Document Retention

Duration of Record Retention

The required duration for retention varies depending on which regulations apply to the research in question.

Investigators must retain some of the information from the study file after study completion. The DHHS regulations at 45 CFR 46 do not specify a research records retention period. There are requirements published by the Office of Management and Budget related to records retention which differ from the requirements for studies regulated by the FDA. In addition, HIPAA requires retention of some key information and documents apart from the requirements for the rest of the research records.

  • IRB Records means all records of communications with the IRB and all approval documents (stored in eIRB).

  • HIPAA Authorization means either (1) the copy of the signed Consent Forms or (2) the stand-alone authorization or (3) documentation of verbal authorization.

  • HIPAA Waiver means the record of the IRB determination of a waiver of HIPAA (stored in eIRB).

Study Document Retention Requirements
Minimum Retention Period
IRB Records § 3 years after study completion
Federal Grants 3 years after expiration of grant period
HIPAA Authorization 6 years after completion of study
HIPAA Waiver § 6 years after completion of study
FDA 2 years after last marketing approval

§ Automatically maintained in the eIRB system

Research Not Regulated by the FDA

45 CFR 74 Uniform Administrative Requirements For Awards And Subawards to Institutions of Higher Education, Hospitals, Other Nonprofit Organizations, and Commercial Organizations

Subpart C - Post-Award Requirements
45 CFR 74.53 Retention and access requirements for records

(a) This section sets forth requirements for record retention and access to records for awards to recipients.
(b) Financial records, supporting documents, statistical records, and all other records pertinent to an award shall be retained for a period of three years from the date of submission of the final expenditure report or, for awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report. The only exceptions are the following:...

Department of Health and Human Services Requirements for IRBs:

  • 45 CFR 46.115(b) and 21 CFR 56.115(b) require that all IRB records be retained for at least 3 years, and records relating to research which is conducted be retained for at least 3 years after completion of the research. All records must be accessible for inspection and copying by authorized representatives of HHS or the FDA at reasonable times and in a reasonable manner.

Federal Regulatory Requirements for Recipients of Grants:

  • Federal Regulations for record retention and access to records for awards to recipients are set forth in OMB Circular A-110, (Uniform Administrative Requirements for Grants and Agreements with Institutions of Higher Education, Hospitals, and Other Non-Profit Organizations) and in various regulations including 45 CFR 74 and 45 CFR 92. The other records pertinent to an award includes all research-related study records. The minimum retention period is 3 years but individual granting agencies can require longer periods of up to 7 years. Investigators must comply with the requirements of the granting agency.

  • In addition, 42 CFR 93 (Public Health Service Policies on Research Misconduct) specifies evidentiary retention requirements for research records that are part of a research misconduct investigation.

Research Not Funded by the Federal Government:

  • Best Practice standards are to maintain research records for at least 3 years after completion, which is the minimum period required for federally funded research.

  • Some recommendations for research involving children suggest a minimum records retention period of 6 years rather than 3 years.

Research Regulated by the FDA

21 CFR 312.62(c): An investigator involved in the research of drugs, devices, or biologics being tested in humans for FDA approval shall retain records

  • for a period of 2 years following the date a marketing application is approved for the drug for the indication for which it is being investigated; or, if no application is to be filed or if the application is not approved for such indication, until 2 years after the investigation is discontinued and FDA is notified.

  • The date of last marketing approval will not be known at the time the research is completed and can be quite long. Investigators are advised to include funds for storage of the case records in their study budget. Records should be retained until there is written confirmation from the sponsor or FDA granting permission to destroy them.

HIPAA Requirements

45 CFR 164.530(j)(1) of HIPAA requires a 6 year retention period for the documents listed below.

  • Written HIPAA Authorizations: If the research involves Protected Health Information (PHI), the Principal Investigator must retain the permission (i.e. the consent form or authorization) to use the PHI for 6 years beyond the expiration date of the authorization (completion of the research).

  • IRB Determinations for Waiver of HIPAA: Records documenting that a request for waiver of HIPAA Authorization met all the requirements of 45 CFR 164.512(i.)(2)(ii) must be retained for 6 years from the completion of the research. This information will be automatically archived in the eIRB system.

  • Disclosures of PHI: An accounting of all disclosures of PHI (not listed in the consent/authorization) must be retained for 6 years after the disclosure.

Clinically Significant Research Results

Investigators must retain all medical records that are of clinical significance in accordance with CHOP Policy A-3-9: Retention and Destruction of Medical Records. These records are considered part of the subject's hospital medical record. However, if the source documents are part of the subject's main hospital record (e.g., recorded in EPIC, ChartMax, CompuRecord, etc.), there is no need to maintain a duplicate as part of the research records. The source document satisfies policy A-3-9.

Results that are not directly related to the research may still be clinically significant. These results are classified as incidental findings or secondary findings. Only those incidental findings that are clinically significant need to be reported to the research subject and placed in the medical record.

  1. If I have to retain study documents for 3 years, when can I de-identify the records?

    It depends. For FDA-related studies, it is important to retain the key/link until the sponsor notifies you that it is no longer necessary. This is vital since the FDA could choose to audit the study. For all other studies, identifiers can be removed from the dataset that will be used for analysis purposes as soon as the research is complete. As long as a key exists linking the dataset to a Master File containing PHI, the data is coded. The Master File may be retained as long as needed consistent with the goals and requirements of the research. As long as the ongoing use of the data doesn't involve interaction with personally identifiable information the study may be closed.

  2. How long do I need to keep copies of signed consent forms?

    If the consent form contains a HIPAA Authorization (a combined consent/authorization), the documents must be retained for 6 years. Otherwise, 3 years is sufficient.

  3. How long do I need to keep documentation of HIPAA Authorization?

    If a stand-alone HIPAA Authorization or a verbal HIPAA authorization is used, the documentation must be retained for 6 years.

Top