The Health Insurance Portability and Accountability Act (HIPAA) establishes the conditions under which Protected Health Information (PHI) may be used or disclosed for research purposes. HIPAA protects the privacy of individually identifiable health information while at the same time ensures that researchers continue to have access to medical information necessary to conduct research. In order to ensure compliance with HIPAA, the Institutional Review Board (IRB) must first determine whether the information is individually identifiable.
Please identify any of the types of data you are collecting for this study:
|Medical Record Numbers|
|Electronic Mail Addresses|
|Device Identifiers and Serial Numbers|
|Health Plan Beneficiary Numbers|
|Biometric Identifiers, Including Finger & Voice Prints|
|Full Face Photos & Comparable Images|
|Geographic Subdivisions Smaller Than A State|
|Vehicle Identifiers and Serial Numbers Including License Plates|
|You know that the information that is collected could be used alone or in combination with other information to identify someone|
|Any Unique Identifying Number, Characteristic or Code|
|All Elements of Date (except year) Related to An Individual; Including Dates of Admission, Discharge, Birth, Death and for Persons >89 y.o.; the Year of Birth Cannot Be Used|
If you DID identify items above, and your protocol application contains a written consent form, you are required to address issues 1-6 below in the consent form. Your responses should reside under a new heading in the consent form entitled “Authorization To Share Personal Health Information In Research” (see consent form example). The consent form will be reviewed by the IRB during their review of the protocol.
- Address what identifiable health information will be used and for what purposes.
- Provide a description of any information that will be disclosed to others and, if applicable, a list of who will disclose the information and to whom it will be disclosed.
- Provide an expiration date for the disclosure. Please note: the expiration date is for the use of the PHI by the researcher. After that date, the researcher may no longer access the data. The expiration date may be “none.”
- Include a statement that the authorization can be revoked, in writing, by the research subject. Indicate that such written document must be provided to you, the principal investigator, who will confirm in writing to the subject that their PHI has been revoked per their request. Copies of all such documentation must be provided to the IRB.
- Provide a statement that disclosed information may be re-disclosed and no longer protected. If the recipient of the disclosure has agreed to restrict its use of the data, a summary of the additional protections must be included.
- Provide a statement that if the individual does not provide an authorization, s/he cannot participate in the research.
If you DID identify items above, and your protocol application does NOT include a written consent form address questions 1-5 below. Submit your response to the IRB along with your protocol application forms. The IRB will assess whether a Waiver of Authorization (notification to the research subjects that you are using their PHI is not required) is appropriate. If appropriate, the IRB will issue you the document, Waiver of Authorization, along with the other IRB approval forms at the time of IRB approval of the study.
Please provide details of why the research could not practicably be conducted without access to and use of the PHI.
- Do you have an adequate plan to protect identifiers from improper use and disclosure? Please provide details.
- Do you have an adequate plan to destroy all identifiers at the earliest opportunity consistent with the conduct of the research? Please explain if there is a research or health justification for retaining identifiers or if retention of identifiers is otherwise required by law.
- Please provide written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law or for authorized oversight of the research project.
- Provide an expiration date for the disclosures. Please note: the expiration date is for the use of the PHI by the researcher. After that date, the research may no longer access the data. The expiration date may be “none”.