Organizational Services,Technology,Research,

Departments & Programs,UW Health,Enterprise Analytics (EA)

Requirements for Research Data Requests

Requirements for Research Data Requests - Departments & Programs, UW Health, Enterprise Analytics (EA)


In addition to submission of a request using UWHC Help Desk Self Service, copies of UW-Madison IRB research protocol, approval and/or certification documents are required for all research requests. The requested forms are required by the University for research activities and should already be completed by any staff engaged in research.

Details regarding the UW-Madison rules can be found on the following Web sites:

Request Notes

Exceptions - If you believe your research data request is not subject to these requirements, please include an explanation with your data request.

Additional Documentation Requirements for Research Requests

If your request is for:In addition to the Data Request Form, please submit:

Preparatory Information for Research Activities:


Copy of your Preparatory to Research Certification of compliance, on file with the UW-Madison Privacy Officer.




Copy of your Database Registration Form and Preparatory to Research Certification for Database Custodian, on file with the UW-Madison Privacy Officer, if the data query results will be stored in a database.

Protocol-Specific Use and Disclosure

  • chart reviews
  • subject contact or recruitment
  • clinical trials
  • etc.
  1. Copy of your IRB protocol approval notice. 
  2. Copy of your most up to date protocol or exemption application approved by the IRB.
  3. As applicable, either of the following documents:
    1. Copy of your Research Authorization form.
    2. Copy of your Waiver of Authorization.
Limited Data Set
The data you request will lack 15 of the 18 identifiers specified by the HIPAA Privacy Rule (see the full list under De-identified Data). It may include dates (e.g., date of birth, admission, and discharge dates) and some geographic information: city, state and zip code, but not street address.
UWHC can provide limited data sets without additional IRB documentation. A data use agreement that contains the provisions required by the HIPAA Privacy Rule must be made between UWHC and the researcher.

De-identified Data
The data you request will not include any of the following 18 specific identifiers specified by the HIPAA Privacy Rule:

  • names
  • geographic subdivisions smaller than a state
    all elements of dates (except year) related to an individual (including dates of admission, discharge, birth, death and, for individuals over 89 years old, the year of birth must not be used)
  • telephone numbers
  • FAX numbers
  • electronic mail addresses
  • Social Security numbers
  • medical record numbers
  • health plan beneficiary numbers
  • account numbers
  • certificate/license numbers
  • vehicle identifiers and serial numbers including license plates
  • device identifiers and serial numbers
  • web URLs
  • internet protocol addresses
  • biometric identifiers (including finger and voice prints)
  • full face photos and comparable images
  • any unique identifying number, characteristic or code
UWHC can provide de-identified data without additional IRB documentation.