- During a clinical trial, a participant experiences an unexpected adverse event that may be related to the study intervention. The participant requests that information about this event not be reported to regulatory authorities. How should the research team respond?
Answer: Explain that adverse event reporting is required for participant safety and cannot be omitted based on participant preference
When you encounter questions about adverse event reporting in clinical trials, remember that participant safety and regulatory compliance create non-negotiable obligations that override individual preferences.
Adverse event reporting serves a critical public health function by allowing regulatory agencies to identify safety signals, update product labeling, and protect future patients. These reporting requirements are legally mandated and built into the research protocol that participants agree to when enrolling. The research team has both ethical and legal obligations to report all adverse events according to predetermined timelines, regardless of participant wishes.
Option A misunderstands the scope of participant autonomy. While participants control many aspects of their health information, adverse event reporting falls under mandatory safety surveillance that transcends individual privacy preferences. Option C might seem like a compromise, but regulatory reporting requires specific participant information for proper safety evaluation and follow-up. De-identified reports often cannot fulfill these requirements and may still violate reporting protocols. Option D suggests unnecessary delay in a situation with clear regulatory requirements. IRBs establish frameworks for adverse event reporting during protocol approval, but they don't make case-by-case determinations that could delay critical safety reporting.
The correct approach (B) involves educating the participant about why reporting is mandatory while being empathetic to their concerns. The team should explain how adverse event data protects future patients and that reporting requirements were part of the original informed consent.
Remember: In clinical research, participant safety obligations and regulatory compliance requirements cannot be waived by participant request—these represent non-negotiable aspects of ethical research conduct.
- A research team receives a data breach notification that an encrypted laptop containing a dataset with direct identifiers was stolen from a researcher's car. The dataset includes 2,847 participants from a diabetes prevention study. The encryption meets current NIST standards, but the password was stored in the same laptop bag. The IRB and data safety monitoring board must be notified within specific timeframes. What is the most critical immediate concern regarding regulatory compliance?
Answer: Assessing whether this constitutes a HIPAA breach requiring notification to HHS within 60 days and potentially to participants within 60 days if risk assessment indicates likely compromise.
Option B correctly identifies the HIPAA breach notification requirements, which are the most immediate regulatory concern. Since the password was compromised along with the encrypted device, this likely constitutes a breach requiring assessment and potential notification to HHS within 60 days and to individuals within 60 days if the risk assessment indicates likely compromise. Option A incorrectly cites Common Rule provisions - the Common Rule doesn't have specific breach notification requirements like HIPAA. Option C is wrong because the compromised password means the encryption may not provide adequate protection. Option D is overly reactive and not a regulatory requirement for this type of breach.
- A community-based participatory research study involves collecting health data from a marginalized population. The community advisory board requests that individual participant data not be shared outside the community, even in de-identified form. This request primarily reflects concerns about:
Answer: Cultural values and community autonomy over research involving their members
When you encounter questions about community-based participatory research (CBPR), focus on the core principle that communities are equal partners with decision-making authority over research affecting their members. CBPR emphasizes community ownership, self-determination, and respect for cultural values.
The community advisory board's request to retain control over their data, even when de-identified, reflects their exercise of community autonomy and cultural sovereignty. Many marginalized communities have experienced historical exploitation through research, leading to strong preferences for maintaining control over how their information is used. This reflects deeply held cultural values about collective ownership of community knowledge and the right to determine how their population is represented in research.
Option A is incorrect because legal liability concerns would typically focus on data breaches or privacy violations, not blanket restrictions on sharing de-identified data. Option C misses the mark—while small population de-identification can be technically challenging, the community's concern isn't about inadequate procedures but about maintaining control regardless of technical safeguards. Option D incorrectly suggests this stems from regulatory requirements, when it actually represents the community's autonomous decision-making.
Remember that CBPR questions often test whether you understand the shift from traditional "research on communities" to "research with communities." The key distinction is that communities aren't just study subjects—they're partners with legitimate authority over research decisions. When you see scenarios involving community advisory boards or indigenous/marginalized populations asserting control over research processes, think community autonomy and cultural self-determination first.
