• MSU Privacy Board
• MSU Privacy Board Membership
• Research that Requires MSU Privacy Board Review
• MSU Privacy Board Review Processes
• Review Process Flow Chart
• MSU Privacy Board Frequently Asked Questions
• Authorization Forms

MSU Privacy Board

The MSU Research Privacy Board was created to meet the requirements of the HIPAA Privacy Rule that became effective April 14, 2003. This Board reviews research projects that come under the HIPAA regulations and are submitted to any of the MSU Institutional Review Boards (BIRB, CRIRB or SIRB).

MSU Privacy Board Membership

The privacy board membership includes individuals with varying backgrounds necessary to review the effect of the research on an individual's privacy. At least one member must have a background / competency in biomedical research, at least one member must have a background / competency in statistics and/or epidemiology, at least one member must be knowledgeable of privacy regulations, and at least one member must be unaffiliated with MSU, IRB reliant institutions of MSU, or sponsors of MSU research. The Privacy Board members may be members of any of the MSU IRBs, employees or students of MSU, employees of IRB reliant institutions, or unaffiliated individuals. The MSU Vice President for Research and Graduate Studies appoints the chair and members for terms up to 3 years, renewable at the discretion of the Vice President.

Research Privacy Board Members

Below is a list of the Research Privacy Board members, their representation on the committee, and each member’s specialty.        

Top of page

Research that Requires MSU Privacy Board Review

The Privacy Board reviews all research projects submitted to any MSU IRB that require the use of medical records or any other "protected health information" as defined by the HIPAA Privacy Rule.

The IRB initial application form asks investigators to self-identify whether or not their project involves this type of information and whether they are requesting a waiver of authorization.

The IRB staff screens all applications (preliminary and initial approval, renewal and revisions of currently active projects) in order to identify the projects that involve protected health information.

MSU Privacy Board Review Processes

Once the project is identified as requiring review by the Research Privacy Board, the IRB staff assigns it to the chair of the Board (or a designated reviewer). At the same time, the IRB staff also assigns the project to reviewers following the appropriate IRB category of review, e.g., exempt, expedited or full. Note: an individual reviewer may serve both types of review on a project, i.e. IRB and Research Privacy Board reviews.

Approval of a project that requires Privacy Board review in addition to IRB review must be approved by both the IRB and the Privacy Board. The IRB chair sends an approval letter to the investigator that documents the conditions of both approvals except for waivers of authorization. The Research Privacy Board sends a separate approval letter for an approved waiver of authorization.

Top of page

Expedited Privacy Board Review Process:
The expedited process requires review by the chair or one Privacy Board member designated by the chair. The designated member should be knowledgeable in the regulatory aspects of privacy regulations, statistics and/or epidemiology. The expedited process does not require a meeting of the convened Privacy Board for approval. The Expedited Privacy Board review can occur simultaneous with the regular IRB review. Note: the project may be reviewed under an expedited process by the Privacy Board and be reviewed under exempt, expedited or a full review process by the IRB. The criteria for determining the category of Privacy Board and IRB reviews are not the same.

The Privacy Board chair (or designated reviewer) determines whether the project meets the criteria for Expedited Privacy Board Review. If so, the reviewer can provide comments to the investigator asking for clarification or corrections, and/or approve the project. If the reviewer determines that the expedited category of review is not appropriate or if approval is denied, he/she bumps up the project for review by the convened Privacy Board (Normal Privacy Board Review). The investigator responds to Privacy Board reviewer comments in the same manner as she/he responds to regular IRB reviewer comments.

Criteria for Expedited MSU Privacy Board Review:
If the research project requires access to and use of medical records (or any such "protected health information") and meets any of the following criteria the project can be reviewed through an expedited Privacy Board review by the chair or designated Privacy Board member:

1. An authorization to use or disclose protected health information is submitted, or
2. All research subjects are deceased, or
3. Protected health information is "de-identified" as certified by the covered entity, or
4. Protected health information is in a "limited data set" and a "data use agreement" with the covered entity is submitted, or
5. A waiver of informed consent for the research was obtained prior to April 14, 2003, or
6. Researchers, who are also the health care providers of the subjects, need to use medical records solely to prepare a research project or to recruit subjects prior to having subjects sign an authorization form, and the records will not be removed from the "covered entity", or
7. A waiver of authorization is requested to use existing medical records.

Normal Privacy Board Review Process:
The normal review process requires a convened meeting of a quorum of the entire Privacy Board that includes at least one member who is unaffiliated with the research (covered entity, researcher, sponsor of the research, nor related to anyone who is affiliated with same). At the meeting the project is reviewed and a vote taken; approval requires a vote by a majority of those members present at the convened meeting. The board can vote to approve, conditionally approve or deny approval. Currently the Privacy Board schedules a meeting as needed, i.e., when a project is submitted that requires full review. There are no regularly scheduled meetings.

Conditional approval must specify the conditions that must be fulfilled before the approval becomes effective, e.g., changes to authorization forms, and steps to protect identifiers, written assurances for reuse or disclosure.

Minutes of the specially scheduled meetings for normal review by the MSU Research Privacy Board are documented and maintained by the IRB staff.

Top of page