Umbrella Protocol for Minimal Risk Record Review Research

PURPOSE: This policy establishes the criteria, requirements, and oversight procedures for the submission, approval, and management of umbrella protocols for minimal risk human subjects research involving retrospective and prospective records review. The umbrella protocol framework allows a single overarching protocol to support multiple related sub-studies under one defined structure while ensuring regulatory compliance, consistency, and appropriate oversight. 

To add one or more sub-studies, the umbrella protocol principal investigator (PI) submits a sub-study Modification Request (MR) through the umbrella protocol. If the Institutional Review Board (IRB) finds a sub-study unsuitable for an umbrella protocol, it will be returned to submit as a separate Initial Review (IR).

SCOPE: This policy applies to a department/division seeking to implement an umbrella protocol for minimal risk human subjects research involving records review. An umbrella protocol may be submitted for:

• An entire department/division; or
• A defined research program within a department.

EXCLUSIONS: Umbrella protocols and sub-studies cannot involve:

• Prisoner records, unless incidentally encountered in record review of a diverse population.
• FDA-regulated products – test articles including drugs, biologics, medical devices, or other products such as supplements, software, algorithms intended to treat, cure, mitigate, prevent, diagnose, or affect the structure or function of the body.
• Development of Artificial Intelligence (AI) (e.g., algorithms).
• Intervention of any type.
• Interaction with human subjects to collect research data.
• Student records that are protected under FERPA.
• Sharing data with recipient investigators outside of the umbrella protocol, unless the registry process is defined to the satisfaction of the IRB (e.g., honest broker, collection of "not-human research" letters, data-use agreement). 

A separate IRB application is required for record reviews with any of the above attributes.

EXTRAMURAL OR INTRAMURAL FUNDING:
Assuring a funding agency or sponsor permits an umbrella study design is the responsibility of the umbrella protocol PI, if used to support establishing the protocol, and the sub-study investigators, if funding supports sub-study record review or data extractions.

ARTIFICIAL INTELLIGENCE (AI) INPUT OF PHI/PII: The Center for Clinical and Translational Science (CCTS) and UK Healthcare act as custodians for all healthcare data at the University of Kentucky. Inputting Protected Health Information (PHI) and/or Personally Identifiable Information (PII) data in AI software is solely permitted through the defined CCTS data environment service agreement. CONTACT PENDING 

UMBRELLA PROTOCOL ELIGIBILITY CRITERIA

To qualify as an umbrella protocol, all the following criteria must be met:

Initial Approval:

• One (1) umbrella protocol must be reviewed and approved by the IRB prior to adding any sub-study protocols.
• Sub-studies must be submitted for IRB approval through a sub-study Modification Request (MR).

Risk Level: Research conducted under the umbrella protocol must be minimal risk only. The risks to subjects, from study procedures or the use of private identifiable information, do not exceed the risks that subjects encounter in their daily life or in the conduct of routine physical or psychological examinations.

Study Type: Only retrospective and prospective records review or data extraction studies are permitted. Records may include University of Kentucky medical records, administrative databases, registries, data trusts (i.e., CCTS enterprise services), archives, or other existing data originally collected for other purposes (non-research or different research). Requests for all record sources must be listed in the umbrella protocol. Studies do not involve direct interaction/intervention with individuals to collect research information.

Personnel:

• Umbrella Protocol Principal Investigator (PI): UK faculty or staff who serve as stewards of all data collected, provide oversight of sub-study investigators, and assume responsibility for ensuring all sub-studies operate according to this policy, federal privacy regulations (HIPAA Privacy Rule), and the IRB-approved protocol. The umbrella protocol PI is responsible for submitting accounting and reporting any unanticipated problems via prompt reporting or non-prompt inclusion with the Annual Administrative Review (AAR).
• Sub-Study Investigator: UK faculty, staff, researchers, students/trainees, who submit and sign a Sub-Study Abstract/Agreement. The sub-study investigator should not begin sub-study research until after the IRB approves the sub-study MR. Provide sub-study closure date to the umbrella protocol PI and ensure data are archived consistently with the umbrella protocol (e.g., encrypted if it includes identifiers).

UMBRELLA PROTOCOL REQUIREMENTS

Title Requirement: The protocol application title must clearly identify the submission as “Umbrella Protocol”.

Umbrella Protocol Research Description: The research description for the umbrella protocol must address the following:

• An umbrella protocol Waiver of HIPAA Authorization outlining the steps and protections that will be applied and adhered to by all accepted sub-studies.
• A description of the process to review and evaluate each sub-study as being scientifically valid, within the scope of the umbrella protocol objectives/therapeutic area, and consistent with the HIPAA and Informed Consent waiver justifications.
• A description of how the umbrella protocol PI will manage the Sub-Study Abstract/Agreement to oversee the submission and review of each sub-study.

The Umbrella Protocol Justification for a Waiver of Informed Consent Process: A Waiver of Informed Consent Process must be justified in accordance with minimal risk criteria and the impracticability of conducting the record review if consent were required.