- Under HIPAA regulations, which of the following would still be considered personal health information (PHI) even after standard de-identification procedures?
Answer: Health survey responses with names removed but including exact birth dates and 5-digit ZIP codes
When approaching HIPAA de-identification questions, you need to understand that removing the 18 standard identifiers doesn't automatically make data non-identifiable if other information could still reasonably identify individuals.
Option C is correct because it contains a dangerous combination of quasi-identifiers that could easily re-identify individuals. Exact birth dates are extremely specific (there are only 365 possible dates per year), and 5-digit ZIP codes narrow down geographic location to small areas. Together, these create a high probability of uniquely identifying individuals, especially in smaller communities. This violates HIPAA's safe harbor method, which requires birth dates to be generalized to year only and ZIP codes to show only the first three digits (and only if the area contains 20,000+ people).
Option A follows proper de-identification by using age groups instead of exact ages, and ZIP codes are limited to areas with sufficient population size to prevent identification. Option B represents a gray area in current regulations - while genetic data is sensitive, the 18 standard HIPAA identifiers have been removed, and genetic sequences alone don't directly identify individuals without additional linking information. Option D employs proper techniques: random study numbers replace identifiable patient IDs, and date-shifting maintains temporal relationships while preventing identification through specific dates.
Remember this pattern: HIPAA violations often involve combinations of quasi-identifiers that seem harmless individually but become identifying when combined. Always look for specific dates, detailed geographic information, and unique characteristics that could distinguish individuals within small populations.
- A research team wants to analyze social media posts to study mental health trends during the COVID-19 pandemic. They plan to collect public posts containing specific mental health keywords from Twitter, Instagram, and Facebook. The posts will be analyzed using natural language processing to identify sentiment patterns and potential risk factors. The team argues that since the posts are publicly available, no IRB approval is needed. However, they plan to create detailed demographic profiles by linking posts to users' public profile information and will retain data for 5 years. Which factor most strongly suggests IRB review is required?
Answer: The linkage of posts to demographic profile information creates identifiable datasets that constitute human subjects research requiring IRB oversight regardless of public availability.
When evaluating whether social media research requires IRB review, the key question is whether the study constitutes "human subjects research" under federal regulations. This determination hinges on whether investigators can identify specific individuals from the data, not simply whether the original posts were public.
Answer D correctly identifies the critical factor: linking posts to demographic profile information creates identifiable datasets. Even though social media posts are publicly available, systematically connecting them to users' profiles transforms anonymous content into identifiable human subjects data. Under 45 CFR 46, research involving identifiable individuals requires IRB oversight, regardless of whether the source material was originally public. The ability to identify specific people makes this human subjects research.
Option A is actually true but represents a general principle rather than the most specific factor in this scenario. While public availability doesn't exempt research from review, this doesn't pinpoint why this particular study needs IRB approval.
Option B incorrectly focuses on consent and retention periods. The issue isn't about exceeding implied consent or data storage duration—it's about the identifiable nature of the linked dataset.
Option C addresses important ethical considerations about vulnerable populations and stigmatization, but these are secondary concerns. Mental health topics don't automatically trigger IRB requirements; the identifiability of subjects does.
Remember this key principle: IRB review requirements depend on whether you can identify research participants, not whether their data was originally public. Always ask yourself: "Can specific individuals be identified from this dataset?" If yes, you likely need IRB approval.
- A hospital-based research team wants to use electronic health record (EHR) data for a retrospective outcomes study without patient consent, claiming the research qualifies for a HIPAA waiver. The study will analyze treatment patterns and outcomes for 10,000 patients over 5 years. The research team plans to include detailed clinical notes in their analysis and will collaborate with researchers at three other institutions. They argue that obtaining consent from 10,000 patients would be 'impracticable' and that the research has important public health value. Which criterion for HIPAA waiver approval is most likely to be problematic?
Answer: The inclusion of detailed clinical notes likely contains more information than necessary for the research purpose, violating the minimum necessary requirement for HIPAA waiver approval.
HIPAA waiver approval requires meeting several specific criteria, with the "minimum necessary" standard being one of the most strictly enforced. This principle requires that researchers only access and use the minimum amount of protected health information necessary to accomplish their research objectives.
