UNIVERSITY OF TENNESSEE HEALTH SCIENCE CENTER INSTITUTIONAL REVIEW BOARD

HIPAA AUTHORIZATION FOR THE USE OF PROTECTED HEALTH INFORMATION IN RESEARCH

1. PURPOSE
   
   To provide guidance to investigators for securing subject authorization for use of protected health information (PHI) in human research studies.
2. SCOPE
   
   This SOP applies to IRB members and investigators.
   
   Personnel Responsible:
   
   Institutional Review Board staff, members, investigators.
3. BACKGROUND
   
   The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires that persons provide authorization for the use of PHI for specific purposes other than treatment, payment or health care operations. Specific authorization is generally required for the use and disclosure of PHI in research studies. The IRB requires incorporation of HIPAA authorization language in the body of the informed consent document.
   
   The basic elements of information that must be provided in writing to prospective subjects in securing their authorization for the research use of their PHI are specified in the privacy regulations. They include the following elements:
   1. a description of the information to be used or disclosed that identifies the information “in a specific and meaningful fashion”;
   2. the name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;
   3. the name or other specific identification of the person(s), or class of persons, to whom the covered entity is permitted to make the requested use or disclosure;
   4. a description of each purpose for the requested use or disclosure;
   5. an expiration date or an expiration event that relates to the purpose of the use or disclosure; the expiration date may be specified as “end of the research study”, or as “none” in the event that the PHI will be used for an indefinite period as part of a research database or repository;
   6. a description of the individual’s right to revoke the authorization in writing, including limitations on this right, and an explanation of how the individual may revoke the authorization; in explaining limitations on the right to revoke the authorization, investigators must indicate that the Privacy Rule permits the continued research use and disclosure of PHI obtained from the subject prior to the time when the authorization is revoked;
   7. an explanation that the investigator may condition research participation on the provision of the authorization and that subjects who revoke the authorization may be withdrawn from the study;
   8. the potential for information disclosed pursuant to the authorization to be subject to re-disclosure by the recipient and no longer protected by the Privacy Rule; and
   9. when the research includes evaluation of a treatment, a statement that the subject’s access to PHI will be temporarily suspended as long as the research is in progress, but will be reinstated upon completion of the research; this ground for the denial of access does not apply to research in which treatment is not evaluated.
      
      Several other regulatory requirements for authorizations must also be noted. First, the authorization must be signed and dated by the subject or the subject’s legally authorized representative. Second, if the signature is secured from the subject’s legally authorized representative, then a description of the representative’s authority to act on the individual’s behalf must also be provided.
      
      This latter provision requires that, for studies in which personal representatives may be providing consent or permission for some subjects, a separate line must be inserted in the signature section of the research consent form for describing the relationship of the representative to the subject. Third, when the authorization is included in the consent form for the research study, a copy of the consent form must be provided to the subject or the subject’s legally authorized representative. Finally, signed consent forms including the authorization must be retained for at least six years.
      
      In Accordance With
      
      45 CFR 160, 164; http://www.hhs.gov/ocr/hipaa
      
      Compliance with this policy also requires compliance with state or local laws or regulations that provide additional protections for human subjects.
4. PROCEDURES
   1. When a study is submitted for full board or expedited review, the Form 1 application must specify the plan for securing the HIPAA authorization of prospective subjects as part of the informed consent process.
   2. The following HIPAA authorization language must be inserted at the appropriate location in the confidentiality section of the consent document. The material in block form is the required authorization language. The italicized and highlighted material in brackets provides directions for including material that may or may not be relevant for particular studies.
      
      Authorization to Use and Disclose Protected Health Information for Research Purposes
      
      Under federal privacy regulations, you have the right to decide who can review and copy your identifiable health information (called “protected health information” or PHI). PHI collected in this study may include information such as:
      • Past and present medical records
      • Records about your study visits
      • Records about phone calls made as part of this research
      • Research records
        
        By signing this consent form, you are giving your permission for the study doctor and the study staff at the University of Tennessee to get your PHI from your doctor and/or facilities where you have received health care. They may also share your PHI with:

• The Institutional Review Board (IRB) at the University of Tennessee Health Science Center
• [if a multi-institutional study, add] researchers at [name of institutions]
• [if a cooperative study, add] [the name of the cooperative group]
• [if the research involves an FDA regulated drug/device/biologic, add] The US Food and Drug Administration (FDA)
• [if applicable, add] Department of Health and Human Services (DHHS) or other government agencies
• [if applicable, add] Governmental agencies in other countries
• [if research procedures will be billed to the subject’s insurance, add] your medical insurance provider
• [if research procedures are taking place at both Methodist and Le Bonheur, add] Methodist Le Bonheur Healthcare
• [if research procedures are taking place at Le Bonheur Children’s Hospital add] Le Bonheur Children’s Hospital
• [if research procedures are taking place at Methodist Hospitals, add] Methodist Healthcare-Memphis Hospitals
• [if research procedures are taking place at Regional One Health, add] Regional One Health
• [if research procedures are taking place at UT Medical Group, Inc., add] UT Medical Group, Inc.
• [if research procedures are taking place at a UT Le Bonheur Pediatric Specialists facility, add] UT Le Bonheur Pediatric Specialists, Inc.
• [if your study has a sponsor, add] [name of sponsor] which sponsors and provides funds for this research
• [if applicable, add] [name of CRO], which has been hired by the sponsor to coordinate the study
• [if applicable, add] a Data and Safety Monitoring Board (DSMB)

[If you included a sponsor, CRO, DSMB, or similar unaffiliated organization in the above bullet point list, you must add] However, some of these organizations or institutions above do not have the same obligations to protect your PHI.

Your PHI will only be used and/or given to others:

• to do the research,
• to study the results, and
• to see if the research was done right.

[Provide an expiration date for the authorization by choosing one of the following 3 statements:]

Your PHI will be used until the study is completed.

[if the research is FDA regulated, state] Your PHI will be used for as long as the sponsor reports study data to the FDA.

[if the research is without a foreseeable end point, such as a repository or a registry, state] Your PHI will be used indefinitely.

You may withdraw or take away your permission to use and disclose your PHI at any time. You do this by sending written notice to the study doctor. If you withdraw your permission, you may not be able to stay in the study.

When you withdraw your permission, no new PHI will be gathered after that date. However, information that has already been gathered may still be used and given to others. The federal regulations allow you to review or copy your PHI that is used in this study.

[If the research study includes treatment of subjects, add the following sentences.] However, in order to complete the research, your access to this PHI may be temporarily suspended while the research is in progress. Once the study is over, your right to review and copy your PHI will be reinstated.

3. In general, the language in the HIPAA authorization template should be precisely followed. Minor changes to the template, inserted at the request of study sponsors, are permissible with the review and approval of the IRB and the legal department of the institution in which the research is conducted. Use of sponsor recommended HIPAA authorization templates in place of or in addition to the IRB template is not permitted.
4. The HIPAA authorization template must be placed in the confidentiality section of all consent forms unless the investigator has received IRB approval to use PHI in research without the authorization of the subject.
5. Investigators must maintain documentation that subjects have provided a HIPAA authorization for the research use of their PHI (i.e., consent forms) for at least 6 years after the date on which the subject signed the consent form containing a HIPAA authorization or the date when it was last in effect, whichever is later. If the sponsor, governmental regulatory agency, IRB or institution requires that research documents/materials be retained for longer than 6 years, then the longer period of retention prevails.