Once your study is concluded, you will need to maintain your data and research material for a required record retention period. Different regulations apply to how long you are required to store records after the completion of research, and you must keep records for the longest applicable period of time. You should contact the University Records & Information Management Office to confirm current legal requirements for retention periods and to solicit their approval prior to destruction of study records.
Research Record Retention Periods
Federal regulations require research records to be retained for at least 3 years after the completion of the research (45 CFR 46) and UVA regulations require that data are kept for at least 5 years. Additional standards from your discipline may also be applicable to your data storage plan. Research that involves identifiable health information is subject to HIPAA regulations, which require records to be retained for at least 6 years after a participant has signed an authorization. Finally, research sponsors may require longer retention periods. If your study was funded by a research sponsor, please check the contract between UVA and the funding sponsor for details regarding record retention periods, as the contract may state a longer retention period. Another good practice is to retain data until there is no reasonable possibility that you will be required to defend against an allegation of scientific misconduct. In sum, you must keep your research records for at least 5 years and possibly longer, depending on the longest applicable standard.
Who is Responsible for Maintaining IRB Records of the Study?
The study team is responsible for maintaining records for all IRB approved study documents (i.e., protocol versions, consents, etc.), correspondence interactions and documentation of approvals (IRB assurance forms) with the study files. The IRB-SBS is also responsible for keeping good records about our practices as described in the federal regulations (45 CFR 46.115). Our office maintains a digital file for each protocol including a copy of every protocol version submitted to our office (and all accompanying documents), correspondence between our office and the researcher, and any other documents relating to the continuing review of that protocol. The IRB file is retained for at least three years after a study is closed. The study team may contact the IRB office to request a duplicate copy of a missing IRB record if needed during this the IRB's record retentions period. We also maintain records of our meeting minutes, IRB members, and standard operating procedures so that should our office be audited, we would be able to demonstrate that we are conducting ourselves according to the federal regulations.
Likewise, any researcher who is conducting a study with an IRB approved protocol is required to maintain adequate records that correspond to what was described in the protocol. iProtocol helps with this effort as we retain all protocol versions, approval certificates, and all versions of any uploaded document including consent forms, instruments, etc. To see your protocol's history, you can select the "Protocol History" link below each approved protocol. For more information, see Protocol History. When you close your study, you should make a copy of all the data in iProtocol History to maintain with your study files for the required retention period.
Beyond what iProtocol retains, you will need to keep a record of the documents you use as well as the data you collect during your study. If your study includes a documenting consent, you will need to retain individualized records of the documentation. For example, if you are conducting interviews, the participant will sign a consent form prior to the interview. You should have a signed consent form for every corresponding interview. You are also required to keep your files for the applicable record retention period after you close your study. You should contact the University Records & Information Management Office to solicit their approval prior to destruction of study records.
Study Data from Research Records in Relation to Participant Privacy Protections
Regardless of whether you study is ever audited, maintaining organized files will help you to protect participants. Often for IRB-SBS studies, loss of confidentiality is the greatest risk to participants and poor organization and data management can be an easy way for loss of confidentiality to occur.
Notice that these regulations do not specify when you must destroy data, only state the minimum amount of time you must retain it. As long as you can guarantee that your research records are secure, you can keep them indefinitely. Of course, practical considerations of storage space may make this impossible. Moreover, some participants may object to retention of their study records for an indefinite amount of time. Ideally, you should define your retention policy in your consent form, so that your participants can agree to it.
Sometimes researchers wish to reuse data for subsequent studies. If you anticipate this situation, you should state in your consent form that data may be retained for use in future studies. In this case, you should destroy any identifying information and linking files once you have kept them for the longest applicable standard. Especially if participants are unable to give consent to additional uses of their data, all records should be de-identified before use. Careful data storage for subsequent use prevents researchers from collecting the same data over and over again, protecting participants from inefficient research practices and exposing them to less risk. For more information about data management, please see UVA Library's website on data management.
Destruction of Research Records
When research records are to be destroyed instead of stored securely, you should remember to protect your participants’ confidentiality throughout the process. Paper records should be shredded and recycled, instead of carelessly tossed in the garbage. Records stored on a computer hard drive should then be erased using commercial software applications designed to remove all data from the storage device. UVA Information Security for more information on erasing electronic records. For data stored on USB drives or recorded data on tapes, CDs, or DVDs, the storage devices should be physically destroyed. Please seek approval from UVA's Records & Information Management Office before you destroy the study records. You should keep documentation stating what study records were destroyed, and when and how the records were destroyed.