Answer D correctly identifies the core problem: detailed clinical notes typically contain extensive narrative information about patients' conditions, treatments, social circumstances, and other sensitive details that likely exceed what's needed for analyzing treatment patterns and outcomes. For a study focused on treatment patterns and outcomes, researchers would typically need structured data elements (diagnoses, medications, procedures, lab values) rather than full clinical narratives. The inclusion of detailed notes suggests the research team hasn't carefully considered what data is actually necessary, violating this fundamental HIPAA requirement.
Looking at the incorrect options: Answer A misunderstands the impracticability standard - difficulty contacting 10,000 patients over a 5-year period can indeed meet this threshold when properly documented. Answer B incorrectly assumes that deceased patients create complications for waiver approval; in fact, data from deceased patients can often be included more easily in waiver requests. Answer C overstates the significance of multi-institutional collaboration - while data use agreements are required, this doesn't typically prevent waiver approval when properly managed.
When evaluating HIPAA waiver scenarios, always scrutinize whether the requested data elements align with the stated research aims. The "minimum necessary" requirement is often the most challenging criterion to satisfy and frequently causes waiver applications to be rejected or require modification.
- A research study involves analyzing existing medical records from a hospital system. The hospital's legal team indicates that a Business Associate Agreement (BAA) is required before data can be shared. This requirement suggests that:
Answer: The data contains protected health information covered under HIPAA regulations
When you encounter questions about Business Associate Agreements (BAAs) in biostatistics research, you're dealing with HIPAA compliance and data protection requirements. A BAA is a specific legal document required under HIPAA regulations whenever protected health information (PHI) will be shared with or accessed by external parties who aren't directly covered by HIPAA.
The correct answer is A because BAAs are exclusively required when PHI covered under HIPAA regulations is involved. Since the hospital's legal team is mandating a BAA before sharing medical records, this definitively indicates that the data contains identifiable health information that falls under HIPAA protection. Medical records from hospital systems typically contain patient identifiers, diagnoses, treatments, and other PHI that triggers HIPAA requirements.
Option B is incorrect because BAAs aren't about commercial activities—they're specifically about PHI protection, regardless of whether research is commercial or academic. Option C misunderstands the purpose of BAAs, which aren't about data ownership rights but about ensuring proper handling and protection of PHI by third parties. Option D is wrong because BAA requirements aren't determined by whether researchers are academic or business entities—even academic researchers need BAAs when accessing PHI.
Remember this key principle: whenever you see "Business Associate Agreement" mentioned in research scenarios, it's always signaling HIPAA compliance issues with protected health information. BAAs serve one primary purpose—ensuring that external parties who access PHI will handle it according to HIPAA standards.
- A research consortium plans to create a shared database combining de-identified datasets from five different institutions studying cardiovascular outcomes. Each institution collected data under different consent frameworks: Institution A obtained consent for 'cardiovascular research only,' Institution B for 'any health-related research,' Institution C for 'research as approved by IRB,' Institution D for 'broad biomedical research,' and Institution E for 'this study only.' The consortium wants to use advanced machine learning techniques that might identify novel disease associations beyond cardiovascular outcomes. Which institutions' data can be appropriately included without additional consent?
Answer: Only Institutions B and D, since their consent language encompasses research beyond the original cardiovascular focus and supports the novel disease association analyses.
Option A correctly identifies that only Institutions B ('any health-related research') and D ('broad biomedical research') have consent language broad enough to cover machine learning analyses that might identify novel disease associations beyond cardiovascular outcomes. Institution A's 'cardiovascular research only' consent is too narrow for broader disease association studies. Institution C's 'research as approved by IRB' is ambiguous and would require careful IRB review. Institution E clearly limited consent to the original study. Option B incorrectly assumes machine learning for novel associations falls within cardiovascular research scope. Option C wrongly includes Institution C without IRB clarification. Option D incorrectly assumes de-identification eliminates consent requirements - consent scope still matters even with de-identified data.
