Records Management
Records Management: Archiving and Storage | Destruction of Records
It is important to remember that records and data resulting from VA-approved research projects belong to the VA, not to the investigator. These files fall under federal records retention rules. If the study involved collection of identifiable records from human subjects, the files are also affected by HIPAA and privacy rules.
HIPAA/Privacy
Once a study closes, all records containing protected health information (PHI) or personally identifiable information (PII) must be sequestered. No access to PHI/PII is allowed post-closure and no copies of PHI/PII can remain accessible to the study team. All copies of any files containing PHI/PII must be turned in to the research data managers upon study closure.
Remember that in cases of administrative closure, these files will be immediately sequestered by the research office data managers. Access to PHI/PII cannot be restored after an administrative closure action.
Federal Records Retention
Federal rules set by the National Archives and Records Administration (NARA) mandate that a copy of all research investigator records be maintained for six fiscal years post study closure. While HIPAA/Privacy rules apply only to PHI/PII, NARA rules apply to all records related to the research project. The NARA definition of "investigator records" includes (but is not limited to) any and all files, data, manuscript drafts, logs, notes, protocols, and investigator copies of oversight committee letters that pertain to the approved research study.
Remember that while six fiscal years post-closure is the minimum required retention period, NARA guidelines state that some records may be stored for longer. Studies involving FDA device trials, or studies in which the study sponsor requests longer periods of records retention, for example, may exceed the six year minimum.
Electronic Research Record Storage
Our program asks that all electronic files related to an approved project be stored in a predictable location on the VA network. For most studies, the required storage location is in the R:\Data directory, in a subfolder using the approved project number as the base folder name. (For example, files for an oncology study with protocol number 1500101 might be saved to a folder named "R:\Data\1500101 Oncology".) Currently, only records maintained by CCDOR or the RECOVER program may be stored outside of R:\Data.
Our expectation is that all research records and data for the study will always be saved to this location. On study closure, our research data managers will archive the folder, and your study team will lose access, satisfying any HIPAA/Privacy requirements. Our research data managers will maintain the archived folder for the duration of the retention period mandated by NARA, satisfying federal records retention requirements. When the retention period has been satisfied, our research data managers will complete and file the records destruction forms and ensure the records are destroyed. By keeping all records and data in the R:\Data directory, you will be helping us ensure that no records or data were missed when the study was archived.
Hard Copy (Paper) Records
Because storage of hard copy (paper) records is more difficult, these records should only be created when necessary and should be digitized by scanning whenever possible. While some records (such as wet ink signatures on consent forms for FDA studies) must be maintained in the original hard copy format, VA considers most records to be media neutral, which means that hard copies do not need to be retained if a digitized version is available. Shredding paper copies after scanning them does not require documentation of destruction, as no records are actually being destroyed - they are only changing format from paper to digital. Our program recommends regularly digitizing records for your active studies, and storing the digitized files in your study folder on R:\Data. Waiting until the study closes to digitize records is not recommended.
If your study has hard copy records that must be sequestered (for HIPAA/Privacy) or archived (for federal records retention), these files must be turned in to the research office records management liasion immediately upon study closure. To ship files to long-term offsite storage, we must have a minimum of eight full file boxes of hard copy records. You should be prepared to digitize records if your hard copy files do not meet the eight file box minimum volume.
What am I allowed to keep?
You can keep copies of any files that do not contain PHI/PII. You can keep draft or final copies of any manuscripts or grant proposals originating from your research. You can keep copies of any de-identified datasets, or datasets that do not contain data originating from human subjects. If you think that copies of datasets will be useful to your future research, you are strongly encouraged to ensure that de-identified datasets are created before study closure.
Can I recover files post-closure?
The simple answer is no. Once a study has been archived you cannot retroactively request access to files from that project. We do not have the staff time available to verify that requested files do not contain PHI/PII. For this reason, we strongly encourage all study teams to ensure that de-identified datasets and/or copies of files the team may retain are created and saved before the study closes.
Records Management: Archiving and Storage | Destruction of Records
Federal rules set by the National Archives and Records Administration (NARA) mandate that stored research investigator records be destroyed after six fiscal years have elapsed post study closure. The NARA definition of "investigator records" includes (but is not limited to) any and all files, data, manuscript drafts, logs, notes, protocols, and investigator copies of oversight committee letters that pertain to the approved research study.
Federal records retention rules also mandate that destruction of records be documented at the end of the required retention period. In general no records may be destroyed unless (a) the required retention period has been satisfied, and (b) a record of destruction (VA Form 7468, "Request for Disposition of Records") has been completed and filed with the facility records management official.
Our office maintains copies of VA Form 7468 pre-filled for use with investigator records. This form is available on the R drive at R:\All_Staff\Record Storage. As a reminder, study records can not be deleted or shredded until after VA Form 7468 has been completed by the person initiating the request for destruction, and has been signed by both the facility Records Manager and the Industrial Hygienist (for physical records) or ISSO (for electronic records). Note: Duplicate copies can be deleted or shredded at any time; only destruction of the sole remaining copy of any research records requires such documentation.
Electronic Research Record Destruction
For all electronic records archived on the R:\ drive as described above, no action need be taken by investigators or study teams to document destruction. Our research data managers will verify retention periods were satisfied, complete and file the records destruction forms, and ensure the records are destroyed. By keeping all records and data in the R:\Data directory, you will be helping us ensure that no records or data were missed in this process.
For any records that were not turned in to research administration, the PI or study team must complete VA Form 7468 and submit it to the Research Office. Our office will route the form for signature and provide permission to destroy records via deletion once all signatures are in place.
Hard Copy (Paper) Record Destruction
For all hard copy records turned in to be shipped to long-term offsite storage for archiving as described above, no action need be taken by investigators or study teams to document destruction. The long-term storage facility will document destruction and handle physical destruction of the records.
For any records that were not turned in to research administration to ship to long-term storage, the PI or study team must complete VA Form 7468 and submit it to the Research Office. Our office will route the form for signature and provide permission to destroy records via placement into a Shred-It bin once all signatures are in place.
