Main navigation | Main content
PHI & De-Identified Data
Authorizations
Other Research Questions
It is not required to get the HIPAA Authorization at the time of consent, but it is the most practical time.
The following records ARE EXEMPTED from the definition of PHI even though they may contain health-related information:
Studies that use these kinds of records are not subject to HIPAA. However, existing IRB rules on informed consent and confidentiality still apply.
Data is considered de-identified under HIPAA when none of the following elements are present:
|
|
|
|
No. An Authorization differs from an informed consent in that an Authorization focuses on the privacy risks and states how, why, and to whom the PHI will be used and/or disclosed for research. An informed consent, on the other hand, provides research subjects with a description of how the confidentiality of records will be protected, among other things.
(Approvals for waivers or alterations will be rare and in most cases researchers are advised to use an Authorization Form with their subjects to use/disclose PHI. IRB approval is required for this Authorization Form - similar to consent forms.)
The following criteria must be met to qualify for a waiver:
The use or disclosure of protected health information involves no more than minimal risk to the privacy of individuals, based on, at least, the presence of the following elements;
The IRB maintains the authority to make the final decision if a study meets the aforementioned criteria. Use Appendix H to apply for a waiver or alteration of authorization and include it with your application form submission to the IRB.
Yes. The minor's parent or legal guardian must sign a HIPAA authorization on the minor's behalf. You can use the same HIPAA authorization for minors that you would use for adults. HIPAA does NOT have an added assent requirement for minors.
Yes, but subjects must receive a signed copy of the authorization.
Yes, a subject can revoke his/her authorization at any time in writing. Data already collected under the authorization can be used to a limited extent if necessary to preserve the integrity of the research.
HIPAA Authorization from non-English speaking subjects must be valid and meaningful. If a translated HIPAA Authorization will not be created, researchers must use a qualified translator to verbally translate the HIPAA Authorization and facilitate the informed consent process. The subject, the interpreter, and a witness (e.g. researcher) must sign the English language HIPAA Authorization form.
Contact the UMN Privacy Office for guidance if a non-UMN Translator will be used: 612-624-7447 or privacy@umn.edu.
In addition, please be aware that the Minnesota Department of Health has established a statewide roster of spoken language health interpreters. The Roster can be accessed via the following web address: http://www.health.state.mn.us/divs/pqc/hci/index.html
For studies using IRB-approved consent forms: These studies may continue to collect and use data from subjects enrolled prior to April 14, 2003 without any any new documentation requirements. However, studies that will continue to enroll subjects after this date must request approval to collect and use this data. See Instructions for existing IRB-approved studies for details about what to submit to the IRB.
For studies not using consent forms: If the study will enroll or reenroll subjects (have subject contact) on or after April 14, 2003, see these instructions about what is required to be submitted to the IRB before that date. If the study will not enroll or reenroll subjects on or after April 14, 2003, the study may continue without any additional documentation to the IRB.
HIPAA defines research as “a systematic investigation, including research development, testing and evaluation, designed to Develop or contribute to generalizable knowledge.”
This definition is identical to the one used in the 45 CFR 46.
Reviews preparatory to research and research involving the PHI of decedents are two instances that do not require subject authorization.
In addition, activities involved in preparing for research, covered entities may use or disclose PHI to a researcher without an individual’s Authorization, a waiver or an alteration, or a data use agreement. The covered entity must obtain from a researcher representations that:
A researcher who is an employee or a member of the covered entity’s workforce could use protected health information to contact prospective research subjects, i.e. study recruitment.
If planning to use PHI, fill out Appendix H as part of the IRB application submission. In Appendix H, request to use or disclose PHI by means of one of the four following options:
Once approved, the Subject Authorization Form must be signed by the subject or their authorized representative.
Authorization Form Template
Customize this template and use in conjunction with a consent form during the consent process with potential subjects. It must be signed and dated by the subject or the subject's authorized representative as a consent for would be. Use and disclosures of PHI must be described in this document to receive IRB approval.
Please submit your customized authorization form for IRB approval along with your IRB application.
Authorization Form Template (2012)
Authorization Form Template - Non-English Speakers (2012)
Authorization Form Template for Recruitment Databases
Complete and submit this form to the IRB with an application to establish a recruitment registry assuring the IRB that data used in your research is authorized.
Authorization Form Template for Recruitment
De-Identification Certification Form
Complete and submit this form to the IRB to assure the IRB that data used in your research is de-identified. (see When is data "de-identified"?)
This form is required when applying for an Exemption of IRB Review for studies that will use de-identified data. This form is to be used in conjunction with the IRB's Exempt Screening Application form.
De-Identification Certification Form
Data-Use Agreement Template
Customize this template as an agreement that will be signed by the researcher as an agreement for how they will use/disclose the PHI provided to them by a covered entity.
Authorization Form to Establish a Database for Future Research
Customize this template and use in conjunction with a consent form during the consent process with potential subjects. It must be signed and dated by the subject or the subject's authorized representative as a consent form would be. Use and disclosures of PHI must be described in this document to receive IRB approval.
Please submit your customized authorization form for IRB approval along with your IRB application.
Authorization Form to Establish a Database for Future Research Template