- A clinical trial investigating a new hypertension medication requires participants to provide informed consent. During the consent process, a potential participant asks whether they can withdraw from the study at any time without penalty. The study coordinator should inform them that:
Answer: Participants may withdraw at any time without penalty, and withdrawal will not affect their medical care
When you encounter questions about informed consent and participant rights in clinical trials, focus on the fundamental ethical principles that protect research participants. The cornerstone principle is that participation must always remain voluntary throughout the entire study period.
The correct answer is C because participants have an absolute right to withdraw from any research study at any time, for any reason, without facing penalties or consequences to their ongoing medical care. This principle is enshrined in research ethics guidelines worldwide, including the Declaration of Helsinki and Good Clinical Practice standards. The withdrawal right exists to protect participant autonomy and prevent coercion.
Answer A is incorrect because withdrawal rights don't expire once treatment begins - participants retain full autonomy throughout the study regardless of what procedures they've undergone. Answer B represents a form of coercion through financial penalty, which violates ethical research principles. Even if compensation was provided for completed visits, withholding it for withdrawal would create undue pressure to continue participation. Answer D is wrong because requiring investigator approval creates a barrier to withdrawal that could prevent participants from exercising their rights, potentially trapping them in research they no longer wish to continue.
Remember this key principle for biostatistics and research ethics questions: participant rights are absolute and non-negotiable. Any answer choice that places conditions, penalties, or barriers on withdrawal rights will be incorrect. The right to withdraw exists precisely to ensure that research remains voluntary from start to finish.
- A biostatistician receives a subpoena requesting individual-level research data from a completed clinical trial investigating opioid addiction treatment. The study was conducted under an NIH Certificate of Confidentiality, and the consent form stated that 'your information will be kept confidential to the extent permitted by law.' The subpoena is part of litigation against a pharmaceutical company and specifically requests data that could identify participants who experienced adverse events. How should the biostatistician respond?
Answer: Consult with institutional legal counsel to invoke Certificate of Confidentiality protections while noting that researchers may voluntarily disclose if they determine it serves participant interests.
Option C correctly recognizes that Certificates of Confidentiality provide strong but not absolute protection, and that legal counsel should be involved in responding to subpoenas. The Certificate allows researchers to resist disclosure but also permits voluntary disclosure if the researcher determines it serves participant interests. This is a complex legal situation requiring expert guidance. Option A incorrectly assumes the consent language overrides Certificate protections. Option B wrongly states that Certificate protection is absolute - it's not. Option D misunderstands Certificate protections, which apply to individual-level data regardless of whether it's technically de-identified, and aggregate data disclosure still requires careful consideration.
- A researcher conducting a survey study wants to collect sensitive information about participants' mental health history. To encourage honest responses, they propose using a data collection method where responses cannot be linked back to individual participants, even by the research team. This approach is an example of:
Answer: Anonymous data collection, which still requires informed consent but offers stronger privacy protection
When you encounter questions about data collection methods in research, focus on the key distinction between anonymous and confidential data collection, and remember that informed consent requirements remain constant regardless of the privacy protection level.
Anonymous data collection means that responses truly cannot be linked back to individual participants by anyone, including the researchers themselves. This occurs when no identifying information is collected or when any identifying information is permanently separated from responses before analysis. This method provides the strongest possible privacy protection, making participants more likely to provide honest responses about sensitive topics like mental health history.
Crucially, anonymous data collection does not eliminate the need for informed consent. Participants must still understand what they're agreeing to participate in, what risks they face, and what will happen to their information, even if that information cannot be traced back to them.
Option A incorrectly suggests that anonymity eliminates informed consent requirements, which is a dangerous misconception. Option B describes confidential rather than anonymous collection—confidentiality means researchers could potentially link responses to individuals but promise not to. Option D refers to HIPAA de-identification standards, which apply specifically to protected health information in healthcare settings, not general research survey data.
The correct answer is C because it accurately identifies this as anonymous data collection while correctly noting that informed consent is still required despite the enhanced privacy protection.
Remember: Anonymous data collection offers maximum privacy protection but never eliminates the fundamental ethical requirement for informed consent in research.
- A biostatistician working with international collaborators on a cancer genomics study discovers that the European partner institution's ethics committee has different requirements for genetic data sharing than the U.S. IRB. The European committee requires explicit consent for each specific analysis, while the U.S. IRB approved broad consent for future genomics research. The study involves 500 participants from each site, and the analysis plan requires combining datasets. Additionally, some U.S. participants are European citizens living temporarily in the U.S. How should this regulatory conflict be addressed?
