What is HIPAA?
HIPAA is an acronym for the Health Insurance Portability and Accountability Act, passed by Congress in 1996. The purpose of the Act was to increase the ease with which people could transfer their health care information from one insurer or provider to the next. Congress, as part of HIPAA, required the development of privacy regulations to protect the confidentiality of individually identifiable health care information. The final privacy Rule was issued on August 14, 2002 (www.hhs.gov/ocr/hipaa/finalreg.html). The University of Washington has until April 14, 2003 to comply with the Privacy Rule.
Who is affected by HIPAA?
All researchers (faculty, staff, or students) at the UW who access or create Protected Health Information (PHI) preceding or during the conduct of their research must comply with the HIPAA regulations.
What is PHI?
Protected Health Information is any information pertaining to a) the past, present, or future physical or mental health or condition of an individual; b) the provision of health care to an individual; or c) the past, present, or future payment for the provision of health care to an individual. PHI may be information that is recorded electronically, on paper, or orally. PHI may concern living people or dead people (referred to in the law as "decedents"). PHI does NOT include de-identified information or biological tissue with no accompanying information, such as an accession number or code number, that may be linked to an identifier.
What kind of research and researchers are affected by the HIPAA regulations?
Any kind of research conducted under the auspices of the UW and UW Medicine that creates or uses protected health information is subject to the HIPAA regulations. This includes such research activities as clinical trials, chart reviews, epidemiological studies, behavioral, and social science studies, as well as basic science research activities. It includes research that involves the provision of treatment as well as research that provides neither treatment nor diagnosis.
All studies involving creation or use of Protected Health Information (PHI) must be reviewed and approved in advance by the UW's Human Subjects Division.
All researchers, whether or not they are directly connected with UW Medicine, who wish to conduct research involving protected health information must complete HIPAA training before they will be allowed to have access to individually identifiable health information in any form.
Who will review research use of HIPAA-regulated information?
HIPAA rules require a Privacy Board or Institutional Review Board (IRB) to
review the research use of HIPAA-regulated health information. The
What types of health information are there?
There are three categories of health information. The authorization requirements for use are different for each.
Individually Identifiable Health Information (IIHI): includes any subset of health information, including demographic information collected from an individual, that:
An authorization signed by the research subject is almost always required for the disclosure of individually identifiable health information. However, if the use meets the requirements for a waiver of authorization, the Human Subjects Review Committees may approve such a waiver.
The Human Subjects Review Committees may allow waivers of authorization for access to de-identified health information.
Limited Data Set: A limited data set is information disclosed by a covered entity to a researcher who has no relationship with the individual whose information is being disclosed. The covered entity is permitted to disclose PHI, with direct identifiers removed, subject to obtaining a data use agreement from the researcher receiving the limited data set. A data use agreement specifies permitted uses and disclosures, specifies who may use or receive the data set, restricts further use and disclosure, and restricts re-identification of the data or contact with the individuals.
The PHI in a limited data set may not be used to contact subjects. The Human Subjects Review Committees may allow waivers of authorization for use of limited data sets in research. If the data are to be removed from the hospital, the researchers must sign a data use agreement with the hospital.
The PHI in a limited data set may not be used to contact subjects. The Human Subjects Review Committees may allow waivers of authorization for use of limited data sets in research. If the data are to be removed from the hospital, the researchers must sign a data use agreement with the hospital.
Direct identifiers that must be removed from the information for a limited data set are:
Identifiers that are allowed in the limited data set are:
The HIPAA regulations use the term "authorization" to describe the process through which a patient allows researchers to access protected health information. The authorization for disclosure and use of protected health information may be combined with the consent form that a research subject signs before agreeing to be in a study. It may also be a separate form. In either case, the information must include:
Blanket authorizations for research to be conducted in the future are not permitted. Each new use requires a specific authorization.
Waiver of authorization for research
The UW Human Subjects Review Committees use these criteria in approving requests for a waiver of authorization for research:
The Human Subjects Review Committees must also consider if the researcher has provided:
What information must researchers provide to the IRB?
Researchers must provide more detailed information about the types of information they will use in their research, how it will be used, who will have access to it, and when it will be destroyed. Specifically, they are asked:
Researchers requesting waivers of authorization will also need to document:
Research subjects' rights under HIPAA
Right to an accounting: When a research subject signs an authorization to disclose PHI, the covered entity is not required to account for the authorized disclosure. Nor is an accounting required when the disclosed PHI was contained in a limited data set or is released to the researcher as de-identified data. However, an accounting is required for research disclosures of identifiable information obtained under a waiver or exception of authorization. Research subjects may request an accounting of disclosures going back for up to six years.
Right to revoke authorization: A research subject has the right to revoke his or her authorization unless the researcher has already acted in reliance on the original authorization. Under the authorization revocation provision, covered entities may continue to use or disclose PHI collected prior to the revocation as necessary to maintain the integrity of the research study. Examples of permitted disclosures include submissions of marketing applications to the FDA, reporting of adverse events, accounting of the subject's withdrawal from the study and investigation of scientific misconduct.
What effect does HIPAA have on recruitment of research subjects?
Recruitment of subjects for research is subject to the general authorization requirements. The Privacy Rule classifies recruitment as "research" rather than as health care operations or marketing. Because development or use of research databases falls within the definition of "research," a covered entity may disclose PHI in a database to sponsors for subject recruitment only after an authorization from the research subject or a waiver from the UW's Human Subjects Review Committee has been obtained.
Neither an authorization nor a waiver is required to disclose PHI contained in a limited data set or as de-identified data. Limited data sets will make it easier to create databases of potential subjects to see if it is feasible to conduct a clinical trial or to perform epidemiological research. There are a couple of important limitations on the use of PHI in a limited data set for subject recruitment. The PHI may not be used to contact subjects, and, because telephone numbers, internet provider addresses, and email addresses are not part of a limited data set, this information may not be collected by researchers from prospective subjects.
When researchers want to approach potential subjects to participate in a study whom they have identified using PHI under a waiver of authorization, they must use an approach method that has been approved in advance by the Human Subjects Review Committee.
Examples of approach mechanisms include using an intermediary such as the patient's primary care provider or a member of the medical staff actually caring for that patient, or sending the potential subject a letter signed by the patient's provider.
What will researchers have to do to request a waiver of authorization?
In completing the application to the UW Human Subjects Review Committee,
Research authorization templates
Researchers must use a separate HIPAA authorization form. The form must be signed and dated by the research subject or the subject's personal representative or legally authorized surrogate. The standard template is available at http://www.washington.edu/research/hsd/form.php?id=58.