HIPAA

1
HIPAA

• Changes to IRB Forms Procedures
• March 20, 2003
• Sheila Moore, CIP
• Office of the Institutional Review Board for
  Human Use (IRB)

2
What happens on April 14th?What should I do
first?

• HIPAA Privacy Policy goes into effect April 14,
  2003.
• Determine if your research protocol uses
  protected health information (PHI) from one of
  the 8 units of the covered entities.

3
Units of Covered Entities

• University of Alabama Hospital
• School of Medicine
• School of Optometry
• The Childrens Hospital of Alabama

• The Kirklin Clinic
• School of Dentistry
• Callahan Eye Foundation Hospital
• Jefferson County Department of Public Health

4
Does the research use PHI that is linked with any
of the following?

• Names
• Geographic Subdivisions smaller than State
• Elements of Dates (except year)
• Telephone Numbers
• Fax Numbers
• Email Addresses
• Social Security Numbers

5
ContinuedDoes the research use PHI that is
linked with any of the following?

• Medical Record Number
• Health Plan Beneficiary Number
• Account Numbers
• Certificate/License Number
• Vehicle Identifiers and serial numbers
• Device Identifiers and serial numbers
• Biometric Identifiers

6
ContinuedDoes the research use PHI that is
linked with any of the following?

• Web universal resource locators (URLs)
• Internet protocol address numbers
• Full-face photographic images
• Any other unique identifying number

7
Protocol uses PHI from unit and use of consent
form was waived

• Has a waiver of written informed consent been
  previously approved by the IRB?
• If so, your protocol will be grandfathered
  under the waiver rules.
• However, at time of renewal you will need to
  complete the Request for Waiver of Patient
  Authorizationa new IRB form.

8
Protocol uses PHI from unit and written
informed consent was required

• Determine if you will be enrolling additional
  participants or requesting participants to sign
  addendum consent forms after April 14, 2003.
• If no consent forms will be used after April
  14th, you will not need to have a HIPAA
  Authorization form.

9
Participants will be asked to sign consent forms
or addendum consent forms after April 14

• Prepare a HIPAA Authorization Formsee new form
  in handout.
• Prepare request memorandumsee sample in the
  handouts.
• Submit materials to the IRB office to obtain
  approval of revised consent form with HIPAA
  Authorization.

10
Completing the HIPAA Authorization Form

• Participant Nameadded at enrollment
• Protocol Title IRB Protocol Number
• Check all units providing information
• Change revision date on all pages of consent form
• Change page numbering for entire form HIPAA
  Authorization will be last page

11
Complete the Request Memo

• See Handout
• Complete on Letterhead
• Include Investigator typewritten name and
  Investigator SIGNATURE
• Include IRB protocol number and title
• Note that only changes to be reviewed at this
  time are the addition of Authorization, the
  revision date and page numbers.

12
IRB Open Office Hours for HIPAA Authorization
Approval Room 470 Admin. Bldg.

• March 24th 9 11
• April 1st 9 11
• April 4th 1 230
• April 7th 9 12

• April 8th 9 12
• April 9th 2 4
• April 10th 9 12
• April 11th 12 - 3

13
Dont want to wait during IRB open office hours?

• You may drop your materials in the IRBs special
  HIPAA mail/drop box.
• Revised consent forms will be ready for pick-up
  at the IRB office front desk 24 hours later.
  Consent forms submitted on Friday will be ready
  Monday.

14
Will the IRB staff come to your
Department/Division to approve authorizations?

• Yes, if you have 20 or more consent forms that
  need review, the IRB staff will come to your
  office to review and approve. IRB staff will
  need work space and access to a copier. You
  still need to complete the request memo.
• Please fax or email your request to the IRB
  office to schedule a time.

15
If PHI from a covered unit is used in the
research and a written consent form is used for
the study, you must have an IRB-approved
Authorization Form after April 14, 2003.
16
Participants Sign Both Forms

• The Participant must sign the informed consent
  document.
• and
• The Participant must sign the Authorization Form.

17
Is an Authorization Form always required when
using a written consent form?

• No, if the research is not conducted under the
  auspices of one of the 8 units listed earlier,
  you may not need an authorization.
• Please check the IRB web site for updates to the
  list of units that will need HIPAA Authorizations
  or Waiver of Authorization.

18
My protocol used PHI but it is now closed to
enrollment and has IRB approval for data analysis
or long term follow-up only. What should I do?

• Nothing for HIPAA. You do not need to submit an
  Authorization form for IRB approval. However,
  you need to keep your IRB approval up to date.

