Title: HIPAA
1HIPAA
- Changes to IRB Forms Procedures
- March 20, 2003
- Sheila Moore, CIP
- Office of the Institutional Review Board for
Human Use (IRB)
2What happens on April 14th?What should I do
first?
- HIPAA Privacy Policy goes into effect April 14,
2003. - Determine if your research protocol uses
protected health information (PHI) from one of
the 8 units of the covered entities.
3Units of Covered Entities
- University of Alabama Hospital
- School of Medicine
- School of Optometry
- The Childrens Hospital of Alabama
- The Kirklin Clinic
- School of Dentistry
- Callahan Eye Foundation Hospital
- Jefferson County Department of Public Health
4Does the research use PHI that is linked with any
of the following?
- Names
- Geographic Subdivisions smaller than State
- Elements of Dates (except year)
- Telephone Numbers
- Fax Numbers
- Email Addresses
- Social Security Numbers
5ContinuedDoes the research use PHI that is
linked with any of the following?
- Medical Record Number
- Health Plan Beneficiary Number
- Account Numbers
- Certificate/License Number
- Vehicle Identifiers and serial numbers
- Device Identifiers and serial numbers
- Biometric Identifiers
6ContinuedDoes the research use PHI that is
linked with any of the following?
- Web universal resource locators (URLs)
- Internet protocol address numbers
- Full-face photographic images
- Any other unique identifying number
7Protocol uses PHI from unit and use of consent
form was waived
- Has a waiver of written informed consent been
previously approved by the IRB? - If so, your protocol will be grandfathered
under the waiver rules. -
- However, at time of renewal you will need to
complete the Request for Waiver of Patient
Authorizationa new IRB form.
8Protocol uses PHI from unit and written
informed consent was required
- Determine if you will be enrolling additional
participants or requesting participants to sign
addendum consent forms after April 14, 2003. - If no consent forms will be used after April
14th, you will not need to have a HIPAA
Authorization form.
9Participants will be asked to sign consent forms
or addendum consent forms after April 14
- Prepare a HIPAA Authorization Formsee new form
in handout. - Prepare request memorandumsee sample in the
handouts. - Submit materials to the IRB office to obtain
approval of revised consent form with HIPAA
Authorization.
10Completing the HIPAA Authorization Form
- Participant Nameadded at enrollment
- Protocol Title IRB Protocol Number
- Check all units providing information
- Change revision date on all pages of consent form
- Change page numbering for entire form HIPAA
Authorization will be last page
11Complete the Request Memo
- See Handout
- Complete on Letterhead
- Include Investigator typewritten name and
Investigator SIGNATURE - Include IRB protocol number and title
- Note that only changes to be reviewed at this
time are the addition of Authorization, the
revision date and page numbers.
12IRB Open Office Hours for HIPAA Authorization
Approval Room 470 Admin. Bldg.
- March 24th 9 11
- April 1st 9 11
- April 4th 1 230
- April 7th 9 12
- April 8th 9 12
- April 9th 2 4
- April 10th 9 12
- April 11th 12 - 3
13Dont want to wait during IRB open office hours?
- You may drop your materials in the IRBs special
HIPAA mail/drop box. - Revised consent forms will be ready for pick-up
at the IRB office front desk 24 hours later.
Consent forms submitted on Friday will be ready
Monday.
14Will the IRB staff come to your
Department/Division to approve authorizations?
- Yes, if you have 20 or more consent forms that
need review, the IRB staff will come to your
office to review and approve. IRB staff will
need work space and access to a copier. You
still need to complete the request memo. - Please fax or email your request to the IRB
office to schedule a time.
15If PHI from a covered unit is used in the
research and a written consent form is used for
the study, you must have an IRB-approved
Authorization Form after April 14, 2003.
16Participants Sign Both Forms
- The Participant must sign the informed consent
document. - and
- The Participant must sign the Authorization Form.
17Is an Authorization Form always required when
using a written consent form?
- No, if the research is not conducted under the
auspices of one of the 8 units listed earlier,
you may not need an authorization. - Please check the IRB web site for updates to the
list of units that will need HIPAA Authorizations
or Waiver of Authorization.
18My protocol used PHI but it is now closed to
enrollment and has IRB approval for data analysis
or long term follow-up only. What should I do?
- Nothing for HIPAA. You do not need to submit an
Authorization form for IRB approval. However,
you need to keep your IRB approval up to date.
