HIPAA GENERAL OPERATING POLICY #22
USES AND DISCLOSURES FOR RESEARCH PURPOSES
I. In General
Except as otherwise provided in HIPAA General Operating Policies 8, 44 and 45, a HCC may use or disclose PHI for research which has been approved by an IRB, regardless of the source of funding of the research, provided that:
a. The HCC obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization for use or disclosure of PHI has been approved by an IRB.
b. The HCC obtains from the researcher representations that:
i. Use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;
ii. No PHI is to be removed from the HCC;
iii. The PHI is necessary for the research purpose; and
iv. The research has been approved by an IRB.
c. The HCC obtains from the researcher:
i. Representation that the use or disclosure sought is solely for research on the PHI of decedents;
ii. Documentation at the request of the HCC of the death of such individuals;
iii. Representation that the PHI is necessary for the research purposes; and
iv. The research has been approved by an IRB.
II. Documentation of Waiver
For a use or disclosure to be permitted based upon documentation of approval of an alteration or waiver of authorization, the documentation must include all of the following:
a. A statement identifying the IRB and the date on which the alteration or waiver of authorization was approved;
b. A statement that the IRB has determined that the alteration or waiver, in whole or in part, of authorization satisfies the following criteria:
i. The use or disclosure of PHI involved no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
1. An adequate plan to protect the identifiers from improper use and disclosure;
2. An adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research, unless there is a research justification for retaining the identifiers or such retention is otherwise required by law; and
3. Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure would be permitted by the Privacy regulations.
ii. The research could not practicably be conducted without the waiver or alteration; and
iii. The research could not practicably be conducted without access to and use of the PHI.
c. A brief description of the PHI for which use or access has been determined to be necessary by the IRB or privacy board;
d. A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures as follows:
i. An IRB must follow the requirements of the Common Rule.
e. The documentation of the alteration or waiver of authorization must be signed by the chair or other member, as designated by the chair, of the IRB, as applicable.
III. Additional Requirements
A person conducting research or a clinical trial may not identify any individual in any report arising from the research or clinical trial. PHI disclosed pursuant to this policy that identifies an individual must be returned to the HCC from which it was obtained or must be destroyed when it is no longer required for the research or clinical trial.
Revised: 09/04/03