19
New IRB FormsApproval of Waiver of
Consent/Waiver of HIPAA Authorization

• To meet HIPAA requirements the protocols for
  Full, Expedited, and Exempt review have been
  revised to include the HIPAA recognized
  identifiers. If a waiver of HIPAA authorization
  is approved by the IRB, the waiver of
  authorization will be noted in the minutes and on
  a new approval form (see sample).

20
New IRB FormsApproval of Waiver of
Consent/Waiver of HIPAA Authorization

• Principal Investigators may continue to request
  waiver of informed consent in the protocol. The
  IRB will make a final determination and note
  their findings in the IRB minutes and on a new
  approval form which will be attached to the
  current approval form.

21
New IRB Forms

• PIs to begin using new forms as soon as possible
  for new protocols.
• Protocols in process on April 14th may be
  required to complete additional information
  regarding identifiers and HIPAA authorization
  and/or waiver of authorization.

22
Data Repositories/Databases

• Databases which contain PHI that is or will be
  used for research purposes must have IRB
  approval.
• IRB approval of database required
• IRB approval of each research protocol utilizing
  database required (amendment or separate
  protocol)
• IRB requires other researchers accessing the
  database to obtain approval from Principal
  Investigator.

23
Data Repositories/Databases

• Storage of research data/information for a
  specific protocol in a database does not need a
  separate approval, but should be included in the
  protocol.

24
Data Repositories/Databases

• De-identified data repositories contain
  de-identified health information
• No IRB approval for de-identified database
  required
• IRB approval for the research/use of the data
  required

25
Research Recruitment

• Question A researcher wants permission from a
  physician to look at UAB Hospital and Clinic
  patient records and flag the records of patients
  eligible for a study. Is this allowed?
• Answer The researcher must request a waiver of
  authorization from the IRB to conduct this
  review.

26
Research Recruitment

• Question A researcher wants a physician to
  discuss enrollment in a trial with the
  physicians patients. Is this allowed?
• Answer Yes. Physicians may discuss clinical
  trial enrollment with their patients without
  obtaining patient authorization.

27
Research Recruitment

• Question A researcher wants a physician to send
  a co-signed letter to identified patients that
  describes a research study and requests that the
  patients contact the researcher. Is this
  permissible?
• Answer Yes and No. The physician may contact
  the patients and request the patients to contact
  the researcher, but the researcher should not
  sign the letter and may not contact the patients.

28
Research Recruitment

• Question A researcher wants a list of patients
  who may be eligible for her research study. What
  must she do to obtain this list from a physician?
  
• Answer The researcher must request from the IRB
  a partial waiver of patient authorization to
  obtain the list.

29
Research Recruitment

• Question A physician provides care to a patient
  who would be a good candidate for a study his
  colleague is conducting. The physician wants to
  tell his colleague about the patient. What must
  the physician do?
• Answer The physician must obtain a HIPAA
  authorization from the patient in order to
  disclose the patients health information to the
  researcher.

30
Research Recruitment

• Question A researcher informs a physician about
  a clinical trial and asks the physician to be on
  the lookout for any patients that might fit the
  criteria for enrollment. Is this permissible?
  
• Answer Yes. The researcher may contact
  physicians about clinical trials and ask the
  physicians to consider whether they have eligible
  patients. However, only the patients physician
  may contact the eligible patients to discuss
  enrollment unless and until the researcher
  obtains an authorization or waiver of
  authorization to contact the patients directly.

31
Research Recruitment

• Question Can a researcher review the results of
  clinical tests performed in the UAB Hospital,
  with the purpose of contacting those patients
  with a positive result to discuss enrollment in a
  clinical trial?
• Answer To do so, the researcher must request
  from the IRB a partial waiver of patient
  authorization to allow the review and patient
  contact.

32
Research Recruitment

• Question Can researchers obtain names from
  outside parties that are not bound by HIPAA ,
  such as a government agency, in order to recruit
  for a trial? Can they contact the individuals?
• Answer Yes. HIPAA does not apply to
  recruitment of enrollees through use of
  information that comes from an entity that is not
  bound by HIPAA.

33
Review of Forms

• Request for Waiver of HIPAA Authorization
• Authorization approval request memorandum
• HIPAA Authorization

• Approval of Waiver of HIPAA Authorization and/or
  waiver of Informed Consent
• Revised Full, Expedited, Exempt Protocol
  documents available on IRB web site
  www.uab.edu/irb/hipaa

34
Questions
www.uab.edu/irb Ph 934-3789 Fax
934-1401 irb_at_uab.edu