In This Section

Document Retention

Published on · Last Updated 1 year 4 months ago


Subscribe to be notified of changes or updates to this page.

2 + 4 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.

CHOP Records Retention Requirements

CHOP investigators must retain all research records in accordance with CHOP Policy A-3-9: Retention and Destruction of Medical Records.The duration specified for research records retention depends upon the level of risk and whether or not the research is exempt. Greater than minimal risk research has a longer retention requirement. Investigators should review the policy to ensure that their plan is in compliance.

All clinically significant medical results must go in the subject's clinical record. Results that are not directly related to the research may still be clinically significant. These results are classified as incidental findings or secondary findings. Only those incidental findings that are clinically significant need to be reported to the research subject and placed in the medical record. (Also see IRB SOP 903: Policy on Reporting Incidental Findings from Research Procedures.)

Regulatory Requirements for Record Retention

The regulatory mandated duration for records retention varies depending on which regulations apply to the research in question. In addition, CHOP policies may have a much longer retention requirement than the federal regulations. CHOP investigators need to ensure that their plan complies both with the federal regulations and CHOP policy.

Investigators must retain some of the information from the study file after study completion. The DHHS regulations at 45 CFR 46 do not specify a research records retention period. There are requirements published by the Office of Management and Budget related to records retention which differ from the requirements for studies regulated by the FDA. In addition, HIPAA requires retention of some key information and documents apart from the requirements for the rest of the research records.

  • IRB Records means all records of communications with the IRB and all approval documents (stored in eIRB).
  • HIPAA Authorization means either (1) the copy of the signed Consent Forms or (2) the stand-alone authorization or (3) documentation of verbal authorization.
  • HIPAA Waiver means the record of the IRB determination of a waiver of HIPAA (stored in eIRB).

Study Document Retention Requirements

Type Minimum Retention Period
IRB Records § 3 years after study completion
Federal Grants 3 years after expiration of grant period
HIPAA Authorization 6 years after completion of study
HIPAA Waiver § 6 years after completion of study
FDA 2 years after last marketing approval

§ Automatically maintained in the eIRB system

Research Not Regulated by the FDA

45 CFR 74

Uniform Administrative Requirements For Awards And Subawards to Institutions of Higher Education, Hospitals, Other Nonprofit Organizations, and Commercial Organizations

Subpart C - Post-Award Requirements
45 CFR 74.53 Retention and access requirements for records

(a) This section sets forth requirements for record retention and access to records for awards to recipients.
(b) Financial records, supporting documents, statistical records, and all other records pertinent to an award shall be retained for a period of three years from the date of submission of the final expenditure report or, for awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report. The only exceptions are the following:...

Department of Health and Human Services Requirements for IRBs:

  • 45 CFR 46.115(b) and 21 CFR 56.115(b) require that all IRB records be retained for at least 3 years, and records relating to research which is conducted be retained for at least 3 years after completion of the research. All records must be accessible for inspection and copying by authorized representatives of HHS or the FDA at reasonable times and in a reasonable manner.

Federal Regulatory Requirements for Recipients of Grants:

  • Federal Regulations for record retention and access to records for awards to recipients are set forth in OMB Circular A-110, (Uniform Administrative Requirements for Grants and Agreements with Institutions of Higher Education, Hospitals, and Other Non-Profit Organizations) and in various regulations including 45 CFR 74 and 45 CFR 92. The other records pertinent to an award includes all research-related study records. The minimum retention period is 3 years but individual granting agencies can require longer periods of up to 7 years. Investigators must comply with the requirements of the granting agency.

  • In addition, 42 CFR 93 (Public Health Service Policies on Research Misconduct) specifies evidentiary retention requirements for research records that are part of a research misconduct investigation.

Research Not Funded by the Federal Government:

  • Best Practice standards are to maintain research records for at least 3 years after completion, which is the minimum period required for federally funded research.

  • Some recommendations for research involving children suggest a minimum records retention period of 6 years rather than 3 years.

Research Regulated by the FDA

21 CFR 312.62(c): An investigator involved in the research of drugs, devices, or biologics being tested in humans for FDA approval shall retain records

  • for a period of 2 years following the date a marketing application is approved for the drug for the indication for which it is being investigated; or, if no application is to be filed or if the application is not approved for such indication, until 2 years after the investigation is discontinued and FDA is notified.

  • The date of last marketing approval will not be known at the time the research is completed and can be quite long. Investigators are advised to include funds for storage of the case records in their study budget. Records should be retained until there is written confirmation from the sponsor or FDA granting permission to destroy them.

HIPAA Requirements

45 CFR 164.530(j)(1) of HIPAA requires a 6 year retention period for the documents listed below.

  • Written HIPAA Authorizations: If the research involves Protected Health Information (PHI), the Principal Investigator must retain the permission (i.e. the consent form or authorization) to use the PHI for 6 years beyond the expiration date of the authorization (completion of the research).

  • IRB Determinations for Waiver of HIPAA: Records documenting that a request for waiver of HIPAA Authorization met all the requirements of 45 CFR 164.512(i.)(2)(ii) must be retained for 6 years from the completion of the research. This information will be automatically archived in the eIRB system.

  • Disclosures of PHI: An accounting of all disclosures of PHI (not listed in the consent/authorization) must be retained for 6 years after the disclosure.

Frequently Asked Questions

  1. For how long must I retain study documents, and when can I de-identify the records?

    All studies must comply with CHOP Data Retention Policy A-3-9 (available for download).

    For FDA-related studies, it is important to retain the key/link until the sponsor notifies you that it is no longer necessary (which will generally occur 2 years after the last marketing approval or, if no application is filed or approved, 2 years after the FDA is notified of discontinued application). This is vital since the FDA could choose to audit the study.

    For minimal risk studies, all study data (including identifiers) should be maintained for 6 years following study completion (or longer if required by the study sponsor).

  2. How long do I need to keep copies of signed consent forms?

    The documents must be retained for must be retained for at least 6 years following study completion, or longer if required per CHOP Data Retention Policy A-3-9.

  3. How long do I need to keep documentation of HIPAA Authorization?

    If a stand-alone HIPAA Authorization or a verbal HIPAA authorization is used, the documentation must be retained for at least 6 years following study completion, or longer if required per CHOP Data Retention Policy A-3-9.