19New IRB FormsApproval of Waiver of
Consent/Waiver of HIPAA Authorization
- To meet HIPAA requirements the protocols for
Full, Expedited, and Exempt review have been
revised to include the HIPAA recognized
identifiers. If a waiver of HIPAA authorization
is approved by the IRB, the waiver of
authorization will be noted in the minutes and on
a new approval form (see sample).
20New IRB FormsApproval of Waiver of
Consent/Waiver of HIPAA Authorization
- Principal Investigators may continue to request
waiver of informed consent in the protocol. The
IRB will make a final determination and note
their findings in the IRB minutes and on a new
approval form which will be attached to the
current approval form.
21New IRB Forms
- PIs to begin using new forms as soon as possible
for new protocols. - Protocols in process on April 14th may be
required to complete additional information
regarding identifiers and HIPAA authorization
and/or waiver of authorization.
22Data Repositories/Databases
- Databases which contain PHI that is or will be
used for research purposes must have IRB
approval. - IRB approval of database required
- IRB approval of each research protocol utilizing
database required (amendment or separate
protocol) - IRB requires other researchers accessing the
database to obtain approval from Principal
Investigator.
23Data Repositories/Databases
- Storage of research data/information for a
specific protocol in a database does not need a
separate approval, but should be included in the
protocol.
24Data Repositories/Databases
- De-identified data repositories contain
de-identified health information - No IRB approval for de-identified database
required - IRB approval for the research/use of the data
required
25Research Recruitment
- Question A researcher wants permission from a
physician to look at UAB Hospital and Clinic
patient records and flag the records of patients
eligible for a study. Is this allowed? - Answer The researcher must request a waiver of
authorization from the IRB to conduct this
review.
26Research Recruitment
- Question A researcher wants a physician to
discuss enrollment in a trial with the
physicians patients. Is this allowed? - Answer Yes. Physicians may discuss clinical
trial enrollment with their patients without
obtaining patient authorization.
27Research Recruitment
- Question A researcher wants a physician to send
a co-signed letter to identified patients that
describes a research study and requests that the
patients contact the researcher. Is this
permissible? - Answer Yes and No. The physician may contact
the patients and request the patients to contact
the researcher, but the researcher should not
sign the letter and may not contact the patients.
28Research Recruitment
- Question A researcher wants a list of patients
who may be eligible for her research study. What
must she do to obtain this list from a physician?
- Answer The researcher must request from the IRB
a partial waiver of patient authorization to
obtain the list.
29Research Recruitment
- Question A physician provides care to a patient
who would be a good candidate for a study his
colleague is conducting. The physician wants to
tell his colleague about the patient. What must
the physician do? -
- Answer The physician must obtain a HIPAA
authorization from the patient in order to
disclose the patients health information to the
researcher.
30Research Recruitment
- Question A researcher informs a physician about
a clinical trial and asks the physician to be on
the lookout for any patients that might fit the
criteria for enrollment. Is this permissible?
- Answer Yes. The researcher may contact
physicians about clinical trials and ask the
physicians to consider whether they have eligible
patients. However, only the patients physician
may contact the eligible patients to discuss
enrollment unless and until the researcher
obtains an authorization or waiver of
authorization to contact the patients directly.
31Research Recruitment
- Question Can a researcher review the results of
clinical tests performed in the UAB Hospital,
with the purpose of contacting those patients
with a positive result to discuss enrollment in a
clinical trial? - Answer To do so, the researcher must request
from the IRB a partial waiver of patient
authorization to allow the review and patient
contact.
32Research Recruitment
- Question Can researchers obtain names from
outside parties that are not bound by HIPAA ,
such as a government agency, in order to recruit
for a trial? Can they contact the individuals? - Answer Yes. HIPAA does not apply to
recruitment of enrollees through use of
information that comes from an entity that is not
bound by HIPAA.
33Review of Forms
- Request for Waiver of HIPAA Authorization
- Authorization approval request memorandum
- HIPAA Authorization
- Approval of Waiver of HIPAA Authorization and/or
waiver of Informed Consent - Revised Full, Expedited, Exempt Protocol
documents available on IRB web site
www.uab.edu/irb/hipaa
34Questions
www.uab.edu/irb Ph 934-3789 Fax
934-1401 irb_at_uab.edu