Umbrella & Outcome Protocols: Scope

Multiple faculty members can contribute and should be listed as key personnel; but one PI must take ultimate responsibility for the studies covered by the umbrella protocol. Umbrella protocols are generally only appropriate for minimal risk research, though exceptions may be made on a case-by-case basis.

While umbrella protocols often use data from research repositories, these protocols do not serve the same purpose. Research repositories store and share data for other researchers’ studies that have their own protocol. Umbrella protocols allow investigators to conduct research under the umbrella protocol itself. See Research Registries and Repositories for more information.

The umbrella protocol must be detailed enough for the IRB to assess risks and understand all procedures. Protocols that pull data from various sources (PACS, registries, department databases, or QI/QA databases) must describe those sources in detail. Protocols that pull data from other research studies must include the study number, and may only pull data from research studies that include sharing of data for other research projects.

The application should describe the process investigators will follow when requesting to conduct a research project under the umbrella protocol, and when requesting access to data or specimens that are specific to their research question, including:

• How investigators will request data or specimens.
• Whether data requests are reviewed by the PI or a committee to determine if the project fits under the parameters of the umbrella application.
• If multiple data sources are required, who will merge the data into one data set for that project before it is delivered to the investigator.
• Who will maintain the link to the identifiers, the person distributing the data or the PI. The IRB generally expects that data and specimen recipients conducting studies under the umbrella protocol will not have access to direct identifiers. Exceptions will require justification.

A list of projects conducted under the umbrella protocol and a description of each must be retained by the PI and made available to the IRB during post-approval monitoring inspections. This includes all study-specific records and analyses that are conducted in accordance with the procedures and provisions described in the approved umbrella protocol.

Examples of the types of studies for which an umbrella protocol may be appropriate:

• Research within a department using diagnostic imaging and image guided procedures that are performed for clinical purposes to gather pilot data to test hypotheses for improvements in imaging techniques.
• Research within a department using archived samples and relevant clinical data that are acquired as part of a patient’s clinical care to correlate pathology findings with clinically reported outcomes.
• Research within a division using data from a QA/QI or departmental database for purposes of evaluating outcomes of patients with a particular disease or condition in a specific clinic or who receive a certain type of care (e.g., a specific surgery). This kind of umbrella protocol (also called outcomes analyses) can be submitted using the “Health care records research only” application type within the nPBA.

Both the protocol-based application (PBA) and nPBA may be used for other umbrella protocols that are not outcomes analyses. For more information on databases requiring IRB review, see: Research Registries and Repositories.

Changes of protocol must be submitted for the following:

• Addition of new study populations
• Significant changes to study length
• Addition of new study procedures
• Any change in study procedures, compensation, time to completion, etc., requiring a revision to the informed consent form
• Change in PI

There is no limit to the number of studies conducted under an umbrella protocol, but the IRB may decide that a new application must be opened when the application has undergone a large number of changes or the application is long-standing and was approved prior to changes in regulations or policy.

Umbrella applications cannot serve as a data source for other studies. Investigators should not “share back” their results to be collated in one place. Data from the individual projects should not be kept for future research; it would be challenging to track these projects and the PI is responsible for tracking every project done under this application.

Link to this section

What Should Not Be Submitted as an Umbrella Protocol

The following types of studies are NOT appropriate for an umbrella protocol without a specific IRB exception:

• A single umbrella protocol covering an entire department’s work or spanning the work of multiple faculty members’ labs.
• Those with populations subject to additional protections under federal regulations (children, prisoners, pregnant participants, fetuses).
• Federally funded projects (including the Department of Defense) should be submitted under their own protocol to meet additional federal agency requirements.
• Studies that are FDA regulated. This includes studies seeking a non-significant risk (NSR) determination for a device, and those that validate the safety or efficacy of AI algorithms that meet the definition of a medical device.
• Protocols that are clinical trials and require submission of data to CT.gov.
• Multi-site studies where data will be received from or disclosed to other collaborating sites (this does not include sites like Meriter or ACHC where UW faculty treat patients.
• VA regulated studies.
• Studies using data subject to additional state and federal laws, such as HIV test results and substance use disorder records covered by 42 CFR Part 2. These studies are subject to additional legal requirements that can be more difficult to ensure are met under an umbrella protocol.

Link to this section