Existing records and secondary data: where a dataset becomes human subjects
Data gathered long before your study existed can still be human-subjects research. The board never asks how the file reached your machine. It asks whether you could readily work out who the people inside it are — and at Grand Canyon University that answer is the board's to give, not the researcher's to assume.
The short answer
Existing records count as human subjects once an investigator could readily work out who the people in them are. GCU requires a board determination before archival analysis begins. What sets the level is not the age of the data but who holds the key.
Does a study of records already collected need GCU IRB approval?
It needs a determination. GCU's archival-data guidance states plainly that approval must be obtained before research activities begin where existing or archival data originate from human participants — the researcher's own classroom included — and for secondary analyses of any dataset holding identifiable or potentially identifiable human information. The single carve-out is instructional: material collected only to sharpen one's own teaching is not research until it is destined for a study, a publication or a conference.
That timing matters more than candidates expect. The determination is not paperwork you catch up on once the spreadsheet turns interesting; it is the gate in front of the first query.
A second GCU-specific ordering fact is worth knowing early. Where the records belong to the university, GCU routes the request through the Office of Research and Grants after IRB approval, the data extracted de-identified and released under a Data Use Agreement binding the recipient to the approved purpose. So the file describes not a dataset you hold, but one you are asking for.
What actually makes a record identifiable?
The federal definitions are short and unforgiving. Under 45 CFR 46.102 a living person becomes a human subject not only through interaction, but also whenever an investigator obtains, uses, studies or analyzes identifiable private information about them, or generates it. Private information, in the regulation's sense, is what somebody supplies for a particular purpose and reasonably expects will stay out of public view. It counts as identifiable where the subject's identity either is, or could readily be, ascertained by whoever is doing the research, or already sits attached to the information.
Read that clause slowly: it decides most archival files. "Could readily be ascertained" describes your reach, not your column headings. Names stripped out does not put a file outside the definition when you can walk down the corridor and match a record number to a chart. Small populations do the same: one site, one cohort, one unit, one job title — three unremarkable columns identify somebody as reliably as a name field.
GCU's own IRB materials draw that line in plainer words: anonymous information can never be linked to identifiers, whereas coded information tied to a name or record number does not reach exempt territory merely because a code was substituted.
When does coded data stop being human-subjects research?
There is a narrow route, narrow on purpose. OHRP's guidance holds that secondary work with coded material is not human-subjects research where the investigator cannot readily ascertain identity — in practice, where the investigator has no access to the key and a written agreement or board-approved policy forbids releasing it to them.
Two things follow. The protection is documentary — a signed instrument between you and the key holder, not a promise about your own restraint. And an investigator holding the key personally has not qualified, however scrupulously they mean to behave. The commonest failure here is a file calling de-identification something the candidate performed, when the candidate also built the crosswalk.
| How the data reaches you | Who can re-identify | How the board tends to read it | What the file must carry |
|---|---|---|---|
| Public dataset, released de-identified | No one, without extraordinary effort | Frequently outside the human-subjects definition, or exempt secondary use | Provenance of the dataset and its terms of use |
| Coded extract, key held by a third party | The key holder only | Can fall outside the definition where the key is contractually withheld | The written agreement or policy barring release of the key |
| Coded extract, key held by you | You | Identifiable private information | Full application, security plan, and a level assigned by the board |
| Records you access in your own workplace | You, by walking down the corridor | Identifiable, whatever the export looks like | Site authorization plus a dual-role account of your access |
| Health records held by a covered entity | Depends on de-identification | Identifiable unless de-identified or a limited data set | Waiver documentation or a data use agreement |
A reading of how the criteria apply, not a determination. Which route GCU expects for a dataset is set by GCU's current doctoral handbook or IRB portal.
Which exemption do records studies usually reach for?
Two categories carry almost all of this work, and both are determinations the board issues — never statuses a candidate declares. The levels of review are assigned against the federal criteria, and a file must earn the one it asks for.
