If I have to retain study documents for 3 years, when can I de-identify the records?
It depends. For FDA-related studies, it is important to retain the key/link until the sponsor notifies you that it is no longer necessary. This is vital since the FDA could choose to audit the study. For all other studies, identifiers can be removed from the dataset that will be used for analysis purposes as soon as the research is complete. As long as a key exists linking the dataset to a Master File containing PHI, the data is coded. The Master File may be retained as long as needed consistent with the goals and requirements of the research. As long as the ongoing use of the data doesn't involve interaction with personally identifiable information the study may be closed.
How long do I need to keep copies of signed consent forms?
If the consent form contains a HIPAA Authorization (a combined consent/authorization), the documents must be retained for 6 years. Otherwise, 3 years is sufficient.
How long do I need to keep documentation of HIPAA Authorization?
If a stand-alone HIPAA Authorization or a verbal HIPAA authorization is used, the documentation must be retained for 6 years.