Retrospective chart reviews and existing data at Walden: when it's human-subjects research and what the IRB needs

Why does a project with no participants still go to the board?

Two rules stack here, one federal and one Walden's own. The federal rule sits in 45 CFR 46.102: a human subject includes a living person about whom a researcher obtains or analyzes identifiable private information, and private information covers what a person has "provided for specific purposes" with a reasonable expectation it stays out of public view — the regulation names a medical record as its example. You never meet the patient; the chart still carries the person.

Walden's rule is broader and blunter. The university's handbook requires review of research involving access, collection, or analysis of data from "records of any type," states that ethics review applies "whether human subjects are involved or not," and reserves the exemption from submission to exactly two categories: literature reviews and hypothetical designs. It adds that "no member of the university community may commence any such research data collection until it has been approved by the IRB." So the practical answer to "does my chart review need to go in?" is yes — always. The open questions are which determination comes back and how much the file must carry, and those are worth settling honestly before a document is drafted. The full sequence around the review sits in our walk-through of Walden's IRB process step by step.

Identifiable to whom? The question that decides everything

The regulation's test for identifiability is about reach, not intent: information is identifiable when the identity "is or may readily be ascertained by the investigator or associated with the information." Read that against your actual arrangement, not your hopes for it. The determinations differ sharply:

1. You open the charts yourself. You can read names and record numbers, so identities are within your reach even if you copy none of them down. This is human-subjects research; the file must say why you need that access, what you record, and how the extraction sheet is kept clean of identifiers.
2. Someone at the site abstracts the data and hands you a coded set. The federal government's guidance on coded private information defines coding as replacement of identifying details with a number, letter or symbol while "a key to decipher the code exists, enabling linkage of the identifying information to the private information." Whether that still makes you a human-subjects researcher depends on whether you can reach the key. If the site keeps it under a written arrangement that bars release to you in all circumstances, the work may fall outside the definition — but the same guidance tells institutions not to leave that judgment to the researcher, which is precisely why Walden routes it through the board.
3. You receive a set with identifiers fully removed and no key at all. The people may no longer be subjects in the federal sense. Walden still reads the project; the file's job is to prove the de-identification actually happened, by whose hand, and against which standard.

Notice what runs through all three: the determination hangs on facts about other people — who abstracts, who keys, who signs — that you must arrange before you can describe them. A file that says "the data will be de-identified" without naming the person doing it has not answered the question, only restated it.

Which review path can an existing-records project take?

The Common Rule carves out secondary research at 45 CFR 46.104(d)(4): identifiable information already in existence can qualify for exemption when it is publicly available, or when it is recorded so that identities cannot readily be reached, with no contact and no re-identification by the researcher. Where the source is a HIPAA-regulated provider, a separate limb of the same exemption leans on HIPAA's own protections instead. Which of these, if any, fits your project — and whether the outcome is an exemption, an expedited reading, or something else — is the board's determination under Walden's current handbook and IRB portal, never a box you tick yourself. What each path asks of a file, and why chasing the label is the wrong way to draft, is the subject of our reading of Walden's exempt, expedited and full-board paths.

What does HIPAA add when the source is a clinical site?

If the records live at a hospital, clinic, or practice, the site is almost certainly a covered entity, and it cannot lawfully hand you patient information just because it likes your project. The Privacy Rule gives it a short menu, and your Walden file must name which item the site is using — in the site's words, not yours.

One quiet trap deserves its own sentence: a spreadsheet that keeps admission dates is not de-identified under safe harbor no matter how many names were deleted, because date elements sit on the list. The honest label for that file is a limited data set, and the agreement that travels with one belongs in your planning from the start.

What does the Walden file itself have to carry?

Walden's review opens with Form A, where the data sources and any partner organizations are described; on Walden's current process the IRB office then tells you which documents your particular sources call for. For a records project, expect the file to establish, in some form:

• The source, precisely. Which records system, which fields, which population, which span of encounters — matching the proposal your committee approved, with no drift between the two.
• The identifier plan. Who touches identifiable records, who abstracts, where any key lives, and the written arrangement that keeps it from you if the design depends on that separation.
• The site's permission, in the site's hand. Written permission from someone with authority over the records — and where the organization runs its own review board, the question of which board reads first, which our piece on Walden IRB review alongside a partner site's IRB takes up in full.
• The agreement, if one exists. Data use agreements name parties and obligations; the board reads them for terms that contradict the application.
• Storage and destruction. Walden's handbook expects data stored and destroyed on a stated plan, kept confidential and secure for the retention span the handbook fixes, with access limited to those the file names.

Where do records files actually go wrong?

Rarely on the science. The returns we see are alignment failures: an application that claims de-identified data while requesting a field list with birth dates in it; a permission letter authorizing "a review of outcomes" for a project whose plan names staffing records too; an honest-broker arrangement described in the application but absent from any signed page; a feasibility count performed by pulling charts before any letter existed. Each of these is visible at the desk before the board sees it, which is the argument for a desk-side reading that mirrors the board's — once, before filing. That reading, and everything after it, is what the practice carries end to end.

What to do next

Tell us what the records are, where they live, and who owns them — that is enough for a first reading. We are independent consultants, not affiliated with Walden University; we prepare the determination case, the documents, and every reply to the board, while the study and its findings stay yours and the decision stays the board's. Request the free application review, or browse the questions we answer most often.