the records pocket
Existing records: the moment a dataset becomes human subjects.
Records that already exist become human-subjects research the moment whoever analyses them could tie a row back to a person — straight off the page, or by way of a code somebody could release. Identifiability is the entire test, and not one the project grades itself on: Herzing's board makes the call. What follows opens the records pocket as a reviewer opens it.
Annika Brandstetter, DNP, APRN · filed 23 August 2026
Old records become human-subjects research when whoever analyses them can readily ascertain who the rows describe. Herzing's board makes that determination, not the project. Your application has to name who holds the key, what leaves the source, and when identifiers are destroyed.
Is a pull of existing records research at all?
Two questions settle it, in order. First, is the activity research? Herzing's Statement of Principles quotes the definition from 45 CFR 46.102(l): systematic investigation — its forms include development, testing and evaluation — aimed at knowledge that generalises beyond the setting. Second, does it involve human subjects? The reach here is wider than most people expect: under 46.102(e)(1)(ii), a living person counts as a human subject where identifiable private information about them is obtained, used, studied, analysed or generated by an investigator. Nobody need be met, phoned or consented for that clause to bite. A chart is the regulation's own worked example of private information — something supplied for one purpose that the person expects will stay out of public view.
So a backward-looking pull from a chart system, an incident log or a staffing extract can be human-subjects research even though everything in it happened before the project existed. Age is not what changes the answer. Reach is.
That determination belongs to the institution rather than to you. OHRP's guidance on coded private information advises against letting investigators rule independently that such work falls outside the human-subjects definition, and asks institutions to designate who does rule on it. At Herzing the designation sits in the bylaws: the IRB Chair reads each incoming application and settles whether it is exempt, eligible for expedited review, or bound for the full board. Concluding privately that a dataset is anonymous, then acting on the conclusion, is the one move nothing downstream repairs.
Which of these four datasets is yours?
Most returned records files are not wrong about the law. They are wrong about their own data: the narrative describes one thing and the variable list another. Four situations behave differently, and a reviewer can tell them apart from the variable list alone.
| What you are actually holding | How the Common Rule reads it | How the Privacy Rule reads it, where the source is a covered entity | The question the board presses |
|---|---|---|---|
| You open identified records yourself and transcribe into a sheet, giving each person a code of your own | Human-subjects research. OHRP is explicit that coding at the point of recording still permits identification through linked identifiers, so the secondary-research exemption does not rescue it | Protected health information: needs authorization, a waiver, or the limited-data-set route | Why identifiers are needed at all, who else reaches the key, and when it stops existing |
| Somebody at the source abstracts for you and the key never leaves them, under a written undertaking | May fall outside the human-subjects definition under OHRP's coded-information guidance — though Herzing decides that, not you | Still protected health information if dates or other listed elements survive | That undertaking's wording, the abstractor's role, and a plain statement that the key never reaches you |
| A file with every listed element stripped by the safe-harbor method | Not identifiable private information; still submitted at Herzing, usually toward exemption or a finding of no human subjects | De-identified, and therefore outside the Privacy Rule | Who stripped it and by which method, and that no admission dates or record numbers came through |
| Identifiable data that is genuinely public | Exempt by the public-availability route at 46.104(d)(4)(i) | Not usually protected health information, though that depends on the source | Evidence the source really is public, and the terms of use attached |
One line trips records files more often than anything else in the regulation. The safe-harbor method — 164.514(b)(2) — takes out names; geography finer than a state; every element of a date apart from the year; record, account and beneficiary numbers; and then a catch-all covering any other unique identifying code, characteristic or number. A sheet that has kept admission dates and a unit name fails safe harbor, however careful the deletions. It is a limited data set, and those arrive with paperwork attached.
A quieter trap sits in Herzing's own summary. The current Statement of Principles renders the secondary-data exemption as existing data that is either publicly available or recorded so that subjects cannot be identified — the two routes at 46.104(d)(4)(i) and (ii). A third exists at (d)(4)(iii), for identifiable health information used under the Privacy Rule for health care operations or research. Leaning on that third route means arguing it rather than assuming it, and citing the subparagraph in the application. Which routes this board recognises in practice is exactly the detail to confirm against Herzing's current IRB handbook or portal.
What does HIPAA add when the records belong to a covered entity?
Herzing's board does not administer the Privacy Rule on a hospital's behalf; it asks whether your account of the data holds together and is lawful on its face. The Rule hands the record-holder a short menu, and the file should say plainly which item it orders:
- Individual authorization from every person represented in the dataset, which is rarely workable for a retrospective pull.
