Awareness : Newsletter Articles

Data Broker Corner: Obtaining Medical Record Data to Conduct Your Research

You’ve received IRB approval to begin your research study and you are ready to start collecting and analyzing data. What’s your next step? The specific requirements to receive data derived from patient care at UHealth for research studies may vary based on the design of your study.

If you anticipate direct contact with research subjects prior to requesting this data from UChart, requirements are generally based on whether patients have authorized such use of their medical record data (i.e., signed HIPAA Form B).

Alternatively, the IRB may waive the requirements for HIPAA authorization in order to access protected health information (PHI) prior to, or in the absence of, direct contact with the research subjects if the use or disclosure involves no more than minimal risk to the privacy of individuals, the research could not practicably be conducted without the waiver and the researcher could not practicably be conducted with the access and use of the PHI [45 CFR 164.512(i)(2)].

Once the IRB has granted a waiver of HIPAA authorization, the data request may be submitted for fulfillment via the Clinical Data Request form in the ServiceNow Self-Service Portal or by sending an email to and cc’ing The following recommendations are provided to ensure prompt fulfillment of your data requests pursuant to a full or partial HIPAA waiver.

  • IRB application: Indicate in your recruitment plan that you intend to review UChart health records to identify eligible patients prior to contacting them. The UM IRBs determine the acceptability of proposed recruitment methods. If they agree that this access is appropriate, the UM IRBs may grant a full or partial waiver of HIPAA authorization.
  • Inclusion/Exclusion Criteria: The study’s inclusion criteria serve as the basis upon which to filter your results. When submitting your request, we recommend the use of specific filters whenever possible (i.e. use of ICD9/ICD10 codes for diagnoses, use of CPT codes for procedures, specify sites and/or providers and dates of service, etc).
  • Data Delivery: In general, studies should request the minimum data needed to answer the research questions. Please consider which data points will be necessary for your study: de-identified, limited data set, or identifiable data. Select the most limited category of data that will suffice for your study.
    • If you are screening medical records for recruitment purposes and will have direct contact with interested subjects, perhaps patient names and contact information are enough.
    • Studies based entirely on health record data (e.g., retrospective chart reviews), without any direct patient contact, can often receive expedited review by the IRB. In these cases, the data requested should be consistent with the categories indicated on your IRB-approved data collection sheet.
    • If only de-identified data is requested, you may not need IRB approval at all.

    The request will be routed to the Data Broker team, who will review the IRB application and approval notice to ensure that the requested data is consistent with IRB approval. The workflow employed by the Data Brokers is recorded in UM IT’s Service Now application, in an effort to expedite and document all aspects of the request. If there are any potential data privacy, security or other concerns, the Data Brokers may ask the investigator to amend either the IRB application or the request itself. Once Data Broker approval has been granted, the Data Brokers will coordinate with UHealth IT on data extraction and delivery. Please note UHealth IT performs the actual data extraction.

    For further information on the Data Broker program please contact the UHealth Privacy Office at 305-243-5000 or at For questions regarding IRB submissions, contact the Human Subject Research Office at 305-243-3195. For technical assistance with UChart, contact the UHealth Help Desk at 305-243-5999 or