HIPAA, Researchers and the IRB: Part Two

1. HIPAA, Researchers and the IRB: Part Two Alan Homans, IRB Chair and Nancy Stalnaker, IRB Administrator

2. Introduction AGAIN… • Don’t kill the messenger – we didn’t write this rule! • Be kind – we do NOT have all the answers – but we do want to hear the questions - we will will continue to work towards answering them.

3. What Research is Affected? Privacy rule applies to research that uses Protected Health Information (PHI).PHI is individually identifiable health information received from a covered entity.

4. What Research is Affected? Three categories of identifiability: • PHI – Identifiable – rule applies • De-Identified Information - rule doesnot apply • Limited Data Set – a middle option - limited parts of the rule apply

5. What Research is Affected? • “De-Identified” – there are 18 specific identifiers which must be removed to be considered de-identified – thus not covered by rule. • Limited Data Set – Not fully “de-identified” – can retain certain dates, geographic info and unique identifying numbers . Most privacy rule requirements do not apply, the minimum necessary standard does apply and a data use agreement is required.

6. 18 Items Which MustBeRemoved to Be “De-identified” • Names • ALL geographic subdivisions smaller than the state • All elements of dates smaller than a year (i.e. birth date, admission, discharge, death, etc.) • Phone numbers • Fax numbers • E-mail addresses • SS numbers • Medical record number • Health plan beneficiary

7. 18 Items Which Must Be Removed to Be “De-identified” (continued) • Any other account numbers • Certificate/license numbers • Vehicle identifiers • Device identification numbers • WEB URL's • Internet IP address numbers • Biometric identifiers (fingerprint, voice prints, retina scan, etc) • Full face photographs or comparable images • Any other unique number, characteristic or code. • Diagnoses are not included in this list

8. How to obtain PHI for research? • Authorization from Research Subject • Waiver of Authorization

9. Elements of Authorization • Required elements in an authorization • Specific and meaningful description of what information will be used or disclosed • Who may use or disclose • To whom the PHI will be disclosed • Why the use or disclosure is being made (each purpose) Notice that authorization may be revoked; • Notice that the information may be disclosed to others not subject to the Privacy Rule

10. Elements of Authorization II • Required elements in an authorization • Statement of how long the use or disclosure will continue (no expiration date is allowed for research purposes - but this must be explicitly stated in the authorization form) • Notice that the covered entity may or may not condition treatment or payment on the individual’s signature • Individual’s signature and date

11. How to obtain Authorization? The Draft FAHC Authorization language template is now finished and will be piloted beginning this week. It is a SEPARATE document to be executed in addition to the Informed Consent Document.

12. How to obtain Authorization Protocols Approved Prior to 4/14/03: • Surveys were sent to PIs to determine which approved protocols will require authorization (PHI + new accruals after 4/14/03). • Forms and processes will be piloted beginning this week and adjustments made. • IRB will email PIs having protocols identified as needing an authorization with instructions and the template, as soon as possible.

13. How to obtain Authorization? Review of authorization forms for existing protocols will be done on a first-come, first-serve basis – if you know you will be entering new subjects soon after 4/14/03, get your authorizations as soon as possible.

14. How to obtain Authorization? NEW PROTOCOLS: The process for determining which new protocols will require authorization is currently being developed, including a revision to our protocol cover sheet. We will let you know as soon as this is available.

15. How to obtain Waiver of Authorization? In research, authorization is not required if it meets the criteria for waiver outlined in the privacy rule.

16. No more than minimal risk Not adversely affect rights and welfare of subjects Research cannot be done without waiver When appropriate, information will be provided to subjects of research No more than minimal risk to privacy, based on, at least: Plan to protect identifiers Plan to destroy identifiers ASAP Written assurance that PHI will not be used/disclosed with few exceptions Research cannot be done without waiver, and Research cannot be done without this PHI CRITERIA FOR WAIVER OF AUTHORIZATION COMMON RULE PRIVACY RULE

17. How to obtain Waiver of Authorization? The process and forms are currently being developed to address the required criteria necessary for the IRB to approve a waiver. We will let you know when these are available.

18. TRANSITION TO PRIVACY RULE • Compliance date: April 14, 2003 • If you have a waiver of consent under the common rule prior to 4/14/03, you do NOT need to apply for a waiver under HIPAA • All new enrollment of subjects on research involving PHI falls under HIPAA & requires an authorization

19. Authorization/Waiver Reminders • If you need to do an authorization, the IRB will contact you to inform you what you need to do • If you haven’t completed your survey yet, please do so immediately! • HIPAA is in addition to current IRB human subject requirements - when both regulations apply, both requirements must be followed.

20. DATABASES/REGISTRIES • HIPAA will add a new level of scrutiny to use of all PHI • UVM and FAHC need to place ourselves in the best compliance position possible

21. DATABASES/REGISTRIES • In order to ensure that the development, maintenance and release of data involving PHI meets these requirements, we will be surveying all researchers about existing databases. • Processes are being developed for the IRB to review existing databases and, when appropriate, approve waiver of consent and/or authorization.

22. DATABASES/REGISTRIES • Model procedures for developing and operating databases and registries will be drafted and made available upon completion.