The one-sentence rule
An IRB is only required if you are using the Stony Brook University Network AND need to download the dataset OR re-identify your cohort of SBU patients for chart review or recruitment.
By use case
| Use case | IRB required? | Key details |
|---|---|---|
| Study design & feasibility | No | Platform-only work; no individual patient data accessed |
| In-platform data analysis | No | Platform-only work; no individual patient data accessed |
| MRNs for subject recruitment | Yes | Requires PHI access; include a HIPAA Waiver of Authorization |
| MRNs for chart review | Yes | Requires PHI access to patient records |
| SBM patients limited dataset download | Yes | Limited datasets contain dates, diagnoses, procedures; include the Limited Dataset form |
| Research or Linked Network dataset download | No | Individual patient identification is not possible |
Publishing
Many publication venues require an IRB determination that the research qualifies as “Not Human Subjects Research” — even when Stony Brook datasets aren't used. Verify with the venue before submission.
Help with the paperwork
- Template protocols for TriNetX limited-dataset or chart-review research (see Documentation & Resources)
- Template HIPAA Waiver of Authorization for recruitment purposes
- The SBM TriNetX Administrator and Honest Broker review IRB documentation for compliance