PPM Section 320-36

Printable Version

In this Section

Quick Links

Policy and Procedure Manual

Chapter 320, Records and Archives
Section 36, Access to Protected Health Information for Research
Approved: 10/2/03
Supersedes: New

Responsible Department: UCDHS/Campus Compliance Department
Source Document: HIPAA Research Compliance Guidelines

I. Purpose

This section provides guidance on access to protected health information (PHI) for research purposes in accordance with the Health Insurance Portability and Accountability Act (HIPAA) privacy regulations. Refer to Section 320-35 for general HIPAA requirements, definitions, and references.

II. Policy

A. This policy applies to any research in which health information is collected by or obtained from a covered entity.

B. Health information that is completely de-identified as defined by HIPAA is not PHI (see http://www.ucdmc.ucdavis.edu/compliance/guidance/privacy/deident.html). If all health information in a study is de-identified prior to receipt by the investigator, this policy does not apply.

C. Researchers may request access to PHI for research in the following situations:

1. Authorization by individual (or legal representative).

2. Waiver of authorization granted by the Institutional Review Board (IRB).

3. Work preparatory to research.

4. Decedent records.

5. Limited data set (see III.E, below).

D. Requests for access to PHI for research under C.1, C.2, and C.5 shall be submitted to the IRB for review/approval. Requests under C.3 and C.4 shall be submitted to the Privacy Official for review/approval. However, if C.4 includes identifiers linked to living persons, IRB review/approval is required. Also, if C.4 includes review of death records maintained by the State Registrar, local registrars, or county records, the IRB must determine whether the research constitutes a valid scientific interest (Health and Safety Code Section 102231).

III. Procedures

A. Authorization

1. An individual's authorization must be obtained for the research study. Blanket authorizations do not provide sufficient information to make an informed choice. The authorization must be approved by the IRB prior to use.

2. An appropriate authorization must contain the following elements:

A description of information used/disclosed.
The names of authorized recipients of information.
A description of the purpose of using/disclosing the data.
An expiration date or event for the authorization.
A statement that the individual has a right to revoke his/her authorization.
A statement that the provider cannot condition treatment, payment, enrollment, or eligibility for benefits on signing the authorization, except for treatment that is research related or intended to create PHI for disclosure to an outside entity.
A statement that there is the potential for information to be redisclosed by the recipient. If a recipient has agreed to restrict use and disclosure of the data, a summary of the protections may be included here.
Signature and date.

3. An optional statement may be included in the authorization that the right of the individual to access PHI created or obtained in the course of the study will be temporarily suspended for as long as the research is in progress and the right of access will be reinstated upon completion of the research. If this optional element is not in the authorization, the individual has the right to access his/her PHI created or obtained in the course of the study.

4. An individual's authorization may be printed on the research consent form.

5. The individual has the right to revoke a previous authorization. If the authorization is revoked, the researcher can no longer access PHI. The researcher may use existing data as necessary to maintain the integrity of the study, but the researcher may not gather any more research data from the effective date of the revocation. However, more data may be gathered for submission to the U.S. Food and Drug Administration to investigate scientific misconduct and to report adverse events.

B. Waiver or alteration of authorization

1. The researcher may apply to the IRB for a waiver or alteration of authorization. The IRB requires a brief description of the PHI for which use or access is necessary. Use the IRB form for this purpose (available from the IRB, Office of Human Research Protection).

2. Waiver or alteration of authorization may be granted by the IRB if it is determined that the proposed use or disclosure of PHI involves no more than minimal risk to the privacy of individuals, research could not practically be conducted without the waiver, and research could not practically be conducted without access to and use of the PHI. Required elements for minimal risk are at least:

Adequate plan to protect identifiers from improper use or disclosure.
Adequate plan to destroy identifiers at the earliest opportunity consistent with the conduct of research, unless there is health or research justification for retaining identifiers or such retention is otherwise required by law.
Adequate written assurances that the PHI will not be reused/disclosed to any other person or entity except as required by law for authorized oversight of the research project.

3. Documentation of IRB approval will include all of the following:

Identification of the IRB and approval date.
A statement that the waiver satisfies all of the criteria in III.B.2.
A brief description of the PHI for which use or access has been determined to be necessary by the IRB.
A statement that the waiver has been reviewed and approved under normal or expedited review procedures under the common rule.
The signature of the IRB Chair or other member, as designated by the Chair.

C. Work preparatory to research

1. The investigator must provide the Privacy Official the following:

Identify that access is solely to review PHI to prepare a research protocol or for similar purposes preparatory to research.
State that no PHI will be removed from the covered entity.
Identify that the PHI requested is necessary for the research (minimum necessary).

2. The Privacy Official must approve the request for access.

D. Decedent research

1. If there are identifiers linked to living persons, IRB approval of the research is required. Authorization may be waived as described in III.B.

2. For those studies without linkage to living persons, the investigator must provide the Privacy Official the following:

Identify that access is solely for the research of the PHI of decedents.
State that the information requested is necessary for the research (minimum necessary).
In addition, the privacy officer may request proof of death.

3. The Privacy Official must approve the request for access.

E. Limited data set

1. The requirements for a limited data set and data use agreement are described at the UCDHS/Campus Compliance Department website at http://www.ucdmc.ucdavis.edu/compliance/guidance/privacy/deident.html.

2. As part of the IRB application for review or for exemption from review, the IRB requires a copy of the data use agreement.

3. The Privacy Official must approve the agreement.

F. Recruitment

If knowledge of the individual's PHI is used to identify the person for recruitment, one of the following must be true:

1. The person recruiting the individual and obtaining the individual's authorization for the research study is the individual's physician, and the study is a therapeutic trial that benefits the individual;

2. Prior to the investigator identifying the individual, the individual has signed an authorization specific to the study that allows recruitment;

3. The IRB has waived authorization for the recruitment phase of the study; or

4. The IRB has waived authorization for the entire study.

Alternatives 3 and 4 are most common. For alternative 3, the IRB will need to determine that III.B (waiver or alteration of authorization) applies to the recruitment phase of the study.

G. Access

Written requests for access with documented appropriate approval are presented to the custodian of the data. The data custodian will track all requests and document access granted. For example, the data custodian of patient information at UCDHS is the Health Information Management Department.

H. Studies approved prior to April 14, 2003

1. Research with written consent. Collection of data on enrolled individuals may continue. Individuals enrolled after April 14, 2003, will also have to sign a HIPAA compliant authorization for release of PHI. The authorization does not need to be approved by the IRB until the study's next annual review.

2. Research with consent waived by the IRB. Any studies with a waiver by the IRB of informed consent in accordance with the minimal risk or emergency study provisions of the common rule may continue accruing individuals. However, if an informed consent is sought from a research individual after the compliance date, a HIPAA-compliant authorization must also be obtained.

3. Exempt studies. Studies will require pre-approval as described in III.A-E prior to collecting any new data after the compliance date.

I. Disclosures

1. For decedent research, work preparatory to research, or research conducted under a waiver or alteration of authorization disclosure tracking is required.

2. For studies that do not involve the provision of healthcare, the data custodian will track disclosures of PHI to the investigator.

3. For studies that do involve the provision of healthcare, the investigator will track disclosures of PHI from the study to others, such as disclosures to the study sponsor. The investigator must promptly send disclosure information to the data custodian.