HIPAA - PowerPoint PPT Presentation

1 / 34
About This Presentation
Title:

HIPAA

Description:

Determine if your research protocol uses protected ... School of Dentistry. Callahan Eye Foundation Hospital. Jefferson County Department of Public Health ... – PowerPoint PPT presentation

Number of Views:104
Avg rating:3.0/5.0
Slides: 35
Provided by: smo11
Learn more at: https://www.uab.edu
Category:
Tags: hipaa

less

Transcript and Presenter's Notes

Title: HIPAA


1
HIPAA
  • Changes to IRB Forms Procedures
  • March 20, 2003
  • Sheila Moore, CIP
  • Office of the Institutional Review Board for
    Human Use (IRB)

2
What happens on April 14th?What should I do
first?
  • HIPAA Privacy Policy goes into effect April 14,
    2003.
  • Determine if your research protocol uses
    protected health information (PHI) from one of
    the 8 units of the covered entities.

3
Units of Covered Entities
  • University of Alabama Hospital
  • School of Medicine
  • School of Optometry
  • The Childrens Hospital of Alabama
  • The Kirklin Clinic
  • School of Dentistry
  • Callahan Eye Foundation Hospital
  • Jefferson County Department of Public Health

4
Does the research use PHI that is linked with any
of the following?
  • Names
  • Geographic Subdivisions smaller than State
  • Elements of Dates (except year)
  • Telephone Numbers
  • Fax Numbers
  • Email Addresses
  • Social Security Numbers

5
ContinuedDoes the research use PHI that is
linked with any of the following?
  • Medical Record Number
  • Health Plan Beneficiary Number
  • Account Numbers
  • Certificate/License Number
  • Vehicle Identifiers and serial numbers
  • Device Identifiers and serial numbers
  • Biometric Identifiers

6
ContinuedDoes the research use PHI that is
linked with any of the following?
  • Web universal resource locators (URLs)
  • Internet protocol address numbers
  • Full-face photographic images
  • Any other unique identifying number

7
Protocol uses PHI from unit and use of consent
form was waived
  • Has a waiver of written informed consent been
    previously approved by the IRB?
  • If so, your protocol will be grandfathered
    under the waiver rules.
  • However, at time of renewal you will need to
    complete the Request for Waiver of Patient
    Authorizationa new IRB form.

8
Protocol uses PHI from unit and written
informed consent was required
  • Determine if you will be enrolling additional
    participants or requesting participants to sign
    addendum consent forms after April 14, 2003.
  • If no consent forms will be used after April
    14th, you will not need to have a HIPAA
    Authorization form.

9
Participants will be asked to sign consent forms
or addendum consent forms after April 14
  • Prepare a HIPAA Authorization Formsee new form
    in handout.
  • Prepare request memorandumsee sample in the
    handouts.
  • Submit materials to the IRB office to obtain
    approval of revised consent form with HIPAA
    Authorization.

10
Completing the HIPAA Authorization Form
  • Participant Nameadded at enrollment
  • Protocol Title IRB Protocol Number
  • Check all units providing information
  • Change revision date on all pages of consent form
  • Change page numbering for entire form HIPAA
    Authorization will be last page

11
Complete the Request Memo
  • See Handout
  • Complete on Letterhead
  • Include Investigator typewritten name and
    Investigator SIGNATURE
  • Include IRB protocol number and title
  • Note that only changes to be reviewed at this
    time are the addition of Authorization, the
    revision date and page numbers.

12
IRB Open Office Hours for HIPAA Authorization
Approval Room 470 Admin. Bldg.
  • March 24th 9 11
  • April 1st 9 11
  • April 4th 1 230
  • April 7th 9 12
  • April 8th 9 12
  • April 9th 2 4
  • April 10th 9 12
  • April 11th 12 - 3

13
Dont want to wait during IRB open office hours?
  • You may drop your materials in the IRBs special
    HIPAA mail/drop box.
  • Revised consent forms will be ready for pick-up
    at the IRB office front desk 24 hours later.
    Consent forms submitted on Friday will be ready
    Monday.

14
Will the IRB staff come to your
Department/Division to approve authorizations?
  • Yes, if you have 20 or more consent forms that
    need review, the IRB staff will come to your
    office to review and approve. IRB staff will
    need work space and access to a copier. You
    still need to complete the request memo.
  • Please fax or email your request to the IRB
    office to schedule a time.

15
If PHI from a covered unit is used in the
research and a written consent form is used for
the study, you must have an IRB-approved
Authorization Form after April 14, 2003.
16
Participants Sign Both Forms
  • The Participant must sign the informed consent
    document.
  • and
  • The Participant must sign the Authorization Form.

17
Is an Authorization Form always required when
using a written consent form?
  • No, if the research is not conducted under the
    auspices of one of the 8 units listed earlier,
    you may not need an authorization.
  • Please check the IRB web site for updates to the
    list of units that will need HIPAA Authorizations
    or Waiver of Authorization.