Answer: Apply jurisdiction-specific requirements to each participant group, but seek specific consent for European citizens regardless of their current location due to GDPR extraterritorial provisions.
Option C correctly recognizes that different regulatory frameworks apply to different participant populations, and that GDPR has extraterritorial reach for EU citizens. European participants (both those in Europe and EU citizens in the U.S.) would be subject to GDPR requirements, while U.S. participants follow U.S. regulatory frameworks. This approach respects the legal requirements applicable to each participant group. Option A overly applies European law beyond its jurisdiction. Option B ignores applicable European regulations for European participants. Option D is unnecessarily restrictive and doesn't address the underlying regulatory compliance issues.
- A biostatistician is analyzing data from a study that was originally approved for examining cardiovascular outcomes. The data shows interesting patterns related to mental health that could lead to important findings. To analyze these mental health patterns, the biostatistician should:
Answer: Submit a protocol amendment or new application to the IRB before conducting mental health analyses
When you encounter questions about secondary data analysis in biostatistics, you're dealing with research ethics and regulatory compliance. The key principle is that research studies must stay within the scope of what was originally approved by the Institutional Review Board (IRB).
The correct approach is to submit a protocol amendment or new application to the IRB before conducting mental health analyses (C). Even though the data already exists, analyzing it for mental health outcomes represents a significant departure from the original study purpose. The IRB needs to evaluate whether participants consented to mental health research, whether additional privacy protections are needed, and whether the new analysis creates any unforeseen risks or ethical concerns.
Option A is wrong because using the same dataset doesn't automatically authorize new research questions. IRB approval is tied to specific research aims, not just data ownership. Option B misses the point entirely—the issue isn't about publication strategy but about getting proper authorization before conducting any analysis outside the original scope. Option D, while methodologically important, puts the cart before the horse. You need regulatory approval before investing time in methodological planning.
This reflects a fundamental principle: participant consent and IRB approval are tied to specific research questions, not just data collection. Even seemingly harmless secondary analyses require proper oversight.
Study tip: Remember that in research ethics questions, always think "approval first, analysis second." Any substantial change in research direction—new outcomes, different populations, or novel hypotheses—typically requires returning to the IRB, regardless of data availability.
- A study coordinator discovers that participant contact information (names and phone numbers) was accidentally included in a data file sent to the study biostatistician. The biostatistician has confirmed receipt but has not yet opened the file. What is the most appropriate immediate response?
Answer: Have the biostatistician return or delete the file and send a corrected version without contact information
When you encounter data protection scenarios in biostatistics, think systematically about minimizing exposure and following proper protocols. The key principle is that personal identifiers should never reach unauthorized recipients, and when they do, immediate containment is essential.
Option B is correct because it follows the principle of immediate containment with minimal exposure. Since the biostatistician hasn't opened the file yet, having them return or delete it completely eliminates any potential viewing of protected information. Sending a corrected version without contact information ensures the analysis can proceed properly while maintaining data protection standards.
Option A is problematic because it requires the biostatistician to open the file and actively view the protected information to identify and delete the contact columns. This increases exposure and violates the principle of minimal access to protected data.
Option C represents a dangerous misconception about data breaches. The mere transmission of protected information to an unauthorized recipient constitutes a breach, regardless of whether it was actually viewed. Intent and actual viewing are not required elements of a data protection violation.
Option D jumps too quickly to formal breach reporting. While documentation may eventually be needed, the immediate priority should be containment. Many institutions have protocols requiring you to first attempt to limit exposure before escalating to formal breach procedures, especially when the information hasn't been accessed yet.
Remember: in data protection scenarios, always prioritize immediate containment over documentation. Your first response should minimize who has access to protected information, not who knows about the incident.
- A biostatistician is asked to analyze healthcare utilization patterns using insurance claims data. The data contains encrypted member IDs, but the insurance company retains the encryption key. From a privacy perspective, this data should be considered:
Answer: Identifiable because a mechanism exists to link the data back to specific individuals
When analyzing healthcare data privacy, you need to understand the distinction between truly anonymous data and data that can still be linked back to individuals, regardless of who has access to the linking mechanism.
