Secondary data and existing records in a Purdue Global study: when it is human-subjects research
A project that touches no living person, runs no survey and asks no question of anybody can still be human-subjects research. The hinge is not whether the numbers are new. It is whether the person working with them can put a name to a row — directly, or through a code, a link, a spreadsheet tab nobody deleted. Purdue University Global's board reads that question first, and its own procedures say the applicant does not answer it alone.
Short answer
If you can identify people from the records — by name or through any key you could reach — it is human-subjects research and the board reviews it. If you truly cannot, it may not be. Purdue Global's IRB makes that call, not you.
Why does a chart review need a determination at all?
Because the federal definition of a human subject has two doors, and only one involves meeting anybody. Purdue Global's procedure on determining human subject research reproduces both. The first door is intervention or interaction — you do something to a person, or you talk to them. The second needs no contact at all: an investigator is working with human subjects if they obtain, use, study, analyse or generate identifiable private information.
That second door is the one a records project walks through. The same procedure defines private information as information about behaviour in a setting where somebody could reasonably expect no observation was happening, plus information handed over for a stated purpose the person could reasonably expect would not be made public — a medical record is the example given. It turns identifiable once the investigator can readily work out who the person is, or once identity travels attached to the record.
Neither sentence asks whether the data existed before your project. They ask what you can see when you open the file.
What decides it: your reach, not the dataset
Two people can work from the same export and receive different determinations, because the test is investigator-relative. The board is not grading the database; it measures the distance between you and a name.
Take the ordinary workplace case. A manager pulls a spreadsheet from a record system, strips the name column, and hands it over. If a medical record number, an account number or an admission date survives, identity may readily be ascertained — often by you, sometimes by anyone with access to the source system. If the manager keeps a key mapping row 47 back to a person, and you could ask for it, the reach exists whether or not you intend to use it.
The Office for Human Research Protections addressed exactly this in its guidance on coded private information. Research involving only coded information is not, in OHRP's view, human-subjects research where two conditions are both met: the information was not collected for the proposed project through interaction with living individuals, and the investigator cannot readily ascertain identity — because, for instance, the investigator and the key holder have an agreement prohibiting release of the key. Note what makes that work: a document, not a promise. OHRP then adds the line that matters most for anybody tempted to self-clear — it recommends that investigators not be given authority to determine independently that coded research involves no human subjects.
Purdue Global says the equivalent in its own voice, in its exemption procedure: investigators are not authorised to make that determination entirely independently. The honest sequence is to work the question out carefully, write the reasoning down, and file it for the board to confirm.
Which pathway does a records project belong to?
Purdue Global's Investigator Guide opens with three submission pathways — Human Research Determination, Exempt Research, Expedited Research — each with its own self-assessment worksheet and protocol template. A secondary-analysis project can honestly land on any of the three, and the drawing you file has to match the one you claim.
| Situation | Likely pathway | What the file must establish |
|---|---|---|
| No reach to identity | Human Research Determination | Who holds any key, what bars its release, and why you could not obtain it |
| Local audit of one process | Human Research Determination | Improving one local service, not answering a research question; no comparison group; findings not generalisable |
| Identifiable records, secondary use | Exempt Research | Which of the four secondary-research criteria is met, with confidentiality provisions named |
| Records plus anything prospective | Expedited Research | Minimal risk plus a category; materials gathered for another purpose sit in category five |
The Human Research Determination worksheet repays reading even when you are certain you are doing research, because its indicators of research are blunt: comparison groups, controlled designs, random assignment, data gathered to draw conclusions beyond the local site, a plan to publish as research. Any one contradicts a quality-improvement claim, and the reviewer reads the design rather than the label.
If it is exempt, which criterion are you claiming?
The secondary-research exemption at 45 CFR 46.104(d)(4) is not one gate but four, and Purdue Global's worksheet reproduces all four. You need one, and the file must say which.
- Publicly available. A restricted-use file released under a data-use agreement is not public, whatever the portal calls it.
- Recorded unidentifiably, no contact, no re-identification. Three commitments in one clause, and the protocol should state all three.
