The HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule imposes requirements on certain investigators, research organizations, and institutions who qualify as "covered entities" to obtain authorization before using or disclosing Protected Health Information(PHI) about an individual. Before a covered entity can use or disclose PHI for a research purpose, including certain recruitment activities and retrospective chart reviews, the investigator must either: 1) obtain the participant's written authorization to use and disclose the participant's PHI; or 2) receive approval for a waiver, in whole or in part, or an alteration of authorization.
As a matter of policy, Quorum Review IRB prefers that all new consent forms include language that satisfies the standards of the HIPAA Privacy Rule. Quorum Review IRB does not review HIPAA Authorizations that are separate from the informed consent (i.e, "stand-alone authorization"). Please note that even though Quorum Review IRB reviews HIPAA Authorization language contained within consent forms, it is the investigator's responsibility to comply with the HIPAA Privacy Rule and any applicable state privacy laws. Investigators are encouraged to seek legal counsel to review any HIPAA Authorization language that is used to ensure that it is adequate for the investigator's needs and satisfies state privacy laws.
HIPAA Waivers/Alterations
In some circumstances, it may not be practical for an investigator to obtain a signed HIPAA Authorization prior to the use and disclosure of a participant’s PHI. For example:
- for research recruitment purposes, an investigator may wish to use already collected PHI in order to contact potential participants or may collect and record PHI via telephone screens before the potential research participants visit the research site (called a "Partial Waiver")
- an investigator may desire to access PHI contained in patient medical charts for a retrospective chart review study (called a "Complete Waiver")
- an investigator or sponsor has been approved for a waiver of documentation of consent and would also like approval to alter the requirement to obtain a signed HIPAA authorization (called an "Alteration").
In such circumstances, an investigator or a sponsor can apply to Quorum Review IRB for a waiver or alteration of the HIPAA Privacy Rule requirements. Under the HIPAA Privacy Rule, an Ethics Review Board may approve a waiver or an alteration of the HIPAA Authorization requirement in whole or in part. The Privacy Rule permits covered entities to use and disclose PHI for research purposes without a signed HIPAA Authorization so long as an Ethics Review Board determines that specified regulatory waiver criteria are satisfied.
Quorum reviews waiver/alteration requests for recruitment activities, retrospective chart reviews, research databases, survey research and other research activities. An application form for a complete waiver, a partial waiver, or an alteration may be obtained by contacting Quorum Review IRB's Initial Study Support Team or by visiting Quorum Review IRB's website.
Please contact Quorum Review IRB's Initial Study Support team with any questions regarding HIPAA waivers/alterations.
As Indicated
F-044 - Request for Waiver or Alteration of HIPAA Authorization Requirement
This form should be used when a covered entity (research site/Principal Investigator) or a sponsor seeks to waive, in whole or in part, the requirement to obtain an Authorization before using or disclosing protected health information or to request an alteration to the required elements of Authorization (such as the removal of the requirement to obtain a signature).
Guidance
G-043 - Handbook for Quorum Review IRB (Requires an OnQ Portal Account)
The Handbook provides a guide for using Quorum Review IRB as an ethics review board. It contains policies, procedures, and guidelines to be used in preparing materials for Board review, as well as information on managing ongoing research activities, continuing and periodic review, and closing.
HIPAA Waivers/Alterations
Q. How do I submit a HIPAA Waiver/Alteration to Quorum? >>
Quorum accepts HIPAA Waiver/Alteration Requests via the OnQ Portal, email to our Initial Study Support team, fax, or mail.
Quorum Review
Initial Study Support Team
1601 Fifth Ave., Ste. 1000
Seattle, WA 98101
Fax: 206-448-4193
InitialStudySupport@quorumreview.com
Q. What is the difference between a complete waiver and a partial waiver? >>
A complete HIPAA waiver allows an investigator to use and disclose PHI for a particular research trial or activity without obtaining either a verbal or written authorization from the participants. A partial HIPAA waiver allows an investigator to obtain, use, and/or disclose PHI for one specified portion of a research trial or activity (e.g., in the course of recruitment) without first obtaining a verbal or written authorization.
