Does a project using only medical records require IRB approval?
Yes. The use of medical records or clinical databases (paper, electronic, or any form) for research purposes requires IRB review. This is in accordance with the federal regulations for the protection of human research subjects, Ohio State law pertaining to healthcare records, and the federal privacy rules, known as HIPAA Privacy Rules. Generally, if you will be gathering information from sources that already exist (retrospective review) and need to collect identifiers such as patient name and medical record number so that the data can be linked to individuals, your project qualifies for expedited review.
