not documented

 Revised: 4/15/2022 - deleted reference to Nebraska law; clarified that records must retain identifiers; revised to delete list of items to be retained; specified responsibility of faculty advisor for student conduct research; added regulatory requirements as addendum.

 Revised: 6/30/2022 - revised to state that records associated with exempt research only need to be retained for three years; added statement regarding records retention for volunteer faculty (section 4.1.2).

 Revised 12/17/2025 – clarified definition of “subject files’ (section 3.1.2); clarified PI responsibility to maintain record of disclosures of PHI per HIPAA Privacy Rule (section 4.3); stylistic changes.