FAQ: HIPAA

  1. How does written authorization differ from informed consent?

    Informed consent is specified by required elements that ensure that the subject understands the nature of the research and its risks and potential benefits and agrees to participate in research. A subject's written Authorization is for the use and disclosure of protected health information in the course of research that are not otherwise permitted under the Privacy Rule. An authorization specifies a set of core elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed.

    There are circumstances where HIPAA authorization, but not consent, may be required. This may be the case for screening procedures. For additional information concerning screening procedures, see Recruitment vs Screening.

  2. I am doing research in Botswana, does HIPAA apply to research performed at international sites?

    Since the research is taking place in an international setting, HIPAA authorization is not required from study participants. However, HIPAA protections apply to the use and collection of protected health information (PHI) by agents of the University of Pennsylvania and the Children's Hospital of Philadelphia as part of this research. This means that as an investigator, you are obligated to treat the data to the same protections as if it were collected from subjects at CHOP.

  3. Can I review my own office records to plan for a new study without IRB approval?

    You cannot use, access, or record PHI on human subjects without doing one of the following three things:

    1. a Written Authorization; or
    2. IRB Waiver of Written Authorization; or
    3. submitting a certification to the IRB for Work preparatory to Research.

    The IRB will acknowledge the certification after it is submitted but does not approve the submission.

    If the review of records does not involve use of PHI then it can proceed without IRB approval or submission of a Work Preparatory to Research certification. For example, if a database administrator runs a report to count up the number of potential subjects with a specific medical condition between the ages of 1 and 5 years, that search would not involve use of PHI by the investigator. The report would simply provide a summary of the number of potential subjects. If PHI is viewed, recorded or used in any way, the investigator must submit a Work Preparatory to Research certification before doing the work.

  4. I am submitting a Work Preparatory to Research certification so that I can review my records to identify how many potential subjects are in my clinic. What information, if anything can I retain when I'm done?

    You must limit the data collected to the minimum necessary to meet the objectives of the Work Preparatory to Research (e.g., establish feasibility, plan the study, identify potentially eligible subjects, etc.). You may not collect study data but you may retain names and contact information to be used, after the study is approved by the IRB, for recruitment purposes.

  5. Do I need to submit the Work Preparatory to Research form as part of my IRB submission for my protocol?

    Work preparatory to research is submitted when the investigator is planning research or not sure if it’s feasible. There is no need for this form when an actual protocol will be submitted to the IRB.

  6. Do I need to obtain consent and HIPAA authorization to do study recruitment?

    It depends.

    If recruitment is limited to review of existing medical records as part of an IRB-approved protocol, then HIPAA authorization and consent are not required (a waiver of HIPAA authorization and a waiver of consent [when applicable] can be granted by the IRB). The subjects will have an opportunity, at the time they are approached to participate, to provide informed consent and HIPAA authorization. The investigator is obligated to protect the PHI of prospective subjects just as they are obligated to protect the PHI of every patient cared for at CHOP.

    If the investigator intends to screen potential subjects for eligibility by asking them questions, these questions are considered part of the research. Consent and HIPAA authorization may have to be obtained for screening procedures. For additional information, see Recruitment vs Screening or IRB's Role in HIPAA.

  7. If consent is not required for screening procedures but HIPAA authorization is, do I need to submit a HIPAA authorization form?

    The investigators should submit a stand-alone HIPAA authorization form (Consent Templates) to the IRB. While the IRB does not approve stand-alone HIPAA authorization forms, it does check them for accuracy and to ensure that they contain the required elements. The IRB's responsibilities related to HIPAA are described in more detail in the IRB's Role in HIPAA.

  8. There are decedents whose records will be included amongst those in the study; do we need to file the Decedents HIPAA form?

    The Decedents form is only for research that will be exclusively limited to decedents. The form provides a means for the investigator to attest to their intent to adhere to the requirements of HIPAA related to the use of decedents PHI. The IRB receives the investigators certification and checks it for appropriateness; it does not issue an approval. The investigator will receive the IRB's acknowledgment of receipt.

Top