Waiver of HIPAA Authorization: A Waiver of HIPAA Authorization must be requested, including all potential data sources, addressing justifications, safeguards, and operational protections that will apply for all subsequent sub-studies.

Sub-Study Submission and Naming Conventions: All sub-studies must be submitted as a Modification Request (MR) under the approved umbrella protocol. The umbrella protocol must define and follow standardized naming conventions for all sub-studies (e.g., inclusion of a tracking number or unique identifier).

Oversight Management Description (OMD): Each umbrella protocol IRB submission must include an OMD that addresses the following components:

Governance Structural Information:

• Identification of the PI responsible for the umbrella protocol.
• Identification of sub-study leads as sub-investigators.
• Defined roles and responsibilities for oversight, compliance, and reporting.

Data Security and Confidentiality:

• Data storage locations (e.g., behind a firewall and encrypted (e.g., OneDrive).
• Access controls and user permissions.
• Procedures for preventing unauthorized disclosure.
• Data encryption, if applicable.
• Internal Audit and monitoring procedures, if applicable.
• There is no need for the umbrella protocol to include an honest broker like a registry, as all sub-study personnel have direct access to do record reviews and external data sharing is not permitted.

SUB-STUDY REVIEW PROCESS

Sub-Studies Modification Request (MR): For clarity, sub-study MRs must be submitted separately, identified by an umbrella protocol PI-assigned tracking number, and must not include any additional modifications to the umbrella protocol or other sub-studies. The added sub-study must not commence with record review until IRB approval of the sub-study MR is granted.

The umbrella protocol PI is responsible for reviewing each sub-study to ensure scientific validity and parity between the scope and operations outlined in the umbrella protocol. The umbrella protocol PI accepts the sub-study and submits the sub-study MR with the sub-study investigator added as study personnel and the attached Abstract/Agreement to the IRB.

A Sub-study Abstract/Agreement form includes the following:

• Sub-study Abstract: The sub-study abstract details identifying information for the umbrella protocol and sub‑study, the names of the investigator and faculty advisor (if applicable), anticipated dates of data access, the approximate number of records, and the projected research timeline. It must also describe the research question or hypothesis, data elements to be collected, data sources, data storage location, and a description of any planned analysis distinct from the umbrella protocol.
• Sub-study Agreement: The sub‑study agreement confirms that the proposed sub‑study meets the scope, criteria, and minimal‑risk requirements of the approved umbrella protocol and agrees to conduct the sub‑study in accordance with the criteria and regulatory requirements of the approved umbrella protocol.
• Signatures and Attestations: The sub‑study investigator must certify compliance with the umbrella protocol and all applicable IRB and institutional requirements. For student-led sub-studies, the faculty advisor must attest to scientific merit, adequate qualifications and resources, and continued oversight. The umbrella protocol PI provides the following assurance statement:
  
  "This is to certify that I have reviewed this research protocol and that I attest to the scientific merit of this study; to the qualifications of the investigator(s) to conduct the project; that facilities, equipment, and personnel are adequate to conduct the research; and that continued oversight will be provided as appropriate."

IRB REVIEW

The IRB uses Expedited Review for the umbrella protocol and subsequent sub-study MR.  A sub-study MR to the umbrella protocol must be submitted separately as an MR specific to the addition of a sub-study for clarity.

IRB review of a sub-study MR: The IRB reviews the sub-study MR for the following:

• No greater than Minimal risk
• Consistent with the scope of the umbrella protocol
• Commensurate with the terms of the Informed Consent and HIPAA Waiver justifications and protections.

Annual Review and Monitoring: Umbrella protocols are subject to the following IRB review and monitoring requirements:

• Annual Administrative Review (AAR) Form
• Attached log of sub-studies with tracking number, IRB approval date, and, if applicable, study completion date.
• The umbrella protocol PI removes study personnel no longer involved in conducting sub-studies (e.g., graduated students).

Umbrella protocol PIs are responsible for the maintenance of accurate tracking documentation made available for review upon request from the IRB/ORI Quality Improvement.

A Sub-Study Tracking Log that includes:

• Name of umbrella protocol PI & umbrella protocol number
• Sub-study tracking number & sub-study title
• Name of the sub-study investigator
• Sub-study IRB-approved data sources
• Sub-study MR approval date
• Confirm if the sub-study is currently active or not active
• Sub-study closure date if applicable

A Sub-study Abstract/Agreement is required for each added sub-study through a sub-study Modification Request (MR).

