UW Research

July 1, 2025

For the Record- July 1, 2025: Revised Data Security Requirements, Over-enrollment change, more

In this Issue:

Updated Data Security Requirements Guidance

Effective July 1, 2025

HSD has made significant changes to our GUIDANCE Data Security Requirements. This guidance applies to all research where the UW is the IRB of record, including non-UW sites relying on the UW IRB. This is the first major update in seven years and is the result of a collaboration with UW Medicine and input from UW-IT, researchers, and other UW data security experts.

What’s New?

Updated Risk Classification Levels
The framework of risk levels remains, but definitions have been revised to align with updated UW and national standards. The number of risk levels has been reduced to four and most research data will now be at least risk level 2.

Modernized Security Requirements
Requirements now include clearer expectations, more detailed guidance, and links to helpful resources.

New Support Tools for Researchers

Compliance Deadlines

  • New Studies: Must comply with the updated guidance if submitted on or after  July 1, 2025.
  • Existing Studies: Must be brought into compliance with the new requirements by  January 1, 2026. Researchers are asked to assess whether their study’s data security level has changed and submit a modification if needed.

Please review the updated guidance and contact hsdinfo@uw.edu if you have any questions.

 

Upcoming Changes to IRB Review of School of Medicine Research Involving AI

Beginning September 2025

The Human Subjects Division (HSD) has been collaborating with the UW Medicine Generative Artificial Intelligence (AI) Task Force to develop a set of recommendations aimed at mitigating risks associated with research using Artificial Intelligence (AI). The intention of these recommendations is to implement safeguards while minimizing the burden on researchers by augmenting the IRB review process rather than developing a new separate workflow or review process for research involving AI.

The scope of these recommendations is limited to research involving the use of AI that is:

  1. led by School of Medicine Principal Investigators (PIs), AND,
  2. involves either UW Medicine data or targeted enrollment of UW Medicine patients.

HSD plans to implement this augmented IRB review process for research using AI beginning September 2025. HSD will pilot the new process for 1 year, with a midpoint check-in, before we consider applying any aspects of this process to other schools and departments within the University of Washington.

The main components of the augmented review process will include:

  • Expanding how HSD defines Human Research. HSD’s current interpretation of the regulatory definition of identifiable information does not capture some research that should be reviewed by the IRB in order to mitigate the risks to subjects that may result from re-identification of their data. As such, we will be revising our interpretation to include use of data that is at high risk of re-identification. This means that IRB review will be required for some research involving AI that did not previously require IRB review.
  • Developing guidance for research involving AI. HSD is working to develop a standardized and risk-based approach to the review of research involving AI. The guidance will provide a framework to:
    1. Help the IRB identify risks associated with AI
    2. Help identify appropriate expert advisers to inform risk mitigation strategies
    3. Determine when risks have been appropriately mitigated, and
    4. Communicate the IRBs expectations to researchers.
  • UW Medicine Security Review. A security review will be required for research using AI outside of a secure UW Medicine environment. The security review will be completed in 3 to 5 business days and can happen concurrently or prior to IRB review.

We will provide more information about the new guidance and IRB review process in a future newsletter.

 

Over-enrollment Change

Update

HSD has updated our definition of over-enrollment to clarify that it is based solely on the total number of participants enrolled in a study and removed the prior exclusion of withdrawn participants.

We have also updated several documents to make it easier to identify when over-enrollment has occurred. These updates include:

  1. APPLICATION IRB Protocol form changed to ask about planned participant enrollment versus number of targeted completions. Researchers are encouraged to request the maximum number they need to achieve their study aim(s).
  2. Status Report revised to request total participant enrollment as well as withdrawals and completions from initial IRB approval versus since the last status report. This should simplify reporting for investigators and make it easier for IRB review staff to evaluate.

For minimal risk studies, unless otherwise specified by the IRB, there are no restrictions on the total number of participants that may be enrolled. Enrollment caps only apply to greater than minimal risk studies or where the IRB has specified a limit. Researchers who wish to increase enrollment beyond the cap should submit a modification in Zipline before exceeding it. Over-enrollment is considered noncompliance and may require submission of a Report of New Information.

Contact hsdinfo@uw.edu if you have any questions.

Template Risk Language

New Guidance

HSD has created a new section in our GUIDANCE Designing the Consent Process called Example Risk Language for Common Procedures. This section includes sample risk language for three common procedures (blood draws, MRI, and MRI with contrast). We encourage, but do not require that researchers use this language when designing consent forms. HSD intends to add more sample risk language for other procedures in the future. If you have suggestions for procedures we should consider, email your ideas to hsdinfo@uw.edu.

 

UW Medicine Policy Changes for Research Involving Identified & De-Identified Clinical Data Sets

Effective July 1, 2025

What’s Changing?

All research related data sets involving UW Medicine Identified and/or De-Identified Clinical Data must be pulled by a Neutral Intermediary or ‘Honest Broker’ to ensure the data set matches the approved IRB application and the data set is accurately de-identified when applicable.

  • Honest Broker Options after 7/1:
    • Research IT can pull the data set and/or review an already pulled data set to ensure compliance with the approved IRB application for a small fee
    • Affiliated Developers or Analysts who have completed annual Honest Broker training and attested to the rules of the road can pull data sets for research

New Compliance Policies have been established:

  • COMP.307 Honest Broker Policy
    • Defines the responsibilities, core principles, and annual training requirements for individuals serving as Honest Brokers to ensure compliant release of UW Medicine Clinical Data to researchers.
  • COMP.306 Release of Clinical Data for Research Purposes
    • Outlines when and how UW Medicine may disclose Protected Health Information (PHI) and broader clinical data for research. It introduces a centralized and values-based review process and details data stewardship obligations that fall outside patient privacy and security requirements, including institutional standards, data use agreements, and incident reporting.

Why Is This Changing?
At the direction of the President of UW Medicine, a series of assessments were conducted over the past few years to evaluate the current state of operations. These evaluations revealed gaps in existing policies and processes. To address these issues and ensure consistent data stewardship practices that reduce risk and protect clinical data, UW Medicine has established the Honest Broker Program.

Honest Broker Toolkit for Researchers
Research IT is developing additional tools and guidance to support researchers. More information will be announced in a future newsletter.

More details about the Honest Broker Program can be found on this UW Medicine Honest Broker Program page. Questions can be directed to Research Data Services ritdatahelp@uw.edu.

eSignature Policy for HIPAA Authorization

Update

In consultation with UW Medicine Privacy and others, HSD has revised its policy about acceptable platforms for obtaining electronic signatures for HIPAA Authorizations. Use of electronic signatures to obtain a HIPAA authorization to access UW PHI for research purposes is now permitted using any of the approvable methods for obtaining electronic signatures outlined in HSD’s Consent Guidance. This policy applies to both new and existing studies.

For questions about the updated policy, contact hsdinfo@uw.edu.

 

New Requirements for Industry Initiated Studies and Studies Reviewed by Advarra and WCG

Reminder

As described in detail in our June 3, 2025 newsletter, effective July 1, 2025, all new industry initiated clinical trials authorized for non-UW IRB review will require the use of HSD’s stock compensation for injury consent form language for all studies under a standalone Clinical Trial Agreement (CTA) and most studies under a Master Clinical Trial Agreement (MCTA).

Advarra and WCG will hold releasing IRB approval documents until HSD has verified that the consent form(s) includes the stock language and meets other UW requirements. HSD will complete its review within 5 business days. Study teams can ensure a smooth process by ensuring the study consent form(s) contains all required language. Please review last month’s newsletter for full details about the process changes.

For questions about the new requirements, contact hsdrely@uw.edu.