To govern secondary use of ABA records PHI deidentified data and research data, classify the data, holder, entity, source, original purpose, proposed use, identifiability, linkage, and recipient. Obtain the authorized research and privacy determinations before access. Record authorization, waiver, preparatory-review, decedent, de-identification, or other valid route as applicable, plus minimum fields, security, sharing, retention, withdrawal effects, and downstream restrictions.

Define Darius's governed activity and unit

Secondary use is a new governed purpose with its own authority, data boundary, provenance, access, and end state even when the records already exist. Teams asking how to govern secondary use of ABA records PHI deidentified data and research data need the exact activity, people, purpose, design, data, site, sponsor, funding, institutional scope, authority, current version, participant protections, and unresolved facts before work begins.

Build Darius's research-data use register

Darius creates fields for proposal, data owner, HIPAA entity status, source system, record population, dates, direct and indirect identifiers, small cells, linkage keys, original permissions, Common Rule determination, HIPAA authorization or permitted alternative, data-use agreement, recipient, minimum data, environment, access list, export, coding, de-identification method, residual risk, repository, reuse, publication, return of results, withdrawal effect, retention, deletion, incident route, and closure evidence. Synthetic data records provenance and tests against leakage from real records.

Protect participants and ordinary care in Darius's workflow

Darius's eighteen proposed record reviews, linkages, analyses, repositories, and external data transfers must preserve client dignity, ordinary clinical access, voluntary choice, privacy, communication and AAC, authorized decision-making, safety response, equitable treatment, complaints, and freedom from retaliation. A research label, consent signature, payment, supervisor approval, or publication goal cannot expand a role or erase a required protection.

Work through Darius's fictional example

Darius reviews 18 proposals. Twelve clear institutional, privacy, minimum-data, security, and recipient gates. Two need narrower fields, one needs a documented waiver route, one has an unsafe linkage key, one lacks recipient terms, and one synthetic set cannot prove its provenance. Six remain held or revised. Preserve every proposed, classified, reviewed, approved, exempted, enrolled, changed, reported, published, corrected, held, withdrawn, and closed state with its original version, owner, date, conditions, and validation.

Use Darius's denominator carefully

Initial data-release readiness is 12 of 18, or 66.7%. The six affected proposals remain in the original cohort. Record count, participant count, fields, files, releases, analyses, and publications are different units.

Assign Darius's decisions to authorized owners

Darius inventories facts and enforces approved access. The institution or IRB determines research status. The covered entity or privacy owner decides the HIPAA route. Qualified experts make any formal de-identification determination. Data owners, security, counsel, and investigators act within their documented authority.

Address Darius's main interpretation risk

Removing names may leave dates, rare traits, locations, small cells, free text, images, or linkage keys that identify a person. Combining records can increase rather than reduce disclosure risk.

Verify Darius's research control in practice

Darius tests a sample from source through approved query, transfer, access, analysis, publication, retention, and deletion. Reviewers attempt prohibited joins and confirm that logs, contracts, and technical controls match the approved data path.

Place Darius's project inside organizational accountability

Darius's research-data use register uses the CASP Organizational Guidelines public overview only for high-level business, clinical-operations, and risk-management scope in autism service organizations. CASP sells the detailed guidelines. The workflow here is Finni's editorial governance model, not a CASP research protocol, regulatory determination, or institutional approval.

Apply the BACB research duties to Darius's covered roles

Darius's role review uses the current BACB Ethics Code, which applies to BCBA and BCaBA certificants and people who completed an application. Its research section addresses applicable review, participant welfare, informed consent, confidentiality, competence, conflicts, integrity, authorship, publication, and corrections. BACB has no separate organization or corporation jurisdiction, so institutional and legal controls remain necessary.

