HIPAA Compliance

Fred Hutch HIPAA authorizations were updated effective June 7, 2015. This page provides instructions for using the new HIPAA Authorization forms.

To learn more about this topic, view the Fred Hutch Privacy and Confidentiality Policy.

Actions needed include the following:

New IRB applications: These must include the new version of the HIPAA Authorization Form applicable to your project.
Projects permanently closed to new enrollment: No action is necessary.
Projects continuing to enroll participants: Action will depend on which HIPAA authorization form is being used.

Option A: Projects Using the Fred Hutch Protocol-Specific Authorization

If the HIPAA authorization form currently used for a research project uses the Fred Hutch Protocol Specific Authorization, submit a Research Modification Form to update the Protocol Specific HIPAA Authorization to the new version.

General Instructions for HIPAA Authorizations

To determine whether your research study will require HIPAA authorization from study participants, first determine the type of protected health information, or PHI, which will be accessed or used.

The sections below cover the following:

Use of a limited data set
Use of, or access to, more than a limited data set
Waiver of HIPAA authorization
Use of other covered entities' HIPAA forms outside of Fred Hutch, UW and Seattle Children's

Use of a Limited Data Set

By definition, a limited data set may include categories of PHI such as ZIP codes, geocodes, date of birth, data of admission/discharge/service and other unique codes.

Research studies that will only access a limited data set are not required to obtain a HIPAA authorization from study participants. However, the covered entity from the location where the limited data set will be accessed may require a HIPAA-compliant Data Use Agreement.

Use of, or Access to, More than a Limited Data Set

When using or accessing more than a limited data set, separate HIPAA Authorization forms are required depending on the type of activity or the location where the activity will take place.

Who is conducting the activity or the location of the activity	Complete and submit this form
1. Fred Hutch Investigators, non-transplant-related research: most locations	Fred Hutch Protocol Specific Authorization Form
2. Fred Hutch Investigators conducting transplant-related research at SCCA or UW	Fred Hutch Transplant Program General HIPAA Authorization Form This form is used for transplant program studies only. It can be found on Clinical FYI / CORE
3. UW Consortium investigator	UW HIPAA forms
4. All activities taking place at Seattle Children's	Seattle Children's HIPAA Form

Waiver of HIPAA Authorization

Fred Hutch Investigators requesting a complete waiver of HIPAA authorization are to use the HIPAA Supplement and Waiver of Authorization Form.

Those accessing medical records solely for purposes of ascertaining potential subjects may request a partial waiver for recruitment purposes using the HIPAA Supplement and Waiver of Authorization Form.

Note: The Fred Hutch IRB does not "approve" HIPAA authorization forms. Responsibility for the legal acceptability of HIPAA authorization rests with the covered entity from which researchers will obtain the PHI. Local requirements will vary. To determine what is needed, check with the institution where the PHI resides.

Use of Other Covered Entities' HIPAA Forms Outside of Fred Hutch, SCCA, UW and Seattle Children's

Situations that require the use of HIPAA forms from outside Fred Hutch include the following:

Separate PHI authorization to a research consent
Inclusion of covered entity's HIPAA language into Fred Hutch consent forms
Revisions to a currently approved separate PHI authorization to a research consent
Revisions to consent forms that have HIPAA language inserted within the consent forms
Status changes

Separate PHI Authorization to a Research Consent

If a covered entity requires the use of their own HIPAA forms, their forms will be used in place of the Fred Hutch HIPAA forms. In these situations, provide the following:

A cover memo that outlines the other entity's request to use its HIPAA forms
One copy of each of the covered entity's forms to be included in the IRB file

These forms will not receive Fred Hutch IRB approval dates.

Inclusion of Covered Entity's HIPAA Language into Fred Hutch Consent Forms

Contact the Fred Hutch Office General Counsel before using this method. If advised to do so, provide the following:

One copy of the consent form

The consent form will be reviewed and approved by the IRB.

NOTE: This method is not recommended, but it may be used in some situations.

Revisions to a Currently Approved Separate PHI Authorization to a Research Consent

Submit the following:

A Research Modification Form that notes the IRB file is being updated to contain the revised HIPAA
One copy of the revised Separate PHI Authorization for inclusion into the IRB file

NOTE: These updated forms will not receive IRB approval dates.

Revisions to Consent Forms that have HIPAA Language Inserted within the Consent Forms

Submit the following:

A Research Modification Form
One copy of the revised consent form with track changes
One original clean copy

These modifications will be reviewed and approved by the IRB.

Status Changes (Such as the Requirement of a New HIPAA Waiver)

Submit the following:

A HIPAA Supplement and Waiver of Authorization Form

These changes will be reviewed and approved by the IRB.