The HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule imposes requirements on certain investigators, research organizations, and institutions who qualify as “covered entities” to obtain authorization before using or disclosing Protected Health Information (PHI) about an individual. Before a covered entity can use or disclose PHI for a research purpose, including certain recruitment activities and retrospective chart reviews, the investigator must either:
- Obtain the participant’s written authorization to use and disclose the participant’s PHI; or
- Receive approval for a waiver, in whole or in part, or an alteration of authorization.
As a matter of policy, Quorum Review IRB prefers that all new consent forms include language that satisfies the standards of the HIPAA Privacy Rule. Quorum Review IRB does not review HIPAA Authorizations that are separate from the informed consent (i.e, “stand-alone authorization”). Please note that even though Quorum Review IRB reviews HIPAA Authorization language contained within consent forms, it is the investigator’s responsibility to comply with the HIPAA Privacy Rule and any applicable state privacy laws. Investigators are encouraged to seek legal counsel to review any HIPAA Authorization language that is used to ensure that it is adequate for the investigator’s needs and satisfies state privacy laws.
In some circumstances, it may not be practical for an investigator to obtain a signed HIPAA Authorization prior to the use and disclosure of a participant’s PHI. For example:
- for research recruitment purposes, an investigator may wish to use already collected PHI in order to contact potential participants or may collect and record PHI via telephone screens before the potential research participants visit the research site (called a “Partial Waiver”)
- an investigator may desire to access PHI contained in patient medical charts for a retrospective chart review study (called a “Complete Waiver”)
- an investigator or sponsor has been approved for a waiver of documentation of consent and would also like approval to alter the requirement to obtain a signed HIPAA authorization (called an “Alteration”).
In such circumstances, an investigator or a sponsor can apply to Quorum Review IRB for a waiver or alteration of the HIPAA Privacy Rule requirements. Under the HIPAA Privacy Rule, an Ethics Review Board may approve a waiver or an alteration of the HIPAA Authorization requirement in whole or in part. The Privacy Rule permits covered entities to use and disclose PHI for research purposes without a signed HIPAA Authorization so long as an Ethics Review Board determines that specified regulatory waiver criteria are satisfied.
Quorum reviews waiver/alteration requests for recruitment activities, retrospective chart reviews, research databases, survey research and other research activities. An application form for a complete waiver, a partial waiver, or an alteration may be obtained by contacting Quorum Review IRB’s Initial Study Support Team or by visiting Quorum Review IRB’s website.
Please contact Quorum Review IRB’s Initial Study Support team with any questions regarding HIPAA waivers/alterations.