HIPAA Compliance

To determine whether your research study will require you to obtain HIPAA authorization from study participants, you must first determine the type of Protected Health Information (PHI) you will be accessing/using.

• Use of a "Limited Data Set"
• Use of or Access to More than a Limited Data Set
• Waiver of HIPAA Authorization
• Use of Other Covered Entities' HIPAA Forms outside of FHCRC, SCCA, UW and Seattle Children's

    

Use of a "Limited Data Set"

A limited data set by definition, may include categories of PHI such as ZIP codes, geocodes, date of birth, data of admission/discharge/service, and other unique code.

If your research study will only access a "limited data set", you will not be required to obtain a HIPAA authorization from study participants.  However, the covered entity from where you will be accessing the limited data set may require a HIPAA compliant Data Use Agreement.  If you have questions about Data Use Agreements of Limited Data Set, please contact the FHCRC Office of the General Counsel at 206.667.1224. 

Use of or Access to More than a Limited Data Set

A separate HIPAA Authorization Form(s) is required depending on the type of activity or where the activity will take place.

 

	Who is conducting the activity or Location of the activity	Complete and Submit this form
	1.  FHCRC Investigator The Clinical Research Division (CRD) Faculty and Staff are to work with their assigned Protocol Review Coordinator (PRC) in the Protocol Office when developing and submitting HIPAA forms to the IRO.	The FHCRC CRD General HIPAA Research Authorization Form.  This form is generally used for transplant studies.
	2.  UW Consortium Investigator	UW HIPAA forms
	3.  Activity taking place at Seattle Children's	Seattle Children's HIPAA Form

Waiver of HIPAA Authorization

	FHCRC Investigator - requesting a complete Waiver of HIPAA Authorization	HIPAA Supplement form
	Accessing medical records solely for purposes of ascertaining potential subjects	HIPAA Supplement form

Note:  The FHCRC IRB does not "approve" HIPAA authorization forms.  Responsibility for the legal acceptability of the HIPAA authorization rests with the covered entity from whom you will obtain the PHI.  Local requirements will vary.  Check with the local institution, where the PHI resides to determine what is needed.  If you have questions, contact the FHCRC Office of the General Counsel at 206.667.1224.

Use of Other Covered Entities' HIPAA Forms Outside of FHCRC, SCCA, UW and Seattle Children's

• Separate PHI Authorization to a Research Consent

If a Covered Entity requires the use of their own HIPAA forms, these forms will be used in place of the FHCRC HIPAA forms. Please provide a cover memo which outlines the other entity's request to use their HIPAA forms and one (1) copy of each of the covered entity's forms to be included in the IRB file. These forms will not receive FHCRC IRB approval dates.

• Inclusion of Covered Entity's HIPAA Language into FHCRC Consent Forms

This method is not recommended, but can be used in some situation.  Please contact the FHCRC Office of the General Counsel before using this method.

• Submit one (1) copy of the Consent form.
• The Consent form will be reviewed and approved by the IRB.

• Revisions/Modifications

Revisions to a currently approved Separate PHI Authorization to a Research Consent

• Submit a Protocol Modification Form - Note on the Protocol Modification Form that the IR file is being updated to contain the revised HIPAA.
• Submit one (1) copy of the revised Separate PHI Authorization for inclusion into the IRB file.
• Note: These updated forms will not receive IRB approval dates.

• Revisions to Consent forms which have HIPAA Language inserted within the Consent Forms

• Submit a Protocol Modification Form
• Submit one (1) copy of the revised Consent form with track changes and one (1) original clean copy
• These modifications will be reviewed and approved by the IRB.

Status Change (e.g. new HIPAA waiver required.)

• Submit a HIPAA Supplement Form
• These changes will be reviewed and approved by the IRB

Please contact James Riddle , IRO Assistant Director at 206-667-6501 if you have any questions regarding this paperwork. We are prepared to assist anyone who may need advice.