Module 7 Research Disclosures For Data Custodians

1. START to begin… Click Module 7Research Disclosures For Data Custodians

2. Next Introduction • In this course, you will learn about UNC HCS’s policies and procedures regarding disclosure of PHI for research purposes. • All UNC HCS workforce members involved with research must comply with these policies and procedures.

3. Next Use and Disclosure of PHI in Research • The HIPAA Privacy Rule establishes the conditions under which PHI may be used or disclosed by a covered entity for research purposes. • Research using patient records, both paper and electronic format, or excess human tissues, must be • conducted by a full time member of the Medical Attending Staff or his/her designee • approved by the Chair of the clinical department involved and • approved by the Committee on the Protection of the Rights of Human Subjects (IRB).

4. Next Use and Disclosure of PHI in Research • In those instances where projects proposed by the Medical Allied Health Staff do not fall within the areas of concern of a member of the attending staff, the President of the Hospitals or the Chief of Staff may provide sponsorship. • UNC HCS staff are responsible for understanding: • the documentation requirements prior to releasing PHI for research purposes; and • the accounting of disclosure requirements when PHI is released for research purposes.

5. Next Use and Disclosure of PHI in Research • UNC HCS staff use and disclose PHI for both treatment and research purposes. Different requirements and procedures apply to each. • These requirements are included in the UNC HCS Release of PHI for Research Purposes Policies and the Privacy Guidelines.

6. Next Use and Disclosure of PHI in Research • Any use of PHI for research purposes, even if the investigator is the patient’s treating physician, must be reviewed and approved by the IRB. • Requests for use of excess surgical pathology tissue in research must be approved by the Director of Surgical Pathology.

7. Next Use and Disclosure of PHI in Research UNC HCS is permitted to use and disclose PHI for research with individual authorization or, under limited circumstances, without individual authorization. PHI may be used for research with: • Authorization signed by the patient (or copy of informed consent document signed before 4/14/03); OR • Waiver of Authorization approved by the Institutional Review Board (IRB) (or copy of IRB waiver of informed consent approved prior to 4/14/03); OR • Limited Waiver of Authorization approved by the IRB for research eligibility prescreening and/or recruitment contact.

8. PHI may be used for research if it is: Completely “de-identified” requires the removal of the 18 identifiers listed in the HCS Release of PHI for Research Purposes policy. A “limited data set” which requires specific direct identifiers to be removed and compliance with specified terms of a data use agreement. Reviewed solely in preparation for research which requires that no PHI will be removed from records no PHI will be recorded, no patients will be contacted using PHI obtained from records Research on decedents which requires the researcher to present a written statement that access is solely for research of decedents and that decedent’s PHI is necessary for study and if requested, will provide documentation of the death of the individual. Next Use and Disclosure of PHI in Research

9. Next Use and Disclosure of PHI in Research UNC HCS staff who are requested to provide access or disclose PHI for research purposes documented in records in their custody must assure that the following completed documentation has been provided to the MIM Department Research Section: • Form HD974 (Request for Access to Protected Health Information for Research Purposes); • SARF (Systems Access Request Form), if applicable, signed by the Principal Investigator listed on the IRB Approval Letter; • IRB approval letter AND • Authorization signed by the patient (or copy of informed consent document signed before 4/14/03). A copy of the consent/authorization form must be sent to the Medical Information Management Department to be filed; OR • IRB Waiver of Authorization/Informed Consent (or copy of IRB waiver of informed consent approved prior to 4/14/03).

10. Next Options used for HIPAA Compliant Disclosures for Research • Research eligibility prescreening and/or recruitment contact • the researcher must present IRB Waiver of Authorization or IRB Limited Waiver of Authorization and the HD974 appropriately completed. • Review preparatory to research only • the researcher must present the HD974 appropriately completed. Access to WebCIS will not be granted for these reviews. • Only decedents • the researcher must present a written statement included on the HD974 and will provide documentation of the death of the individuals if requested. • Limited data sets • the researcher must present a Data Use Agreement. HD974 incorporates Data Use Agreement for UNC-CH researchers. • De-identified information • the researcher must present the HD974 form and the completed Request for Record Review or Database Reports form. All 18 identifiers must be removed as outlined in the UNC HCS Release of PHI for Research Purposes policy.

11. Next Requirements for Records or Information Custodians • UNC HCS Staff who disclose PHI for research purposes, including both paper and electronic records (e.g. WebCIS), must assure that all required documentation is submitted to the Medical Information Management (MIM) Research Section. • The MIM Research Section will send the relevant documentation to the appropriate records custodian to notify the custodian that the required documentation has been received. • Access must be limited to a period of time not to exceed the duration of the IRB approval for the research protocol, which is noted on the IRB approval letter.

12. Next Accounting of Disclosures Requirements UNC HCS staff who disclose PHI for research purposes MUST maintain an accounting of disclosures under the following circumstances: • using an IRB Waiver of Authorization with fewer than 50 patients involved by entering each accounting of disclosures into the DisclosureTrac database, • reviews preparatory to research only, or • reviews of decedents’ information • MIM will account for the disclosures for reviews of 50 or more patients.

13. Next Accounting of Disclosures Requirements UNC HCS staff who disclose PHI for research purposes ARE NOT required to maintain an accounting of disclosures under the following circumstances: • Disclosures with written Authorization of the patient • Disclosures of Limited Data Sets • Disclosures of De-identified information

14. Next Use and Disclosure of PHI in Research For additional information, web sites, detailed procedures, and forms refer to: • UNC HCS Release of PHI for Research Purposes Policy • UNC HCS Privacy Guidelines • UNC HCS Accounting of Disclosures Policy • UNC-CH HIPAA Research Policy Located at www.unch.unc.edu/HIPAA

15. Congratulations! Prev You have now successfully completed the online HIPAA Research Use and Disclosure Module - Click <HERE> to end show -