Fred Hutch HIPAA authorizations were updated effective June 7, 2015. This page provides instructions for using the new HIPAA Authorization forms.
To learn more about this topic, view the Fred Hutch Privacy and Confidentiality Policy.
Actions needed include the following:
If the HIPAA authorization form currently used for a research project uses the Fred Hutch Protocol Specific Authorization, submit a Research Modification Form to update the Protocol Specific HIPAA Authorization to the new version.
This modification may be submitted at any time, but no later than the project's next Continuation Review Report, or CRR. CRRs for projects open to accrual and that use this authorization will not be accepted unless the IRB file has been updated to the new version or a modification is submitted with the CRR.
Existing participants do not need to re-sign or re-authorize on the updated form. When the authorization form is updated through the IRB, new participants enrolling after IRB review must sign the updated version.
NOTE: Several new sections of the authorization form require research teams to edit the form to fit their specific research project.
For additional information regarding the new Fred Hutch Protocol Specific HIPAA Authorization Form, see the Instructions and Talking Points.
Research projects using the Transplant Program General HIPAA Authorization form, which covers all protocols in a transplant participant’s consent conference packet, do not need to take specific action with the IRB.
The updated, age-specific versions were posted to CTMS on June 7, 2021. To locate these forms, perform a Document Search in CTMS for the protocol number 'SHELL-CC-HIPAA'.
NOTE: No specific action is required with the IRB, just be aware the form has changed.
Research teams using another institution's HIPAA authorization forms do not need to take any action. This change only applies to research projects using the Fred Hutch Protocol Specific HIPAA Authorization Form.
Fred Hutch research teams with HIPAA authorization language embedded in their consent form should contact the Fred Hutch General Counsel to discuss whether changes in the authorization language are necessary.
To determine whether your research study will require HIPAA authorization from study participants, first determine the type of protected health information, or PHI, which will be accessed or used.
The sections below cover the following:
By definition, a limited data set may include categories of PHI such as ZIP codes, geocodes, date of birth, data of admission/discharge/service and other unique codes.
Research studies that will only access a limited data set are not required to obtain a HIPAA authorization from study participants. However, the covered entity from the location where the limited data set will be accessed may require a HIPAA-compliant Data Use Agreement.
When using or accessing more than a limited data set, separate HIPAA Authorization forms are required depending on the type of activity or the location where the activity will take place.
Who is conducting the activity or the location of the activity | Complete and submit this form |
---|---|
1. Fred Hutch Investigators, non-transplant-related research: most locations | Fred Hutch Protocol Specific Authorization Form |
2. Fred Hutch Investigators conducting transplant-related research at SCCA or UW | Fred Hutch Transplant Program General HIPAA Authorization Form This form is used for transplant program studies only. It can be found on Clinical FYI / CORE |
3. UW Consortium investigator | UW HIPAA forms |
4. All activities taking place at Seattle Children's | Seattle Children's HIPAA Form |
Fred Hutch Investigators requesting a complete waiver of HIPAA authorization are to use the HIPAA Supplement and Waiver of Authorization Form.
Those accessing medical records solely for purposes of ascertaining potential subjects may request a partial waiver for recruitment purposes using the HIPAA Supplement and Waiver of Authorization Form.
Note: The Fred Hutch IRB does not "approve" HIPAA authorization forms. Responsibility for the legal acceptability of HIPAA authorization rests with the covered entity from which researchers will obtain the PHI. Local requirements will vary. To determine what is needed, check with the institution where the PHI resides.
Situations that require the use of HIPAA forms from outside Fred Hutch include the following:
If a covered entity requires the use of their own HIPAA forms, their forms will be used in place of the Fred Hutch HIPAA forms. In these situations, provide the following:
These forms will not receive Fred Hutch IRB approval dates.
Contact the Fred Hutch Office General Counsel before using this method. If advised to do so, provide the following:
The consent form will be reviewed and approved by the IRB.
NOTE: This method is not recommended, but it may be used in some situations.
Submit the following:
NOTE: These updated forms will not receive IRB approval dates.
Submit the following:
These modifications will be reviewed and approved by the IRB.
Submit the following:
These changes will be reviewed and approved by the IRB.