HIPAA Authorization and Waivers in Research

Part of Human Subjects Protection for Clinical Research Staff: Privacy and Confidentiality.

About 5 minutes. Free, in your language, no account needed.

Why this matters

When a study uses a person's health information, two separate questions come up. Did the person agree to take part? And may the health information flow to the research team? The first is informed consent (Module 4). The second is a privacy question, and for many sites HIPAA answers it.

This lesson covers a US law, the HIPAA Privacy Rule (45 CFR 164), taught as the worked example. ICH E6(R3) asks that identifying information be protected under the applicable privacy and data protection requirements wherever the trial runs. Other countries have their own privacy laws, and state law may add requirements.

Does HIPAA apply to your site?

HIPAA applies to covered entities and their business associates. Whether the Privacy Rule governs your site depends on what your site is. Ask your privacy officer rather than assume.

The general rule and the authorization

A covered entity may not use or disclose protected health information (PHI) without an authorization that is valid under 45 CFR 164.508, except as otherwise permitted or required (164.508(a)(1)).

A valid authorization has core elements (164.508(c)(1)): a description of the information, who may make the disclosure, to whom, the purpose, an expiration date or event, and a signature and date. For research, "end of the research study" or "none" is enough as an expiration, including for a repository. If a personal representative signs, the form describes that person's authority.

It must also state the right to revoke in writing and the exceptions to that right, whether treatment can be conditioned on signing, and the potential for the recipient to redisclose the information. It must be in plain language, and the person must get a copy (164.508(c)(2) to (4)).

A person may revoke in writing at any time, except to the extent the covered entity has already acted in reliance on the authorization (164.508(b)(5)). An authorization is defective if it has expired, is incompletely filled out, has been revoked, or contains material information known to be false (164.508(b)(2)).

An authorization is not consent to participate

Staff often blur this. A research authorization is not the same document as the consent to participate, even when the two are combined in one form (164.508(b)(3)(i)).

Consent to participate is about whether the person joins the research. The authorization is about whether the covered entity may use or disclose their PHI for it. Each has its own rules for content and revocation.

A provider may condition research-related treatment on an authorization for the research (164.508(b)(4)(i)). An authorization can be combined with a consent to participate. When treatment is conditioned on one part, the combined form must clearly differentiate the conditioned and unconditioned parts and offer opt-in for the unconditioned part (164.508(b)(3)(i)). If you see a combined form, find the authorization part and check it as its own document.

When no authorization is used

A covered entity may use or disclose PHI for research without authorization if it has documentation that an IRB or a privacy board approved an alteration or waiver of authorization (164.512(i)(1)(i)). The documentation covers (164.512(i)(2)):

• Minimal risk to privacy, based on at least an adequate plan to protect identifiers, a plan to destroy them at the earliest opportunity (unless justified or legally required to keep them), and written assurances against reuse or disclosure except as permitted.
• The research could not practicably be done without the waiver.
• The research could not practicably be done without access to and use of the PHI.
• The identity of the IRB or privacy board, the date, a description of the PHI, the review procedure, and the chair's or designee's signature.

A privacy board has members with varying backgrounds and appropriate competency, at least one member not affiliated with the covered entity or the sponsor, and no member reviews a project in which the member has a conflict (164.512(i)(1)(i)(B)).

Two narrower routes exist. For reviews preparatory to research, the researcher represents that the use is solely to prepare a protocol, no PHI leaves the covered entity, and the PHI is necessary. Research on decedents' information also needs representations and, on request, documentation of death (164.512(i)(1)(ii), (iii)).

In practice

A coordinator at a hospital-based site receives the study packet, with a consent form and a separate authorization. Before the first visit she checks that the authorization has its core elements and a signature and date, and that the participant received a copy. She does not treat the signed consent as covering the privacy form, and she files the authorization on its own line in the participant binder.

What this looks like when it goes wrong

A site pulls chart data for a retrospective review. A staff member believes the IRB approval is enough. No one has documentation of a waiver of authorization or a privacy board's approval, and no authorization exists for these patients. The data are already in a spreadsheet. The site should stop and bring it to its privacy officer and the investigator to find out whether the use was permitted. IRB approval of a study does not by itself show that this HIPAA documentation exists.

Key takeaways

• HIPAA applies to covered entities and business associates, so ask your privacy officer whether it governs your site.
• Without a valid authorization, a covered entity may not use or disclose PHI unless the rule permits it.
• A valid authorization has required elements, can be revoked in writing, and is defective if expired, incomplete, revoked or known to be false.
• A research authorization is not the same as consent to participate, even when combined in one form.
• Research use without authorization needs documented IRB or privacy board approval of an alteration or waiver.