- A waiver of that authorization, granted by a board or a privacy board. The criteria at 164.512(i)(2)(ii) require minimal privacy risk, resting on adequate plans to protect the identifiers and to destroy them at the earliest opportunity, written assurances against reuse, and findings that the work could not practicably proceed without either the waiver or the information.
- A limited data set, released on the terms 164.514(e) sets: the listed direct identifiers come out, dates and coarse geography may remain, and whoever receives it signs a data-use agreement.
- De-identified data, by safe harbor or by expert determination, which leaves the Privacy Rule behind altogether.
- Review preparatory to research at 164.512(i)(1)(ii), which lets somebody examine records to shape a protocol provided nothing leaves the covered entity. A feasibility count is done lawfully this way. It is not permission to begin collecting.
Whichever item you order, one sentence has to hold across every page of the folder. A file promising de-identified data in one paragraph and a link to readmissions by medical record number in the next has described two different projects, and the board only needs to notice once.
Which Herzing application does a records project go on?
Herzing publishes two, and its Getting Started note routes them by programme rather than by design: the improvement or innovation application for the doctoral nursing tracks it names, the research protocol application for everyone else. Both go to the IRB office by email, and both open by saying the board reviews the request in order to determine whether it is human subject research under the Common Rule — the determination is an output of filing, not a prerequisite for it.
So the form in front of you may be shaped for improvement work while your data sits squarely in secondary research, or the reverse. Writing fixes that, not form-shopping: the narrative has to make the category argument out loud, in the board's own vocabulary. Our piece on the review levels takes the same argument from the board's side, and the process step by step lays out the sequence a file moves through.
What the records pocket has to contain before it is filed
Both applications carry a data-security block asking four things of physical and electronic data alike: where it rests, how that place is secured, how long it is kept, how it is disposed of. Answer all four with nouns and names. "Encrypted" is not a location; "securely destroyed" is not a method.
- The source, named. Which system, which service line, which date range, who owns it.
- The variable list. Every field you will genuinely hold, so the identifiability claim can be checked against it instead of taken on trust.
- The hand-off. Who extracts, who strips identifiers, what reaches you — and if a code exists, who keeps the key and under what written prohibition on releasing it.
- The lawful basis for the data leaving its source: authorization, a waiver and the body that granted it, a limited data set with its agreement, de-identification, or a public source.
- Storage and disposal, with a real end point for the identifiers rather than a stated intention. The Privacy Rule's waiver criteria and Herzing's own form are asking this from two directions.
- Site permission from whoever can genuinely grant access to the records — a separate act from a supervisor's blessing, and the subject of its own piece.
- Training certificates for everyone named on the application. Herzing's checklists ask for a copy of CITI certification, noting that it is free for Herzing affiliates through Canvas.
- Any external board's paperwork. The checklists ask for a copy of the application and the approval letter from an external IRB where one applies.
One clause on both applications is easy to skim and awkward to meet late: information collected from Herzing's own community counts as proprietary, publications may not identify or implicate the university, and a copy of the final deliverable returns to Herzing. Where the records come from inside Herzing rather than a clinical site, read it before planning how the findings travel.
What to do next
Write the variable list before anything else. Nine times in ten the identifiability question answers itself once the fields are on one page, and the rest of the pocket follows from that answer instead of arguing with it.
Prefer to hand it over? Our free application review reads whatever exists today and tells you which pockets a reviewer would accept and which would come straight back. After that we build the folder and carry it, replying for as long as the board keeps writing. None of it changes who owns the work — the records, the analysis and the conclusions remain yours — or who owns the ruling. The tabs and their honest stop points are laid out in how it works; the FAQ takes the same ground briefly.
Sources
- Herzing University Institutional Review Board — the board's own page, its forms and its meeting calendar.
- Herzing University IRB, Getting Started: Read this First (PDF) — which application belongs to which programme, and where it goes.
- Herzing University IRB Statement of Principles (PDF) — definitions, the exempt and expedited summaries, and the approval criteria.
- Herzing University IRB Research Protocol Application (PDF) — the submission checklist and the data-security block.
- Herzing University IRB Healthcare Improvement or Innovation Project Application (PDF).
- Herzing University IRB Bylaws (PDF) — who triages an incoming application into exempt, expedited or full board.
- 45 CFR 46.102 and 45 CFR 46.104 — the definitions, and the exemption categories including secondary research at (d)(4).
- OHRP guidance: research involving coded private information or specimens.
- 45 CFR 164.514(b) and (e) — the safe-harbor method, and limited data sets with their agreements.
- 45 CFR 164.512(i) — research waivers, and review preparatory to research.
Named forms, routes and prerequisites move between editions. Verify every Herzing-specific item against Herzing's current IRB handbook or portal. This practice is independent and not affiliated with Herzing University or its Institutional Review Board.
the other tabs in this file