Secondary research uses of identifiable private information
45 CFR 46.104(d)(4) covers secondary uses of identifiable private information that is publicly available; or recorded in a way that leaves identity beyond ready reach; or regulated health information used under the privacy rule; or generated by federal programs on stated conditions. Note the second branch: it turns on how the investigator records the information, which is why the recording plan belongs in the application.
Educational tests, surveys, interviews and observation
46.104(d)(2) reaches existing test scores and instrument results, provided identity cannot readily be ascertained; or a disclosure beyond the study would put nobody at reasonable legal jeopardy and damage nobody's reputation, employability, educational advancement or finances; or a limited board review makes the finding the rule requires. That middle branch catches workplace and school datasets: a small-site file about performance is exactly the exposure the clause guards against.
What if the records are health records?
Then a second rulebook joins the first, and the file must satisfy both. Under 45 CFR 164.514 health information reaches de-identified status by one of two routes: a qualified expert's determination, or safe harbor, which removes eighteen classes of identifier — names, fine-grained geography, dates, contact and account numbers, network addresses, biometrics, facial photographs, any remaining unique identifier. Between them sits the limited data set: direct identifiers removed, dates and some geography retained, the recipient bound by a data use agreement forbidding re-identification.
Where identifiers genuinely must travel, 164.512(i) lets an IRB or a privacy board approve a waiver or alteration of authorization against documented criteria: minimal privacy risk, a plan to protect the identifiers and later destroy them, and findings that neither the study nor its reach into the information could realistically proceed any other way. That waiver is a separate decision from GCU's, and it usually belongs to the institution holding the chart — at which point the sequencing question becomes its own problem.
What if the records are education records?
Then the Family Educational Rights and Privacy Act frames what a school or district may release. 34 CFR 99.31 permits disclosure without consent to organizations conducting studies on the agency's behalf, under a written agreement fixing purpose and scope, restricting use to it, barring personal identification, and requiring destruction once the identifiable information is no longer needed. It also allows release of records with identifying information removed, and permits a record code — provided the code is not built from personal information and the method of generating it stays undisclosed.
The practical consequence is that the district's written agreement and the application must describe one dataset, not two. Promise the board de-identified extracts while the agreement contemplates roster-level access and the return writes itself.
What does the file actually have to show?
The four sentences the board is looking for
- Where the records came from, who holds them, and under what authority you get them.
- Exactly which fields cross to you — not which fields exist.
- Who can re-identify the people, and what document keeps that key from you.
- Where the extract will live, who else can open it, how it ends.
Where archival files most often come back
- The application says de-identified; the security plan describes a linking sheet.
- Analysis began while the determination was still pending.
- One small site makes the population identifiable whatever the export holds.
- The candidate holds the key and calls the result anonymous.
- No site authorization for the entity that owns the records.
The test every document here faces: any two pages, side by side, describe one dataset.
Is a records study genuinely a lighter file?
Lighter in places, heavier in others. No recruitment script, no consent conversation, no scheduling — but every claim about identifiability must be documented rather than asserted, and the data-security plan becomes the argument. Treat a secondary analysis as a formality and you write four paragraphs where the board wanted four exhibits, which is why our three moves put identifiability first.
What to do next
Write down who can re-identify the people in your dataset — then find the document that proves it. If none exists, that is your finding, better found here than in a board letter. Send us the AQR-approved proposal with a description of the dataset and the free application review will say where the file sits. Sometimes the honest answer is that it reads as exempt territory and is clean enough to file yourself. More of the logic sits in the answers on the record.
Sources
- GCU Research — Classroom-Based Research / Archival Data
- GCU Research — Institutional Review Board
- GCU IRB Resource Center — IRB FAQs
- 45 CFR 46.102 — Definitions
- 45 CFR 46.104 — Exempt research
- OHRP — Coded private information or biospecimens in research (via this mirrored copy)
- 45 CFR 164.514 — de-identified health data, and the limited data set
- 45 CFR 164.512(i) — Uses and disclosures for research
- 34 CFR 99.31 — FERPA: disclosure without consent
Where this article and GCU's own materials differ, GCU's current doctoral handbook or IRB portal governs. gcuirb is an independent practice and is not affiliated with, endorsed by or connected to Grand Canyon University.