- Regulated use of identifiable health information. Where the use is regulated under the HIPAA rules at 45 CFR parts 160 and 164, subparts A and E, for health care operations or research as defined at 45 CFR 164.501.
- Federal non-research information. Government-generated information used by or for a federal department.
One structural point deserves emphasis. Purdue Global's worksheet records that, as an online institution, its board does not currently review the exemption categories covering taste and food quality studies, storage for later secondary research under broad consent, or secondary research under broad consent. If your plan depends on broad consent, that is a conversation to have before the protocol is drafted.
What changes when the records are health records?
HIPAA runs alongside the Common Rule; clearing one does not clear the other. Three provisions do most of the work here.
De-identification. Under 45 CFR 164.514(a)–(b), health information is not individually identifiable where there is no reasonable basis to believe it can identify a person — established by a qualified expert's documented determination that the re-identification risk is very small, or by removing the enumerated identifiers. Deleting the name column is not that standard.
The limited data set. Under 164.514(e), a limited data set strips out the direct identifiers enumerated there — names, contact details, account and record numbers, device and network identifiers, biometrics and full-face images — while permitting dates and some geography to remain. It may be used for research only under a data use agreement, signed by a site's legal office, which puts it on your critical path early.
Authorisation, and who may waive it. Purdue Global's external-site supplement is explicit on a point that surprises people: Purdue Global will not waive HIPAA authorisation for third parties. If protected health information is coming to you from another covered entity, the full or partial waiver has to come from that entity. The toolkit also carries an authorisation instruction sheet for somebody authorising release of their own records.
What must the file say, in the same words, everywhere?
A returned application is usually a tolerance failure — one dimension measured in two documents and found different. Read your own draft against this list before anybody else does.
- The source of every variable, named identically in protocol, application and agreement.
- The date range and record count, as one figure rather than two.
- Who holds any key, what bars its release to you, and whether that document exists yet.
- The identifiers that survive — dates, unit names, small-cell geography — listed rather than summarised as "de-identified".
- Where the extract will live, who can open it, when identifiers come off, and what follows closure.
- A site letter naming the actual access — which system, which records, which fields — signed by somebody authorised to grant it.
- Your human-research training, current and in the option the Investigator Guide names. That guide and the IRB portal have not always described the options in matching language, so verify against the current handbook or IRB portal on the day you file.
None is a research problem. All are drawing problems, visible to anybody reading the documents against each other rather than singly.
What to do next
If your project runs on records somebody else already gathered, the determination is the first thing to settle and the cheapest thing to get wrong. Send us the extract specification, the draft protocol and whatever the site has put in writing; a consultant reads the file the way Purdue Global's board will and returns a written findings list — drift, missing element, or clean. Hand the process over and we carry all of it: determination, drafting, filing, and each answer the board asks for, through to the letter. What never changes hands is your question, your dataset and your conclusions — and no consultancy settles the outcome, which belongs to the board alone. Start with the free application review, see what an end-to-end engagement covers, or browse the questions candidates ask most.
Sources
- PG IRB, SOP 300: Determination of Human Subject Research — docs.google.com
- PG IRB, SOP 301: Exemption Determinations — docs.google.com
- PG IRB, IRB-310 Worksheet: Human Research Determination — docs.google.com
- PG IRB, IRB-312 Worksheet: Exemption Determination — docs.google.com
- PG IRB, IRB-503e Protocol: External IRB Supplement — docs.google.com
- PG IRB, Investigator Guide — purdueglobalwriting.center
- PG IRB, IRB Toolkit — purdueglobalwriting.center
- PG IRB portal — sites.google.com/purdueglobal.edu
- 45 CFR 46.104, Exempt research — ecfr.gov
- 45 CFR 46.102, Definitions — ecfr.gov
- 45 CFR 164.514, on de-identification and the limited data set — ecfr.gov
- OHRP, Coded Private Information or Specimens Use in Research (2008); issued under the pre-2018 numbering of 45 CFR 46, so read it alongside the current rule — hhs.gov/ohrp