Institutional Review Board

Retention Requirements

Research records must be kept and securely stored for a number of years after a project is closed.  The amount of time your records must be retained depends on a number of factors, including whether there was FDA oversight, whether HIPAA regulations apply to the project, if there was federal funding for the project (and if so, there are varying requirements depending on the granting agency), etc.

Some requirements for the length of time records must be kept are determined by the closure date of the study.

• University of Utah policy requires that records be maintained for three years after a project is closed.
• The Department of Health and Human Services regulations require that records be kept for three years ((45 CFR 46.115(b) and 21 CFR 56.115(b)).
• For research subject to the Health Insurance Portability and Accountability Act (HIPAA), records must be kept for six years after completion (45 CFR 164.530(j)).  This includes records of IRB determinations of waivers of authorization, and records of disclosure not listed in the consent and authorization document (e.g. secondary analysis of data studies conducted under a waiver).
• For federal agencies, the length of record retention can be determined by the grant period.  Depending on the agencies, records must be kept for up to seven years from the expiration of the grant.
• For studies regulated by the Food and Drug Administration, records must be kept for two years after the last marketing approval (21 CFR 312.62).  Additionally, individual sponsors may have their own requirements for how long records must be kept.

When determining how long records should be kept, it is the responsibility of the study team (and ultimately the investigator) to determine which regulations apply and how long records must be kept.