UK IRB Record Review Sub-Study Abstract/Agreement

SUB-STUDY ABSTRACT

Umbrella Protocol Title:

Umbrella Protocol IRB Number:

Sub-study Title:

Name of Sub-study Investigator:

Name of Supervising Faculty Advisor, If Student:

Earliest date the data being accessed were created (M/D/Y):

Latest date for which the data accessed will be created (M/D/Y):

Maximum number of records to be reviewed:

Anticipated Research Start Date (M/D/Y):

Anticipated Research End Date (M/D/Y):

Brief Description of the Sub-study Hypothesis/Research Question:

List of Collected Variables, Including Any Identifiers (name, date of birth, MRN, etc.):

List All Potential Data Sources:

Brief Description of Where Data Will Be Stored:

Analysis Plan (limits to the study design, and variation from the umbrella protocol procedures):

Funding (if applicable): 

SUB-STUDY AGREEMENT

By signing below the umbrella protocol PI and sub-study investigator certify that all are true: 

• The sub-study is a secondary collection of data collected for a different primary purpose.
• Data sources, scope of study, security/confidentiality measures, and general operations are consistent with the umbrella protocol.  
• There will be no contact with human subjects for purposes of the study.
• The sub-study will not involve an aspect subject to FDA regulations.
• The sub-study does not have a federal funding source of support.
• The sub-study meets the eligibility criteria and justifications of the umbrella protocol for waiver of informed consent and HIPAA waiver of authorization.
• The sub-study is not primarily focused on a prisoner population.
• The sub-study personnel are added to the umbrella protocol study personnel list and have successfully completed the required Human Subject Protection (HSP) training.
• The sub-study will not begin until the IRB Modification Request (MR) is reviewed and approved by the IRB.
• Artificial Intelligence (AI) is not being developed (e.g., algorithms).
• PHI/PII input into AI software will only occur through the defined CCTS data environment service agreement.
• Data collected under this project will not be shared with an external source.
• The sub-study investigator will promptly inform the umbrella protocol PI of any unanticipated problems, breach of confidentiality, and conclusion of the sub-study for reporting to the IRB. 

SUB-STUDY SIGNATURES

Sub‑Study Investigator: I certify that the information provided above is true, complete, and accurate, and that this sub‑study will be conducted in compliance with the umbrella protocol, confidentiality protections as outlined in the umbrella protocol description or HIPAA waiver of Authorization, and the IRB umbrella protocol policy requirements.

Signature:

Date (M/D/Y):

Faculty Advisor (if applicable): This is to certify that I have reviewed this research protocol and that I attest to the scientific merit of this study; to the qualifications of the investigator(s) to conduct the project; that facilities, equipment, and personnel are adequate to conduct the research; and that continued guidance will be provided as appropriate."

Signature:

Date (M/D/Y):

Umbrella Protocol Principal Investigator: This is to certify that I have reviewed this research protocol and that I attest to the scientific merit of this study; to the qualifications of the investigator(s) to conduct the project; that facilities, equipment, and personnel are adequate to conduct the research; and that continued oversight will be provided as appropriate.

Name (printed):

Signature:

Date (M/D/Y):

A Sub-study Tracking Log should be attached during the annual review of the umbrella protocol.

Sub-study Tracking Log

Umbrella Protocol PI:

Umbrella Protocol Number:

{Include the following information for each Sub-study log. The log should be in table format and include all sub-studies.}

Sub-study Tracking Number & Title:

Sub-study Investigator Name:

IRB-Approved Data Source(s):

Initial Sub-study MR Approval Date:

Currently Active (Y/N):

Sub-study Closure Date:

Example study log in table format:

For protocols approved before the umbrella record review policy was implemented, activities conducted under an IRB-approved protocol prior to the implementation date remain valid as initially approved. However, compliance with the new policy is required for any activities conducted after the implementation date. Investigators should use the Annual Administrative Review (AAR) or a Modification Request (MR) to bring their protocols into alignment with the policy. A Sub-study Abstracts/Agreement and Tracking Log is available for reference to make the transition easier.

New sub-study investigators should be added through a sub-study MR as the need arises. The umbrella protocol PI should attach a Sub-Study Abstract/Agreement for each added sub-study. To streamline the process for adding a sub-study to an approved umbrella protocol, the umbrella protocol PI should limit the modifications to adding sub-study investigators and coordinating the Sub-study Abstract/Agreements.

The umbrella protocol PI can remove inactive sub-study investigators during the umbrella protocol annual review or through a sub-study MR. If a sub-study investigator intends to keep accessing previously collected data or submitting additional sub-studies, they should remain listed as active. The umbrella protocol PI adds a new Sub-study Abstract/Agreement via sub-study modification request and removes closed Sub-study Abstract/Agreements from the umbrella protocol attachments at annual review.

You should select Expedited Review when submitting an umbrella protocol and include “Umbrella Protocol” in the application title. Umbrella protocols and their associated sub‑study Modification Requests (MRs) are reviewed using Expedited Review because they are limited to minimal risk research involving retrospective or prospective records review only and do not include interaction or intervention with human subjects.

If you remain listed as study personnel on the umbrella protocol, you may use the previously collected data. Submit a separate IRB application for the component involving participant interaction and indicate your affiliation with the umbrella protocol from which the data originates. Survey studies with adults typically qualify for Exempt Review; however, most interactions with human subjects will require an Informed Consent Process.