Evaluating Your HIPAA Authorization Template and Procedures

Institutional Bulletin vol 4,  issue 2

gavel_folderAlthough the HIPAA/HITECH Omnibus Final Rule was effective in March of 2013, the changes relating to research are worth reviewing- particularly if you or your organization is involved with research that proposes to store information for future research. The new HIPAA rule offers flexibility that it is intended to alleviate administrative burdens on researchers and subjects and harmonize with the Common Rule documentation requirements.

Compound Authorizations

Under the previous HIPAA rule – when individuals were asked to take part in a study that had an optional component (for example banking of tissue, or additional pharmacogenomics analysis) – it was not allowable to combine the authorization for the main study and that optional component. Instead individuals should have been presented with two separate authorizations: one for the required part of the study (the “conditioned authorization” and one for the optional parts of the study (the “unconditioned authorization”). This was logistically problematic in that it was confusing and created additional paperwork. It also conflicted with the Common Rule informed consent requirements which allow individuals to consent to all aspects of a study in a single document.

Under the new HIPAA rule, a single authorization can address both required and optional parts of a study as long as there is clear delineation between the “conditioned” and “unconditioned” components of the research, and the subject is given the option to participate in the unconditional activities.

It is important to note that the rule allows covered entities, researchers, and IRBs discretion with respect to the documentation of the decisions related to optional aspects of the research. The consent could have an additional signature line, check-boxes, or initial lines, for example. One option that was explicitly not allowed under the rule is an “opt out” provision, for example: “check this box if you do not want to participate in the sub-study”. HHS explains that this approach does not allow individuals to clearly affirmatively authorize the optional part of the research and could be considered coercive.

Specificity Requirements

Another important change relates to the scope of an authorization. Under the previous HIPAA rule, authorizations were required to be specific and individuals could not authorize unspecified future research using their information. Again, this interpretation conflicted with the Common Rule standards related to consent.


The 2013 Final Rule does not require an authorization to be specific, rather an authorization must include a description of each purpose of the requested use or disclosure in such a way that it would be reasonable to expect the individual should understand that their PHI could be used and disclosed for such future research. As with the change related to compound authorizations, HHS gives discretion to covered entities, researchers, and IRBs as to how to adequately describe future research. Another important note is that HHS indicated covered entities and researchers could rely on IRB-approved consent forms that were obtained prior to the effective date of the final rule – if the consent form reasonably informed an individual about the future research and was combined with a HIPAA-compliant authorization.

These changes offer enhanced efficiencies and facilitation of research initiatives. It is important to ensure that your policies, procedures, and forms reflect these changes to take full advantage of these updates.

Did you know?

Quorum Review IRB meets the requirements to serve as a Privacy Board in the event your organization does not have one. We can review requests to waive or alter the requirement of a HIPAA authorization. Email us for more information about this special service or complete our contact form.

Tags: , , , , , , , ,