The key principle here is that data is considered identifiable if any realistic mechanism exists to connect it back to specific individuals, even if the researcher doesn't directly control that mechanism. In this scenario, the insurance company retains the encryption key, meaning the encrypted member IDs can still be decoded to reveal actual identities. This creates a clear pathway from the research data back to real people.
Option C correctly recognizes that identifiability depends on the existence of linking mechanisms, not on who controls them. Since the encryption key exists and could theoretically be used to re-identify individuals, the data remains identifiable from a privacy perspective.
Option A incorrectly focuses on the biostatistician's direct ability to identify individuals. True anonymization requires that no one can reasonably link the data back to individuals, not just the immediate researcher.
Option B misapplies HIPAA safe harbor provisions, which require complete removal of specific identifiers, not just encryption. Encrypted data that can be decrypted doesn't meet safe harbor standards.
Option D creates a false distinction between "confidential" and "identifiable." The biostatistician's lack of direct access to the key doesn't change the fundamental identifiable nature of the dataset.
Remember: In privacy assessments, always consider whether re-identification is theoretically possible by any party, not just whether the immediate researcher can identify individuals.
- A study protocol calls for collecting blood samples from participants for immediate analysis, with no samples to be stored for future research. During the consent process, several participants ask whether their biological samples might be used for other research purposes. The most appropriate response is:
Answer: Samples will only be used for the current study as described in the protocol and consent form
When you encounter questions about informed consent and biological samples, focus on the fundamental principle that research participants must know exactly how their samples will be used, and researchers can only use samples as explicitly described in the consent process.
Answer A is correct because it directly addresses what was described in the study protocol and what participants consented to. Since the protocol specifically states that samples are for immediate analysis with no storage for future research, the most ethical and legally appropriate response is to confirm that samples will only be used as originally described. This maintains the integrity of the informed consent process and respects participants' autonomy.
Answer B is problematic because it suggests expanding beyond the current protocol by offering additional consent options that weren't part of the original study design. While future consent is theoretically possible, this response doesn't directly address the current study's limitations.
Answer C inappropriately shifts responsibility to institutional policies rather than acknowledging the specific constraints of this study's protocol and consent process. Participants deserve a clear answer about this particular study, not a vague reference to general institutional governance.
Answer D, while factually correct about sample destruction, misses the point by suggesting participants shouldn't be concerned. This dismisses legitimate participant questions and fails to affirm the ethical commitment to use samples only as consented.
Remember: In biostatistics and research ethics questions, always prioritize what was actually consented to in the specific study protocol. The consent process creates a binding agreement that cannot be expanded without additional explicit consent.
- A researcher wants to analyze social media posts about mental health experiences to identify common themes and patterns. The posts are publicly available but contain usernames and profile information. Which privacy consideration is most critical for this research?
Answer: Usernames should be replaced with study codes even though the posts are publicly available
When you encounter research ethics questions involving publicly available data, remember that public accessibility doesn't automatically eliminate privacy obligations. The key principle is that researchers must still protect participant identities and minimize potential harm, even when data is already public.
The correct approach here is to replace usernames with study codes (C). Even though social media posts are publicly available, directly using usernames in research creates unnecessary risks. It makes it easier to trace findings back to specific individuals, potentially exposing them to stigma or discrimination related to their mental health disclosures. De-identification through coding protects participants while still allowing meaningful analysis.
Option A reflects a dangerous misconception—that public data needs no privacy protections. Public availability doesn't waive ethical obligations to protect participants from research-related harm. Option B is impractical and often impossible for large-scale social media research, especially when analyzing thousands of posts or when users may no longer be active. While informed consent is the gold standard, it's not always feasible for publicly available data analysis. Option D incorrectly assumes that aggregate analysis eliminates privacy concerns, but even aggregated findings can potentially be traced back to individuals if usernames remain attached.
For biostatistics exams, remember this pattern: privacy protection requirements exist on a spectrum, not as binary public/private categories. Even with public data, researchers should implement reasonable safeguards to minimize identification risks. Always look for answers that balance research feasibility with participant protection rather than those that completely eliminate privacy measures.
