Umbrella Protocol for Minimal Risk Record Review Research

PURPOSE: This guidance provides criteria, requirements, and oversight procedures for the submission, approval, and management of umbrella protocols for minimal risk human subjects research involving retrospective and prospective records review. The umbrella protocol framework allows a single overarching protocol to support multiple related sub-studies under one defined structure while ensuring regulatory compliance, consistency, and appropriate oversight. Approval of this framework is at the discretion of the UK Institutional Review board (IRB) and dependent on ongoing appropriate and adequate oversight by the lead Principal Investigator (PI) given the size, scope, and complexity of the protocol.

The IRB generally uses Expedited Review for the umbrella protocol and subsequent sub-study.

In submitting an umbrella protocol (UP), the principal investigator assumes responsibility for the onduct of subsequent record reviews according to the defined scope of the protocol and protections outlined in the IRB application and HIPAA Waiver of Authorization (WoA). The PI must provide oversight as the data steward relative to access, use, and secure storage.

To add one or more sub-studies, the umbrella protocol principal investigator (PI) submits a sub-study Modification Request (MR) through the umbrella protocol. If the IRB finds a sub-study unsuitable for an umbrella protocol, it will be returned to submit as a separate Initial Review (IR).

How does this guide define sub-study?

What it’s not:

Exploratory record reviews by approved study personnel to discover trends, identify potential research questions, guide and generate a future study hypothesis fare not considered sub-studies and would not require submission as a modification review. However, these preparatory activities must comply with all data security protections and/or WoA provisions.

What it is:

Individual record reviews conducted to answer a defined research question to advance generalizable knowledge (e.g., publication, presentation) are considered sub-studies, even if the objective is consistent with the overarching scope of the Umbrella Protocol.

EXCLUSIONS: Umbrella protocols and sub-studies cannot involve:

• Prisoner records, unless incidentally encountered in record review of a diverse population.
• FDA-regulated products – test articles including drugs, biologics, medical devices, or other products such as supplements, software, algorithms intended to treat, cure, mitigate, prevent, diagnose, or affect the structure or function of the body.
• Intervention of any type.
• Interaction with human subjects to collect research data.
• Student records that are protected under FERPA.
• Sharing data with recipient investigators outside of the umbrella protocol, unless the registry process is defined to the satisfaction of the IRB (e.g., honest broker, collection of "not-human research" letters, data-use agreement, see registry guidance).

A separate IRB application is required for record reviews with any of the above attributes.

EXTRAMURAL OR INTRAMURAL FUNDING:

If funded, the UP PI is responsible for assuring this study design is acceptable by the funding agency or sponsor.

ARTIFICIAL INTELLIGENCE (AI) INPUT OF PHI/PII:

Artificial Intelligence (AI), machine learning, and natural language processing may be used within an umbrella protocol provided that:

1. The umbrella protocol is approved for the sub-study use of AI (e.g., identify variables, summarize records, assisting with coding or abstraction of records).
2. The use is permitted by institutional policies or governing bodies.
3. All sub-study use of AI remains within the scope of minimal risk record review research.
4. No PHI/PII are entered into AI platforms that retain, reuse, train upon, disclose, or otherwise use University data for the platform provider's purposes.

Development of AI, training, testing, or validation of new AI algorithms or models goes beyond a record review objective and requires a separate IRB application.

UMBRELLA PROTOCOL ELIGIBILITY CRITERIA

To qualify as an umbrella protocol, all the following criteria must be met:

Risk Level: Research conducted under the umbrella protocol must be minimal risk. The risks to subjects, from study procedures or the use of private identifiable information, do not exceed the risks that subjects encounter in their daily life or in the conduct of routine physical or psychological exams.

Study Type: Retrospective and prospective records review or data extraction studies are permitted. Studies do not involve direct interaction/intervention with individuals to collect research information.

Record Sources: Compliance with any existing restrictions or requisite institutional policies related to record source use or access.

UMBRELLA PROTOCOL PERSONNEL

Umbrella Protocol Principal Investigator (PI):

• UK faculty or staff who serve as stewards of all data collected, provide oversight of sub-study investigators, and assume responsibility for ensuring all sub-studies operate according to this guidance, federal privacy regulations (HIPAA Privacy Rule), and the IRB-approved protocol.
• The number of sub-studies conducted must not exceed the PI’s capacity to provide oversight. The PI may propose, or the IRB may require a cap on the number of concurrent sub-studies.
• The umbrella protocol PI is responsible for maintaining accounting of sub-study activities and reporting any unanticipated problems via prompt reporting or non-prompt inclusion with the Annual Administrative Review (AAR). Sample logs are provided for tracking.
• If responsibility for the Umbrella Protocol is transferred to a new Principal Investigator, the IRB may require additional review, documentation, training, or other actions as necessary to ensure continued compliance with regulatory and institutional requirements.

Sub-Study Investigator: All study personnel added to the Umbrella Protocol agree to comply with privacy, confidentiality, data security, and data management procedures approved under the umbrella protocol and if applicable, Waiver of Authorization (WoA). The sub-study investigator will not collect, access, use, disclose, retain, or share data in a manner that exceeds the scope or protections described in the umbrella protocol and approved sub-study.

UMBRELLA PROTOCOL INITIAL SUBMISSION REQUIREMENTS

Title Requirement: The protocol application title must clearly identify the submission as “Umbrella Protocol.”