18
My protocol used PHI but it is now closed to
enrollment and has IRB approval for data analysis
or long term follow-up only. What should I do?
  • Nothing for HIPAA. You do not need to submit an
    Authorization form for IRB approval. However,
    you need to keep your IRB approval up to date.

19
New IRB FormsApproval of Waiver of
Consent/Waiver of HIPAA Authorization
  • To meet HIPAA requirements the protocols for
    Full, Expedited, and Exempt review have been
    revised to include the HIPAA recognized
    identifiers. If a waiver of HIPAA authorization
    is approved by the IRB, the waiver of
    authorization will be noted in the minutes and on
    a new approval form (see sample).

20
New IRB FormsApproval of Waiver of
Consent/Waiver of HIPAA Authorization
  • Principal Investigators may continue to request
    waiver of informed consent in the protocol. The
    IRB will make a final determination and note
    their findings in the IRB minutes and on a new
    approval form which will be attached to the
    current approval form.

21
New IRB Forms
  • PIs to begin using new forms as soon as possible
    for new protocols.
  • Protocols in process on April 14th may be
    required to complete additional information
    regarding identifiers and HIPAA authorization
    and/or waiver of authorization.

22
Data Repositories/Databases
  • Databases which contain PHI that is or will be
    used for research purposes must have IRB
    approval.
  • IRB approval of database required
  • IRB approval of each research protocol utilizing
    database required (amendment or separate
    protocol)
  • IRB requires other researchers accessing the
    database to obtain approval from Principal
    Investigator.

23
Data Repositories/Databases
  • Storage of research data/information for a
    specific protocol in a database does not need a
    separate approval, but should be included in the
    protocol.

24
Data Repositories/Databases
  • De-identified data repositories contain
    de-identified health information
  • No IRB approval for de-identified database
    required
  • IRB approval for the research/use of the data
    required

25
Research Recruitment
  • Question A researcher wants permission from a
    physician to look at UAB Hospital and Clinic
    patient records and flag the records of patients
    eligible for a study. Is this allowed?
  • Answer The researcher must request a waiver of
    authorization from the IRB to conduct this
    review.

26
Research Recruitment
  • Question A researcher wants a physician to
    discuss enrollment in a trial with the
    physicians patients. Is this allowed?
  • Answer Yes. Physicians may discuss clinical
    trial enrollment with their patients without
    obtaining patient authorization.

27
Research Recruitment
  • Question A researcher wants a physician to send
    a co-signed letter to identified patients that
    describes a research study and requests that the
    patients contact the researcher. Is this
    permissible?
  • Answer Yes and No. The physician may contact
    the patients and request the patients to contact
    the researcher, but the researcher should not
    sign the letter and may not contact the patients.

28
Research Recruitment
  • Question A researcher wants a list of patients
    who may be eligible for her research study. What
    must she do to obtain this list from a physician?
  • Answer The researcher must request from the IRB
    a partial waiver of patient authorization to
    obtain the list.

29
Research Recruitment
  • Question A physician provides care to a patient
    who would be a good candidate for a study his
    colleague is conducting. The physician wants to
    tell his colleague about the patient. What must
    the physician do?
  • Answer The physician must obtain a HIPAA
    authorization from the patient in order to
    disclose the patients health information to the
    researcher.

30
Research Recruitment
  • Question A researcher informs a physician about
    a clinical trial and asks the physician to be on
    the lookout for any patients that might fit the
    criteria for enrollment. Is this permissible?
  • Answer Yes. The researcher may contact
    physicians about clinical trials and ask the
    physicians to consider whether they have eligible
    patients. However, only the patients physician
    may contact the eligible patients to discuss
    enrollment unless and until the researcher
    obtains an authorization or waiver of
    authorization to contact the patients directly.

31
Research Recruitment
  • Question Can a researcher review the results of
    clinical tests performed in the UAB Hospital,
    with the purpose of contacting those patients
    with a positive result to discuss enrollment in a
    clinical trial?
  • Answer To do so, the researcher must request
    from the IRB a partial waiver of patient
    authorization to allow the review and patient
    contact.

32
Research Recruitment
  • Question Can researchers obtain names from
    outside parties that are not bound by HIPAA ,
    such as a government agency, in order to recruit
    for a trial? Can they contact the individuals?
  • Answer Yes. HIPAA does not apply to
    recruitment of enrollees through use of
    information that comes from an entity that is not
    bound by HIPAA.

33
Review of Forms
  • Request for Waiver of HIPAA Authorization
  • Authorization approval request memorandum
  • HIPAA Authorization
  • Approval of Waiver of HIPAA Authorization and/or
    waiver of Informed Consent
  • Revised Full, Expedited, Exempt Protocol
    documents available on IRB web site
    www.uab.edu/irb/hipaa

34
Questions
www.uab.edu/irb Ph 934-3789 Fax
934-1401 irb_at_uab.edu
Write a Comment
User Comments (0)
About PowerShow.com