Office of Research Oversight What’s New in VHA Handbook Dated November 15, 2011 December 1, 2011

VETERANS HEALTH ADMINISTRATION Summary of Changes Reconciles reporting requirements with the recent realignment of ORO’s Regional Office (RO) and Central Office (CO) oversight groups Adds 48 hr telephone/ “heads up” reporting of events/problems determined to be serious and unanticipated and related to research Clarifies reporting requirements related to research information protection Incorporates various minor or clarifying changes Note: Changes from previous requirements are noted in blue italics. 1

VETERANS HEALTH ADMINISTRATION Changes Related to realignment of ORO’s RO and CO oversight groups Report to ORO CO on all matters related to – Animal Research – Research Safety and Security, – Research Information Protection, except as indicated in Slide 6. ORO RO is not copied on these reports. – Note: A copy to the appropriate RO is still required when reporting changes in the Research Program, HRPP Accreditation, FWA, IRB/MOU, RCOs to ORO CO per §6.c(5), §7.k., and Appendix A 2

VETERANS HEALTH ADMINISTRATION Rapid Notification §7.d. IRB Review of Serious Unanticipated Problems and Unanticipated SAEs §7.d(1) “If the convened IRB or the qualified IRB member- reviewer determines that the problem or event is serious and unanticipated and related to the research, the IRB Chair or designee must notify ORO via telephone or within 48 hours and report the problem or event directly (without intermediaries) to the facility Director within 5 business days after the determination” o Change: Requirement for notifying ORO via telephone or within 48 hours is added. 3

VETERANS HEALTH ADMINISTRATION Changes to Clarify Reporting Requirements Related to RIPP (1) §11.a. Immediate Reporting. Members of the research community must report the following to the ACOS/R, facility ISO, and facility PO within 1 hour of discovery: §11.a(1) Reportable Incidents. “Any unauthorized use disclosure, transmission, removal, theft, loss, or destruction of VA research-related protected health information (PHI), individually identifiable private information, or confidential information as defined by the HIPAA Privacy Rule, the Common Rule, the Privacy Act or 38 USC §§5701, 5705, and 7332.” o Changes: “confidential information” and “Common Rule” are added, and other types of incidents reportable to NSOC are deleted. 4

VETERANS HEALTH ADMINISTRATION Changes to Clarify Reporting Requirements Related to RIPP (2) §11.a(2) The previous requirement for “reporting to ORO all incidents reported to NSOC” has been deleted. §11.b. Regular Reporting. Within 5 business days of receiving a credible report or becoming aware of a reportable research information protection incident, the ACOS/R must report the situation directly (without intermediaries) to the facility Director, the R&D Committee, and any other relevant research committees, and must ensure that the facility ISO and PO have also been notified. o Change: ACOS/R is given specific reporting responsibilities. 5

VETERANS HEALTH ADMINISTRATION §11.c. Reports to ORO. In addition to other reporting responsibilities, the MCD must report to ORO and ensure the ISO and PO are notified of the following incidents: §11.c(1) Uses and disclosures of PHI under an invalid (or nonexistent) HIPAA authorization or waiver of HIPAA authorization, and deficient (or nonexistent) ISO or PO protocol review practices that substantively compromise the effectiveness of the facility’s research information protection program, must be reported to the relevant ORO RO. o Change: Specifies that these issues continue to be reported to the appropriate ORO RO 6 Changes to Clarify Reporting Requirements Related to RIPP (3)

VETERANS HEALTH ADMINISTRATION §11.c. Reports to ORO. In addition to reporting responsibilities described elsewhere, the MCD must report to ORO and ensure the ISO and PO are notified of following incidents : §11.c(2) All other research information protection incidents described in paragraph 11 (for example, unauthorized transmission, removal, theft, loss, or destruction of VA PHI related to research) must be reported to ORO CO. o Change: All other research information protection issues must be reported to ORO CO rather than ORO RO 7 Changes to Clarify Reporting Requirements Related to RIPP (4)

VETERANS HEALTH ADMINISTRATION Other Changes: Initial Reports to ORO §5.b. Content of Initial Report to ORO. §5.b(7) A description of the event being reported, including (where applicable) the nature of the research study and, for animal studies, the species (e.g., basic science laboratory study; retrospective chart review; prostate cancer treatment study; post-traumatic stress disorder behavioral intervention study; neurophysiological visual perception study in rats) o Change: Additional details to be reported 8

VETERANS HEALTH ADMINISTRATION Other Changes: Secure Transmissions §5.e. Secure Transmission to ORO. Electronic transmissions of such reports must be encrypted in accordance with applicable requirements of the VA Office of Information and Technology. o Change: “Encrypted” is clarified – not all reports to ORO must be encrypted 9

VETERANS HEALTH ADMINISTRATION Other Changes: PBM Alerts §7.b. Serious Unanticipated Problems Involving Risks to Subjects or Others §7.b(3) Note: PBM forwards such communications directly to the Chief of Staff, who is required to forward these communications to the ACOS for Research. o Change: Roles of the Chief of Staff and the ACOS/R in communicating PBM drug alerts are clarified. 10

VETERANS HEALTH ADMINISTRATION Other Changes: PBM Alerts §7.b. Serious Unanticipated Problems Involving Risks to Subjects or Others §7.b(3) Local SOPs must address the obligations of the ACOS for Research, individual investigators, and the IRB in reviewing such [PBM] alerts. o Change: Required procedures in local SOPs are emphasized. 11

VETERANS HEALTH ADMINISTRATION Other Changes: External Monitoring §7.f. Examples of Apparent Serious Noncompliance. §7.f(1) Any finding of noncompliance with human research requirements by any VA office (other than ORO), any other Federal or State entity (e.g., FDA), or any external monitor. o Change: “Finding of noncompliance by any external monitor” is added. 12

VETERANS HEALTH ADMINISTRATION Other Changes: Consultation with ORO §7.i.IRB Review of Apparent Serious or Continuing Noncompliance. NOTE: The IRB Chair, or designee, must consult the relevant ORO RO if the significance of a reported event is not clear. o Change: Required consultation is emphasized. 13

VETERANS HEALTH ADMINISTRATION Other Changes: RCO Changes §7.k. [Reportable] Program Changes. §7.k(5) RCO Changes. Any appointment, resignation, or change in status of the facility RCO must be reported to ORO CO, with a copy to the relevant ORO RO, within 5 business days per subparagraph 6.c(5). o Change: “§7.k(5) RCO Changes” is added. 14

VETERANS HEALTH ADMINISTRATION Other Changes: Lab Decommissions §9.f. Laboratory Decommissions. The PI or Laboratory Director must obtain authorization (i.e., permission) from the SRS and the ACOS for Research prior to decommissioning (including vacating, reassigning, converting to non-laboratory use, or otherwise modifying) existing laboratory space that requires identification and disposal of hazardous materials, infectious agents, or equipment between uses. o Change: “Modifying” existing lab space requiring identification/disposal of hazards is added. 15