IRB & HIPAA

Institutional Review Board (IRB) and Health Insurance Portability & Accountability Act (HIPAA)

In order to gain access to the Clinical Data Warehouse, you need (1) appropriate IRB approval, and (2) approval from the DISCOVERY review committee (see DISCOVERY Process for details)

A key determinant of what type of approvals you need is whether your research question requires data with identifiable information about the patients. To determine your data needs, we recommend you do the following before proceeding to (2) submitting request for approval through the DISCOVERY process:

  • Explore possible variables to include, using tools including RedX, the Top 50 variables list (see Toolkit), and I2B2;
  • Identify the level of patient information you need for your research; If the researcher is requesting de-identified information, the DISCOVERY form can be submitted without further applications for approval from HIPAA. If Limited or Identifiable information is needed, however, then you must fill out a HIPAA B Form.
  • Consider partnering with a clinician to navigate hospital data records.

Important Note: If identifiable information is needed, an IRB protocol must be submitted and approved prior to submitting a DISCOVERY form (see DISCOVERY Process). Approval may take months depending on the nature of the research question. Moreover, while retrieval of de-identified information via DISCOVERY may not require an IRB approval, publication of such data may still require IRB approval, albeit in an expedited fashion.

Please refer to the Columbia University Medical Center HIPAA Policies website for more information on filling out the forms. You may find the policies and forms here.

HIPAA forms may be accessed by logging in to your Rascal account here, after clicking "HIPAA Forms" on the left-hand navigation menu. Once the HIPAA forms and IRB approval have been received, you may proceed with the DISCOVERY form submission.

  • Find Columbia Doctors