Umbrella Protocol Research Description: The research description for the umbrella protocol must address the following:

• Indicate all data sources such as University of Kentucky medical records, administrative databases, registries, data trusts (i.e., CCTS enterprise services), archives, or other data that has been or will be collected for another initial purposes (non-research or different research).
• Describe how each sub-study will be evaluated as being scientifically valid, within the scope of the umbrella protocol objectives/therapeutic area, and consistent with the HIPAA and Informed Consent waiver justifications.
• Request a Waiver of Informed Consent Process. Address rational for the waiver in accordance with minimal risk criteria and the impracticability of conducting the record reviews if consent were required.
• Waiver of HIPAA Authorization: For access to Protected Health Information (PHI), submit a Waiver of HIPAA Authorization outlining the steps and protections that will be applied and adhered to by all record review sub-studies. Indicate how data limits, protections, and controls will be communicated to or agreed to by sub-investigators (e.g., via a copy of WoA; signed formal agreement). Sample agreements are available if needed. Include all potential data sources, addressing justifications, safeguards, and operational protections that will apply. Submit a revised WoA prior to adding new data sources or data elements.
• Data Security and Confidentiality (reference if sections are detailed in a HIPAA waiver of authorization):
  • Data storage locations (e.g., behind a firewall and encrypted (e.g., OneDrive).
  • Access controls and user permissions.
  • Procedures for preventing unauthorized disclosure.
  • Data encryption, if applicable.
  • Internal Audit and monitoring procedures, if applicable.
  • There is no need for the umbrella protocol to include an honest broker like a registry, as all sub-study personnel have direct access to do record reviews and external data sharing is generally not permitted.

Oversight Management Description (OMD): Each umbrella protocol IRB submission must include an OMD that addresses the following components:

Governance Structural Information:

• Identification of the PI and/or Sub-Investigators responsible for the umbrella protocol, oversight, compliance and reporting. Indicate how study personnel compliance with the approved protocol, HIPAA waiver if applicable, and data protections will be communicated, monitored, and confirmed (e.g., task delegation, formal agreement).
• Other tracking or monitoring procedures or plans.

ANNUAL REVIEW AND MONITORING

Umbrella protocols are subject to the following IRB review and monitoring requirements:

• Annual Administrative Review (AAR) – status report and unanticipated problem summary including the PI’s assessment of whether the problems/adverse events warrant changes to the protocol, consent process, or risk/benefit ratio.
• Updated study personnel list to remove study personnel no longer involved in conducting sub-studies (e.g., graduated students).
• Additional quality improvement reviews as requested by the PI or required by the IRB.

To add a sub-study under an approved umbrella protocol, submit a Modification Request (MR) to the IRB.

The Modification Request should include:

• The title of the sub-study.
• The name of the sub-study Principal Investigator (PI).
• Revisions to the HIPAA Authorization, if applicable, to reflect any additional records that will be accessed, collected, used, or disclosed for the sub-study.
• Revisions to the protocol application that are not already identified and approved under the umbrella protocol (e.g., study personnel, expanded objective, etc.).

SUB-STUDY MODIFICATION REVIEW PROCESS

The umbrella protocol PI is responsible for reviewing each sub-study to ensure scientific validity and parity between the scope and operations outlined in the umbrella protocol. To meet federal regulatory requirements, each sub-study must be submitted for IRB approval through a Modification Request (MR). The added sub-study must not commence with record review until IRB approval of the sub-study MR is granted.

For protocols approved before the umbrella record review policy was implemented, activities conducted under an IRB-approved protocol prior to the implementation date remain valid as initially approved. However, compliance with the new policy is required for any activities conducted after the implementation date. Investigators should use the Annual Administrative Review (AAR) or a Modification Request (MR) to bring their protocols into alignment with the policy.

New sub-study investigators should be added through a sub-study MR as the need arises. Individual record reviews conducted to answer a defined research question to advance generalizable knowledge (e.g., publication, presentation) are considered sub-studies, even if the objective is consistent with the overarching scope of the Umbrella Protocol. To add a sub-study under an approved umbrella protocol, submit a Modification Request (MR) to the IRB.

The Modification Request should include:

• The title of the sub-study
• The name of the sub-study Principal Investigator (PI).
• Revisions to the HIPAA Authorization, if applicable, to reflect any additional records that will be accessed, collected, used, or disclosed for the sub-study.
• Revisions to the protocol application that are not already identified and approved under the umbrella protocol (e.g., study personnel, expanded objective, etc.)

The umbrella protocol PI can remove inactive sub-study investigators during the umbrella protocol annual review or through a sub-study MR. If a sub-study investigator intends to keep accessing previously collected data or submitting additional sub-studies, they should remain listed as active.

You should select Expedited Review when submitting an umbrella protocol and include “Umbrella Protocol” in the application title. Umbrella protocols and their associated sub‑study Modification Requests (MRs) are reviewed using Expedited Review because they are limited to minimal risk research involving retrospective or prospective records review only and do not include interaction or intervention with human subjects.

If you remain listed as study personnel on the umbrella protocol, you may use the previously collected data. Submit a separate IRB application for the component involving participant interaction and indicate your affiliation with the umbrella protocol from which the data originates. Survey studies with adults typically qualify for Exempt Review; however, most interactions with human subjects will require an Informed Consent Process.