Federal Policy

Northwestern university IRB HIPAA Guidance

Acceptable Recruitment Practices

Listed below are acceptable recruitment scenarios involving the use or disclosure of Protected Health Information (PHI).
With the exception of Preparatory to Research Activities, all recruitment methods must be reviewed and approved by the IRB before recruitment of any participants may begin.

NOTE: Because of the additional requirements for confidentiality under Illinois state law for sensitive information (i.e., substance abuse diagnosis or history, mental health diagnosis or history), no NU investigator or research staff member shall access sensitive medical records for the purpose of identifying prospective research participants without first consulting with the following staff at the NU affiliates:

  • NMHC (for NMH, NMG, NLFH, CDH, Delnor, CPG)

  Mary Lucie or Meghan Archdeacon
  Office of General Counsel
  Northwestern Memorial HealthCare
  (312) 926-4040


  Laurel Fleming
  Corporate Compliance & Integrity/Chief Privacy Executive
  Northwestern Memorial HealthCare
  (312) 695-9452


  • Shirly Ryan AbilityLab (SRALab)

   Laurie Tenzer
   Office of General Counsel
   Shirley Ryan AbilityLab
   (312) 238-6047

Preparatory to Research Activities:

Under the preparatory to research provisions of the Privacy Rule, NU researchers can access necessary medical records of patients from Northwestern Memorial Hospital (NMH), Northwestern Medicine affiliates, and the Shirley Ryan AbilityLab for the sole purpose of preparing for a research project, including:

  • designing a study,
  • assessing the feasibility of conducting a research study,
  • assessing whether a sufficient and appropriate participant pool exists to support the study.

When performing this activity, NU researchers are not allowed to remove any individually identifiable protected health information from the covered entity. Preparatory to research activities are not research activities and do not require prior IRB review.

Direct Recruitment:

  1. A researcher may choose to develop recruitment materials (e.g., flyers, advertisements) addressing potential participants. If interested, an individual may contact the research team directly.

  2. When the Principal Investigator (PI) is also the treating physician of the targeted participant population,

    1. The authorized research personnel of the applicable study may approach the PI's patients about participation in the study. In addition, patients of other physicians within the PI's department or clinic may be approached for participation provided this is in keeping with the organization's policies.

    2. The authorized research personnel may review their PI's clinic schedules and look for potential participants.

    3. The authorized research personnel may access these patients' medical records and record pertinent information such as contact information and medical information to assess the pre-eligibility of the potential participant.

  3. Authorized research personnel may approach a potential participant who is in the clinic or admitted to the hospital, but only after someone already known to the patient (such as the treating physician, nurse, or clinic staff) has obtained permission from the patient to be approached about the study.

Recruitment by the Healthcare Provider:

  1. A researcher may choose to prepare a form informing patients about a research study. The form will be given to the patients by their health care provider. If patients want to obtain more information about a study, they complete the form (i.e., provide their name and contact information) and return it to the clinical team. The clinical team provides the research team with the completed forms. In this case, the clinical team acts as a "courier".

Recruitment "on behalf" of the healthcare provider (only allowed under an NU Business Associate Agreement with NMH, affiliates, and the Shirley Ryan AbilityLab):

  1. A researcher may ask a treating physician for a list of his/her patients who might be interested in participating in a specific research study. If the physician agrees, he/she may provide contact information (e.g., address, phone number) and other necessary medical information (e.g., age, diagnosis, history of medication use) for the researcher to select patients to be contacted "on behalf of" the clinician.
  2. The researcher may ask a treating physician for permission to access a listing of his/her patients to identify potential participants and access medical records to determine if these individuals would be eligible. The researcher may only copy the minimal information needed to contact the patient (i.e., name, address, phone number) and to assess his eligibility for the research study (e.g., age, diagnosis, medical history).  
  3. The researcher may create and send a letter to potential participants, pursuant to steps 1 and 2 above and approval by the treating physician. The letterhead of the respective institution must be used and any specific procedures required by each organization must be followed.

    The letter should state that the patient is being contacted "on behalf" of his/her physician. The purpose of this letter is to inform people about a study and ask them to call the researcher. The letter should specify if the researcher will follow-up with a phone call. Generally, the IRB limits contact to about 3 attempts.

    Researchers may NOT call the person directly, without previously mailing out a letter.

HIPAA Privacy Officers

Northwestern Memorial HealthCare Clinical Affiliates
   Laurel Fleming
   Director, Corporate Compliance & Integrity/Chief Privacy Executive
   Northwestern Memorial HealthCare

Shirley Ryan AbilityLab (SRALab)
   Leyla Erkan
   Corporate Compliance & Privacy Officer
   Shirley Ryan AbilityLab
   (312) 238-7032