Q. What is an alteration of an authorization? >>
An alteration allows an investigator to have any of the 6 specific core elements or 3 required statements removed from the requirement of HIPAA authorization. For example, a study has been approved with a waiver of documentation of consent. In order for participants to not have to sign an authorization, the investigator or sponsor will need to request an alteration in order to remove the HIPAA requirement to obtain the signature of the individual and date.
Q. Which form should I complete if I want to submit a HIPAA Waiver or Alteration? >>
A request for a complete waiver, a partial waiver, or an alteration is completed on all one form: the Request for Waiver or Alteration of HIPAA Authorization Requirement.
Q. A waiver or alteration was approved at the sponsor protocol level. Can any investigator that is a covered entity rely on this or do individual investigators need to seek their own? >>
IRBs and Privacy Boards coexist. Therefore, the HIPAA Privacy Rule allows a covered entity to use or disclose PHI based on an authorization or alteration approved by any IRB or Privacy Board, without regard to the location or affiliation of the IRB or Privacy Board. An investigator that is a covered entity has the right to rely on any IRB’s or Privacy Board’s documentation granting a waiver or alteration of the Authorization requirement so long as the documentation is proper. However, please note that if you are an investigation that is affiliated with an institution or hospital, they may require review and approval of any waiver/alteration before allowing the use or disclosure of PHI held by that institution or hospital.
Q. Who should I contact if I have questions about completing the HIPAA waiver request? >>
Our Initial Study Support team should be contacted with any questions regarding a HIPAA waiver requests. They can be reached by phone at (206) 448-4082 or by email at InitialStudySupport@quorumreview.com.
HIPAA and Recruitment
Q. When might I need a partial waiver for recruitment purposes? >>
An investigator may need to obtain, use, or disclose PHI in the course of recruitment activities without first obtaining a written authorization. For example: an investigator wants to conduct telephone screens of potential study participants who are responding to an advertising campaign; an investigator (who is not a member of the workforce of the covered entity) wishes to record PHI obtained from patient charts and then contact those patients to determine if they may be interested in enrolling in the research. Quorum Review IRB encourages investigators to seek partial waivers in conjunction with such recruitment activities.
Q. What is Quorum's policy on cold calls for recruitment? >>
Quorum Review IRB discourages investigators from recruiting participants with "cold calls" based on information derived from the medical records of another practitioner when the investigator has no prior relationship with the recruits. Instead, Quorum Review IRB recognizes the ability of a practitioner to discuss with his or her own patient the possibility of participating in clinical research studies. When an investigator seeks a HIPAA waiver/partial waiver for recruitment activities that include "cold calls" to potential recruits, Quorum Review IRB prefers that potential recruits be contacted only by individuals who have been actively involved in providing health care to the potential recruits.
Q. Are there any state law considerations in regard to HIPAA and recruitment? >>
An investigator must proceed with recruiting carefully in light of the HIPAA Privacy Rule as well as state laws that may prohibit the release of PHI without written authorization. Some states may not allow an exception to confidentiality laws for purposes of recruitment into a research study. This is true even though the federal HIPAA Privacy Rule technically allows partial waivers for recruitment purposes.
HIPAA and Consenting
Q. Does Quorum review standalone HIPAA documents? >>
No. Aside from HIPAA Authorizations incorporated into consent forms (i.e. “blended consent”) and HIPAA waiver/alteration requests, Quorum Review IRB will not review HIPAA compliance documents developed by the investigator. This includes stand-alone HIPAA authorizations.
Q. My Quorum consent form does not have a section on HIPAA. Do I need to have participants sign a separate HIPAA document? >>
If the model consent does not contain a HIPAA section, your site needs to present a HIPAA authorization according to your site’s requirements. The Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) requires investigators who are "covered entities" to obtain a HIPAA Authorization from each participant in a research trial. Obtaining a HIPAA Authorization from a research participant allows the investigator to use and disclose the participant’s protected health information (PHI) for research purposes.
Q. I am not a covered entity. Do I have to obtain authorization or request a waiver/alteration under the HIPAA Privacy Rule? >>
If you have determined that you (as a researcher) and/or your site is not a covered entity and documented this analysis, you are not subject to the HIPAA Privacy Rule. However, state laws concerning confidentiality and disclosure of PHI, medical information, medical records, and/or genetic information will still apply. You are responsible for complying with any applicable state laws. Investigators are encouraged to seek legal counsel in order to ensure that he/she is in compliance with applicable state laws.
