FAQ: HIPAA

  1. How does written authorization differ from informed consent?

    Informed consent is specified by required elements that ensure that the subject understands the nature of the research and its risks and potential benefits and agrees to participate in research. A subject's written Authorization is for the use and disclosure of protected health information in the course of research that are not otherwise permitted under the Privacy Rule. An authorization specifies a a set of core elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed.

  2. I am doing research in Botswana, does HIPAA apply to research performed at international sites?

    Since the research is taking place in an international setting, HIPAA authorization is not required from study participants. However, HIPAA protections apply to the use and collection of PHI by agents of the University of Pennsylvania and the Children's Hospital of Philadelphia as part of this research. This means that as an investigator, you are obligated to treat the data to the same protections as if it were collected from subjects at CHOP.

  3. Can I review my own office records to plan for a new study without IRB approval?

    You can not use, view, or record PHI without doing one of the following three things:

    1. a Written Authorization; or
    2. IRB Waiver of Written Authorization; or
    3. submitting a certification to the IRB for Work preparatory to Research.

    The IRB will acknowledge the certification after it is submitted but does not approve the submission.

    If the review of records does not involve use of PHI then it can proceed without IRB approval or submission of a Work Preparatory to Research certification. For example, if a database administrator runs a report to count up the number of potential subjects with a specific medical condition between the ages of 1 and 5 years, that search would not involve use of PHI by the investigator. The report would simply provide a summary of the number of potential subjects. If PHI is viewed, recorded or used in any way, the investigator must submit a Work Preparatory to Research certification before doing the work.

  4. I am submitting a Work Preparatory to Research certification so that I can review my records to identify how many potential subjects are in my clinic. What information, if anything can I retain when I'm done?

    You must limit the data collected to the minimum necessary to meet the objectives of the Work Preparatory to Research (e.g., establish feasibility, plan the study, identify potentially eligible subjects, etc.). You may not collect study data but you may retain names and contact information to be used, after the study is approved by the IRB, for recruitment purposes.

  5. Do I need to submit the Work Preparatory to Research form as part of my IRB submission for my protocol?

    Work preparatory to research is submitted when the investigator is planning research or not sure if its feasible. There is no need for this form when an actual protocol will be submitted to the IRB.

  6. Do I need to obtain consent and HIPAA authorization to do study recruitment?

    It depends.

    If recruitment is limited to review of existing medical records as part of an IRB-approved protocol, then this is considered a component of health care operations and there is no need to request a waiver of consent or HIPAA for this activity. The subjects will have an opportunity, at the time they are approached to participate, to provide informed consent and HIPAA authorization. The investigator is obligated to protect the PHI of prospective subjects just as they are obligated to protect the PHI of every patient cared for at CHOP.

    If as part of recruitment, the investigator intends to ask prospective subjects questions to determine whether or not they are eligible for the study, these questions are are considered part of the research. Consent must be obtained before asking the questions and if personally identifiable health information is involved, HIPAA authorization must also be obtained. This activity requires IRB approval, consent and HIPAA Authorization.

  7. There are decedents whose records will be included amongst those in the study; do we need to file the Decedents HIPAA form?

    The Decedents form is only for research that will be exclusively limited to decedents. The form provides a means for the investigator to attest to their intent to adhere to the requirements of HIPAA related to the use of decedents PHI. The IRB receives the investigators certification and checks it for appropriateness; it does not issue an approval. The investigator will receive the IRB's acknowledgment of receipt.

Top