What is it? - When do I need one? - Is there a standard form? - How do I use the standard UW form? - Does the standard form work everywhere? - What if I want to use records not held by the UW? - What kind of records need an Agreement? - What if study staff change?
Just Give me The Big Picture
A Confidentiality Agreement is a contract between you and the record holder that undertakes to allow access to confidential records in accordance with the relevant State law.
When you wish to have access to confidential records without first getting the permission of the people whose records they are.
A Confidentiality Agreement is a contract between you and the record holder that undertakes to allow access to confidential records in accordance with the relevant State law.
There is a standard form on the Human Subjects Division web site. This form works for records held by the University of Washington and affiliated agencies (e.g., Harborview Medical Center or the University of Washington Medical Center). It does not work for records held by agencies that are not affiliated with the University of Washington.
A Confidentiality Agreement works because it is a legal document drawn up by researchers (who wish to use records) and the record holder (who is responsible for ensuring that records are used in accordance with the relevant law). Most large institutions delegate the authority to make such agreements to a Privacy Board, and the Human Subjects Division acts as the Privacy Board for the University of Washington and affiliated agencies. The University of Washington has no authority to conclude agreements for agencies that are not affiliated with it.
Other agencies have to draw up their own agreements in accordance with the relevant law, and take responsibility for letting researchers use the records they hold without the authorization or consent of the people whose records they are.
Contact the agency, find out who serves as the Privacy Board, obtain their standard agreement, and follow their instructions on filling it out. When the agreement has been signed by all relevant parties, send a copy (not the one with the original signatures) to the Human Subjects Division, either when you submit a new Human Subjects Application, or with a modification form if you are adding it to an approved Human Subjects Application.
Small organizations may not have their own standard Agreement forms, and they may wish to adapt the standard University of Washington Confidentiality Agreement. There is no problem with doing so, as long as the form is changed to make it clear what organization is involved, and what responsible official is signing on behalf of the organization.
Some organizations may prefer to include the conditions of a Confidentiality Agreement in a letter of cooperation, signed by a responsible official. The original letters of cooperation should be kept by the researcher; copies only should be sent to Human Subjects Division.
The basic use of a Confidentiality Agreement is to allow research access to clinical records; the University of Washington also includes other confidential records (educational and personnel records) in the scope of the Confidentiality Agreement form. When used to have access to records containing protected health information, a formal waiver of the HIPAA requirement for authorization is also needed.
A Confidentiality Agreement is a legal instrument, like a contract. Ordinarily, access to private records, in particular medical records, can occur only with the consent of the person whose records they are. (Although records are held by institutions or agencies like hospitals or schools, the records do not belong exclusively to the institutions: important rights to the records, and the information contained in them, belong to the individuals concerned.)
Although Confidentiality Agreements were originally developed to deal with clinical records, the University of Washington also uses them to govern research access to other confidential records held by the university, such as educational and personnel records.
A Confidentiality Agreement is an instrument that allows exceptional access to records even though the individual(s) whose records they are have not given explicit consent for that access. Conditions under which such exceptional access can occur are prescribed by law, and may vary from state to state. The University of Washington Confidentiality Agreement requires very careful handling of access to records, to minimize the possibility of breaches of confidentiality.
There are two main parties to a Confidentiality Agreement used to allow research access to records without consent or authorization: the researcher(s) and the institution that holds the records. Many institutions delegate authority to execute such agreements to a Privacy Board; at the University of Washington, the University of Washington IRBs serve as the privacy board for the University of Washington and affiliated agencies. The relevant Human Subjects Division administrators are authorized to sign for the IRBs in such matters.
In other words, if records are held by the University of Washington or an affiliated agency, the appropriate University of Washington IRB can execute a Confidentiality Agreement on behalf of the University of Washington. But if the records are held by another, unaffiliated, institution or agency, the Confidentiality Agreement (or equivalent) must be negotiated between, and executed by, the researcher(s) and that record-holder. For example, the University of Washington can not negotiate a Confidentiality Agreement on behalf of the Washington State Department of Corrections.
Because a Confidentiality Agreement is an instrument that must be executed with the original signatures of all parties, it is unnecessary to provide copies of incomplete Confidentiality Agreements, since they cannot validly be completed, lacking as they do original signatures of some of the parties. The correct procedure is to submit one proposed Confidentiality Agreement, on a current Confidentiality Agreement form, bearing original signatures of all relevant parties. If approvable, this will be completed by the signature of the relevant Human Subjects Division administrator on behalf of the IRB. The original will then be returned for you, to function as formal certification of authorization for use of records. A copy of the executed Agreement will be retained in the application file. This copy is not itself an executed Confidentiality Agreement, because it does not bear original signatures; it is simply evidence that such an Agreement has been executed and issued. It is the responsibility of the principal investigator to retain the Confidentiality Agreement as evidence of authorization for use of records.
Over the course of a study, the people who should be listed on a Confidentiality Agreement may change. If this happens, a new or supplemental Confidentiality Agreement may be needed.
If you have questions about Confidentiality Agreements, please feel free to contact the appropriate Human Subjects Division staff.