- A biostatistician discovers that a dataset they are analyzing contains more detailed information than described in the original IRB protocol. The additional variables include specific medical diagnoses that were not mentioned in the approved research plan. What should the biostatistician do?
Answer: Contact the IRB to report the discrepancy and seek guidance on how to proceed
When you encounter questions about research ethics and protocol deviations, remember that the IRB (Institutional Review Board) is the governing body that must approve and oversee all human subjects research. Any significant changes or discoveries that deviate from the approved protocol require IRB notification.
The correct approach is C) Contact the IRB to report the discrepancy and seek guidance on how to proceed. This dataset contains medical diagnoses that weren't part of the original approved research plan, which constitutes a protocol deviation. The IRB needs to evaluate whether using this additional data requires protocol amendments, additional consent procedures, or other ethical safeguards. They may determine the data can be used with modifications, or they may require it to be excluded entirely.
Option A is problematic because simply excluding variables from reports doesn't address the ethical oversight issue—the IRB still needs to know about the discrepancy. Option B violates research ethics principles by using data beyond the approved scope without proper oversight, regardless of potential statistical benefits. Option D assumes you can make this decision independently, but protocol deviations require IRB review even when the researcher plans to exclude the extra data.
Study tip: In biostatistics ethics questions, remember that statistical considerations (like power or sample size) never override ethical requirements. When you see scenarios involving unexpected data, protocol changes, or deviations from approved plans, the answer almost always involves consulting the IRB rather than making independent decisions about data use.
- A biostatistician working on a longitudinal cohort study discovers that participant consent forms from 2018-2020 contained language stating that data would be 'destroyed after 10 years,' while forms from 2021-present state that data will be 'retained indefinitely for future research.' The study database currently contains data from all time periods in a single integrated dataset. The research team wants to conduct a 15-year follow-up analysis. How should this consent discrepancy be addressed?
Answer: Conduct the 15-year analysis using only data from participants who consented under the indefinite retention language, and seek re-consent from earlier participants for inclusion in long-term analyses.
Option A correctly respects the original consent terms while providing an ethical path forward. Participants who consented to 10-year retention should have that agreement honored, but they can be approached for re-consent to participate in longer-term studies. Option B violates the principle of informed consent by ignoring the explicit terms participants agreed to initially. Option C is unnecessarily restrictive - there's no need to destroy data if participants can be re-consented. Option D is ethically problematic as IRBs cannot retroactively change consent terms that participants already agreed to, and researcher convenience or scientific benefit doesn't override consent agreements.
- A researcher is conducting a study on diabetes management and wants to collect data from electronic health records at multiple hospitals. The study will analyze de-identified patient data including age, gender, HbA1c levels, and medication adherence patterns. Which of the following best describes the IRB review requirements for this study?
Answer: IRB exemption may apply if the data cannot be linked back to individual subjects
When you encounter questions about IRB review requirements, focus on the key factor that determines the level of oversight needed: whether the research involves identifiable human subjects and the risk level to participants.
The correct answer is C because IRB exemption may indeed apply when data cannot be linked back to individual subjects. Under federal regulations (45 CFR 46), research involving existing data that cannot be readily identified is eligible for exemption from IRB review. The critical distinction is whether the researcher can link the data back to specific individuals - if this linkage is impossible, the research may qualify for exemption.
Option A is incorrect because full IRB review isn't automatically required just because a study uses medical records. The level of review depends on identifiability and risk, not simply the data source. Option B misses the mark because expedited review is typically for minimal risk research involving identifiable subjects - but if data truly cannot be linked to individuals, exemption (not just expedited review) may be appropriate. Option D is completely wrong because retrospective chart reviews absolutely can constitute human subjects research if the data are identifiable or if there's potential for identification.
The key distinction here is between "de-identified" data (which may still have some linking potential) and data that "cannot be linked back to individual subjects" (which offers stronger privacy protection). Pay attention to this subtle but important difference in IRB questions - the strength of the privacy protection determines the appropriate level of review, with the strongest protection potentially qualifying for complete exemption.
