Research Record Retention

Investigator Requirements for Retaining Research Data

Regulations require each investigator to retain research data not only while the research is being conducted but also after the research is completed. How long do you have to keep the records after the completion of the research? Unfortunately, there are several different regulations each of which has different requirements. As a result, researchers must comply with the longest applicable standard according to current institutional policies. See OSU CHS’s Record Retention policy #3-70190.

OHRP Requirements: 45 CFR 46 requires research records to be retained for at least 3 years after the completion of the research (e.g. closure of study with the IRB).
HIPAA Requirements: Research that involves collection of protected health information (PHI) is subject to the HIPAA regulations. Research records including signed consent forms that contain the HIPAA authorization must be retained for 6 years after the date on which the subject signed the consent form or the date when it last was in effect, whichever is later.
FDA Requirements: Any research that involved drugs, devices, or biologics being tested in humans must have records retained for a period of 2 years following the date a marketing application is approved for the drug for the indication for which it is being investigated; or, if no application is to be filed or if the application is not approved for such indication, until 2 years after the investigation is discontinued and FDA is notified. Please note – this length of time can be much greater than 2 years. You should receive written confirmation from the sponsor and/or FDA granting permission to destroy the records. (21CFR312.62.c)
VA Requirements: At present records for any research that involves the VA must be retained indefinitely per current VA federal regulatory requirements.
State of Oklahoma Requirements: The timetable for retention of documents and records is located at http://www.odl.state.ok.us/oar/recordsmgt/grds-education.htm and shall be used as a guideline for retention, imaging, and disposal of documents and records at Oklahoma State University.
NIH funding requirements: Recipients of NIH funding generally must retain financial and programmatic records, supporting documents, statistical records, images, and all other records that are required by the terms of a grant, or may reasonably be considered pertinent to a grant, for a period of 3 years from the date the annual FFR is submitted.
Sponsor Requirements – contract: If your study is sponsored you must ensure that you comply with any terms for record retention detailed in the contract with the sponsor. For example, a sponsor may require you to retain your research related documents for 20 years. Prior to agreeing to a contract that specifies how long records will be maintained you should ensure you will receive adequate funding to pay for the storage.
Questions of data validity: If there are questions or allegations about the validity of the data or appropriate conduct of the research, you must retain all of the original research data until such questions or allegations have been completely resolved.
What did you inform the research participants?: Some participants may object to retention of their study records for an indefinite amount of time. Ideally, you should define your retention policy in your consent form, so that your participants can agree to it. Sometimes researchers wish to reuse data for subsequent studies. If you anticipate this situation, you should state in your consent form that data may be retained for use in future studies. In this case, you should destroy any identifying information and linking files once you have kept them for the longest applicable standard. Especially if participants are unable to give consent to additional uses of their data, all records should be de-identified before use. Careful data storage for subsequent use prevents researchers from collecting the same data over and over again, protecting participants from inefficient research practices and exposing them to less risk.

Notice that these regulations do not specify when you must destroy data, only state the minimum amount of time you must retain it. As long as you can guarantee that your research records are secure, you can keep them indefinitely.

Disposal: When research records are to be destroyed instead of stored securely, you should remember to protect your participants’ confidentiality throughout the process. Paper records should be shredded and recycled, instead of carelessly tossed in the garbage. Records stored on a computer hard drive should then be erased using commercial software applications designed to remove all data from the storage device. For data stored on USB drives or recorded data on tapes, CDs, or DVDs, the storage devices should be physically destroyed. You should keep records stating what records were destroyed, and when and how you did so. Records can be disposed of provided all audits have been completed and all applicable audit reports have been accepted and resolved by all applicable federal and state agencies and provided no legal actions are pending.