Anchor Darius's federal scope to the current HHS rule

Darius's federal analysis starts with the HHS 45 CFR 46 page, reviewed in February 2025, which identifies the 2018 Requirements and added subparts for specified populations. Applicability depends on funding, conduct, assurance, institution, activity, and other facts. The page is an authoritative starting point, while the current rule and responsible institution control the determination.

Use the OHRP decision charts as aids for Darius

Darius's reviewer may use the OHRP 2018 Requirements decision charts to organize research, human-subject, exemption, continuing-review, and consent-waiver questions. OHRP calls the charts generalizations and directs users to the full applicable text. They support intake and discussion; they do not authorize an investigator to self-approve a project.

Classify quality improvement carefully for Darius

Darius's project label follows the OHRP Quality Improvement Activities FAQs. OHRP explains that intent to publish is insufficient to decide whether QI is research and that some QI can be nonexempt human-subjects research. Purpose, design, activity, coverage, and an authorized determination matter more than the label chosen by the project team.

Separate HIPAA research permission for Darius

Darius's privacy review uses HHS research guidance under HIPAA, which explains that covered entities may use or disclose PHI for research with individual authorization or through limited rule-defined paths without authorization. Common Rule consent, IRB action, HIPAA authorization or waiver, data-owner approval, and contract terms remain separate decisions even when one document combines information.

Treat informed consent as a process for Darius

Darius's communication plan draws on the OHRP Informed Consent FAQs. OHRP flags that the FAQ predates the 2018 Requirements and 2024 conforming changes, while retaining general nonbinding guidance. Use the current regulation and review decision. The FAQ describes prospective, legally effective, voluntary information exchange with questions and a real choice to join, continue, or withdraw.

Apply child-research requirements precisely for Darius

Darius's child-participant route uses current 45 CFR 46 Subpart D, amended in October 2024. The IRB determines adequate provisions for parental or guardian permission and for child assent when the child is capable, subject to the rule's conditions and possible waivers. Clinical assent policies and research assent determinations should be recorded separately.

Distinguish adverse events and unanticipated problems for Darius

Darius's incident logic uses OHRP guidance on unanticipated problems and adverse events. The guidance explains that only a subset of adverse events are unanticipated problems and describes unexpectedness, relation or possible relation, and increased risk as the three-part analysis. Use the current protocol, institution, and rules for actual reporting decisions and deadlines.

Scope research-misconduct handling for Darius

Darius's integrity route recognizes the 2024 final rule revising 42 CFR Part 93. The rule became effective January 1, 2025, and its regulatory requirements apply beginning January 1, 2026, to covered Public Health Service research-misconduct matters. Allegations received before that applicability date generally follow the 2005 rule unless the institution and respondent elect the new rule in writing. The current rule addresses fabrication, falsification, and plagiarism and excludes honest error or differences of opinion. Other sponsors, institutions, journals, employers, and laws can use different processes; preserve allegations as allegations until the authorized process decides them.

Make Darius's participation process accessible

Darius's access plan uses DOJ effective-communication guidance for covered title II or title III entities. The appropriate aid or service depends on the interaction's nature, length, complexity, context, and the person's usual communication method. Apply the actual entity and rule, preserve AAC and authorship, and test consent, recruitment, questions, incident notices, and withdrawal routes in the formats participants use.

Choose Darius's next review trigger

Review after new fields, linkage, recipient, site, cloud service, repository, publication, participant request, breach, reidentification signal, retention end, or purpose change. Record the changed fact, affected people and records, immediate protection, governing source, decision owner, reporting or amendment route, deadlines, communication, and validation result.

Close Darius's record with accountable evidence

Review the research-data use register with Darius, investigators, qualified clinicians, the institution or reviewing body, participant representatives as applicable, and the specialists named in the manifest. Confirm that service, QI, evaluation, research, review, consent, privacy, safety, data, employment, authorship, publication, and misconduct routes remain distinct; all conditions are traceable; access is tested; and unresolved work has an accountable endpoint. Keep this page draft and noindex until every required review is complete.

Related resources

Sources