Duke Alert Bar

Duke Privacy for Research

Campus Institutional Review Board

The campus Institutional Review Board (IRB) staff are available to help navigate the process for submitting research protocols to the Campus IRB.  In addition to guiding you through the research process, IRB staff provide one-on-one consultations to faculty and students, and are available to provide training, seminars, and workshops.


Section 164.514(a) of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides the standard for de-identification of protected health information (PHI).  Under this standard, health information is not individually identifiable if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual.

§164.514.  Other requirements relating to uses and disclosures of protected health information

Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.

Sections 164.514(b) and(c) of the Privacy Rule contain the implementation specifications that a covered entity must follow to meet the de-identification standard.  As summarized in the figure below, the Privacy Rule provides two methods by which health information can be designated as de-identified:

Two methods to achieve de-identification in accordance with the HIPAA Privacy Rule

Satisfying either method will demonstrate that a covered entity has met the standard in Section 164.514(a).  De-identified health information created following these methods is no longer protected by the Privacy Rule because it does not fall within the definition of PHI.

Expert Determination

A covered entity may determine that health information is not individually identifiable health information only if:

A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:

      (i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and

      (ii) Documents the methods and results of the analysis that justify such determination

Safe Harbor

The following identifiers of the individual or of relatives, employers or household members of the individual are removed:

1. Names

2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census:

      (a) The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and

      (b) The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000

3. All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older

4. Telephone numbers

5. Vehicle identifiers and serial numbers, including license plate numbers

6. Fax numbers

7. Device identifiers and serial numbers

8. Email addresses

9. Web Universal Resource Locators (URLs)

10. Social Security numbers

11. Internet Protocol (IP) addresses

12. Medical record numbers

13. Biometric identifiers, including finger and voice prints

14. Health plan beneficiary numbers

15. Full-face photographs and any comparable images

16. Account numbers

17. Any other unique identifying number, characteristic or code

18. Certificate/license numbers

Duke Office of Clinical Research (DOCR)

DOCR provides support for principal investigators (PIs), study coordinators and members of the Clinical Research Units (CRUs) at Duke.

DUHS Institutional Review Board (IRB)

The mission of the Duke Health IRB is to ensure the protection of human research subjects by conducting scientific and ethical review of research studies while providing leadership and education for the research community.  Its scope includes the Common Rule, Federal Drug Administration (FDA)-regulated studies, and HIPAA as it applies to research in Duke Health.

Duke University Research

This central resource for Duke University researchers includes links to funding opportunities, research leadership contacts and the latest news on research at Duke.


This office provides face-to-face service for all aspects of the IRB approval and submission process.  Any researchers who wish to meet with an IRB staff member at ORS West, please email campusirb@duke.edu to schedule an appointment.


myRESEARCHhome provides a single location for research-related tasks and information, putting relevant applications, resources and information specific to researchers and their projects in easy reach.  It can be personalized even further to save time and effort.

Office of Research Contracts (ORC)

ORC supports Duke University School of Medicine (SOM) and School of Nursing (SON) research and educational efforts by drafting, reviewing, negotiating, signing and performing certain administrative functions regarding agreements with external industry, non-profit/foundation and government entities for the funding and conduct of clinical and non-clinical research and Continuing Medical Education (CME) and non-CME educational programs.  ORC additionally supports all Duke faculty in establishing appropriate documentation for exchanges of research materials, confidential information, data, technical know-how and equipment in support of research across the university.

ORC negotiates its research agreements to be consistent with academic standards and Duke policies, National Institutes of Health (NIH) guidelines, applicable federal and state laws, and applicable Internal Revenue Service (IRS) regulations relating to Duke’s status as a not-for-profit organization.  ORC advises faculty on matters arising from these agreements, particularly publication rights, intellectual property rights, confidentiality obligations, human subjects protections and liability issues.

Office of Research Informatics (ORI)

ORI is a comprehensive research hub that combines information technology (vended system selection, custom software development, technical and user support, system integration), academic informatics, research faculty and curriculum development, as well as data stewardship.

The ORI mission is to create and support the world’s leading research infrastructure, including a cohesive portfolio of useful and user-driven applications that realize the Integrated Research Home as well as support the Duke Health Learning Health and Personalized Health visions.

Duke University Office of Research Support (ORS)

The campus Human Subjects Protections Program works with investigators to protect the rights and welfare of research participants.  Program staff will pre-review submissions to the IRB for Non-Medical Research, providing feedback, consultation and interpretation of applicable regulations.  Program staff also offer seminars about research ethics and the IRB review process for undergraduate and graduate students.

Reporting Research Concerns

Any concerns related to human research, animal research, conflict of interest, research misconduct, research financial accounting, research safety or other research compliance matters can be reported through the Integrity Line:  1-800-826-8109.

The Integrity Line is a telephone hotline open 24 hours a day, 365 days a year.  You can call the hotline to report a concern without giving your name.  Your call will not be traced.  If you want to leave your name to help answer questions about the situation, your confidentiality will be protected to the extent the law allows.

Social Science Research Institute (SSRI) Protected Research Data Network (PRDN)

The SSRI PRDN is designed to accommodate the growing sensitive data needs of the Duke social science research community.  This collaboration taps expertise in Office of Information Technology (OIT), IT Security Office (ITSO) and SSRI to create a space that researchers will find useful for projects requiring a high level of security.

The foundational layer for the SSRI PRDN is the Duke Data Classification Standard.  ‘Sensitive’ data is anything Duke has to protect in specific ways due to legislation, regulation or contracts.  So all research or corporate data which come with a Data Use Agreement (DUA) or Digital Signal Processing (DSP) is sensitive, by the Duke standard.

Undergraduate Research with Human Subjects

Are you interested in conducting an undergraduate research project?  Before you begin research with human subjects, you must obtain written approval from the non-medical IRB, which can also assist you with the process.

Undergraduate Research Support Office

Students conducting undergraduate research make original intellectual or creative contributions to a discipline – from art history to economics to biology.  Your contribution may be large, such as a new discovery or game-changing way of thinking in that discipline.  Or it may be more modest, an extension of existing ideas that broadens our knowledge or deepens the practice of the field.  But, as long as you are asking questions using the methodologies of the discipline, it is ‘research.’