HIPAA Compliance

Fred Hutch HIPAA authorizations were updated effective June 7, 2015. This page provides instructions for using the new HIPAA Authorization forms.

To learn more about this topic, view the Fred Hutch Privacy and Confidentiality Policy.

Actions needed include the following:

• New IRB applications: These must include the new version of the HIPAA Authorization Form applicable to your project.
  
• Projects permanently closed to new enrollment: No action is necessary.
  
• Projects continuing to enroll participants: Action will depend on which HIPAA authorization form is being used.

Option A: Projects Using the Fred Hutch Protocol-Specific Authorization

If the HIPAA authorization form currently used for a research project uses the Fred Hutch Protocol Specific Authorization, submit a Research Modification Form to update the Protocol Specific HIPAA Authorization to the new version.

This modification may be submitted at any time, but no later than the project's next Continuation Review Report, or CRR. CRRs for projects open to accrual and that use this authorization will not be accepted unless the IRB file has been updated to the new version or a modification is submitted with the CRR.

Existing participants do not need to re-sign or re-authorize on the updated form. When the authorization form is updated through the IRB, new participants enrolling after IRB review must sign the updated version.

NOTE: Several new sections of the authorization form require research teams to edit the form to fit their specific research project.

For additional information regarding the new Fred Hutch Protocol Specific HIPAA Authorization Form, see the Instructions and Talking Points.

Option B: Projects Using the Transplant Program General HIPAA Authorization

Research projects using the Transplant Program General HIPAA Authorization form, which covers all protocols in a transplant participant’s consent conference packet, do not need to take specific action with the IRB.

The updated, age-specific versions were posted to CTMS on June 7, 2021.  To locate these forms, perform a Document Search in CTMS for the protocol number 'SHELL-CC-HIPAA'.

NOTE: No specific action is required with the IRB, just be aware the form has changed.

Option C: Projects Using Another Institution's HIPAA Forms

Research teams using another institution's HIPAA authorization forms do not need to take any action. This change only applies to research projects using the Fred Hutch Protocol Specific HIPAA Authorization Form.

Option D: Projects with HIPAA Authorization Language Embedded in the Consent

Fred Hutch research teams with HIPAA authorization language embedded in their consent form should contact the Fred Hutch General Counsel to discuss whether changes in the authorization language are necessary.

General Instructions for HIPAA Authorizations

To determine whether your research study will require HIPAA authorization from study participants, first determine the type of protected health information, or PHI, which will be accessed or used.

The sections below cover the following:

• Use of a limited data set
• Use of, or access to, more than a limited data set
• Waiver of HIPAA authorization
• Use of other covered entities' HIPAA forms outside of Fred Hutch, SCCA, UW and Seattle Children's

Use of a Limited Data Set

By definition, a limited data set may include categories of PHI such as ZIP codes, geocodes, date of birth, data of admission/discharge/service and other unique codes.

Research studies that will only access a limited data set are not required to obtain a HIPAA authorization from study participants. However, the covered entity from the location where the limited data set will be accessed may require a HIPAA-compliant Data Use Agreement.

Use of, or Access to, More than a Limited Data Set

When using or accessing more than a limited data set, separate HIPAA Authorization forms are required depending on the type of activity or the location where the activity will take place.

Waiver of HIPAA Authorization

Fred Hutch Investigators requesting a complete waiver of HIPAA authorization are to use the HIPAA Supplement and Waiver of Authorization Form.

Those accessing medical records solely for purposes of ascertaining potential subjects may request a partial waiver for recruitment purposes using the HIPAA Supplement and Waiver of Authorization Form.

Note: The Fred Hutch IRB does not "approve" HIPAA authorization forms. Responsibility for the legal acceptability of HIPAA authorization rests with the covered entity from which researchers will obtain the PHI. Local requirements will vary. To determine what is needed, check with the institution where the PHI resides.

Use of Other Covered Entities' HIPAA Forms Outside of Fred Hutch, SCCA, UW and Seattle Children's

Situations that require the use of HIPAA forms from outside Fred Hutch include the following:

• Separate PHI authorization to a research consent
• Inclusion of covered entity's HIPAA language into Fred Hutch consent forms
• Revisions to a currently approved separate PHI authorization to a research consent
• Revisions to consent forms that have HIPAA language inserted within the consent forms
• Status changes

Separate PHI Authorization to a Research Consent

If a covered entity requires the use of their own HIPAA forms, their forms will be used in place of the Fred Hutch HIPAA forms. In these situations, provide the following:

• A cover memo that outlines the other entity's request to use its HIPAA forms
• One copy of each of the covered entity's forms to be included in the IRB file

These forms will not receive Fred Hutch IRB approval dates.

Inclusion of Covered Entity's HIPAA Language into Fred Hutch Consent Forms

Contact the Fred Hutch Office General Counsel before using this method. If advised to do so, provide the following:

• One copy of the consent form

The consent form will be reviewed and approved by the IRB.

NOTE: This method is not recommended, but it may be used in some situations.

Revisions to a Currently Approved Separate PHI Authorization to a Research Consent

Submit the following:

• A Research Modification Form that notes the IRB file is being updated to contain the revised HIPAA
• One copy of the revised Separate PHI Authorization for inclusion into the IRB file

NOTE: These updated forms will not receive IRB approval dates.

Revisions to Consent Forms that have HIPAA Language Inserted within the Consent Forms

Submit the following:

• A Research Modification Form
• One copy of the revised consent form with track changes
• One original clean copy

These modifications will be reviewed and approved by the IRB.

Status Changes (Such as the Requirement of a New HIPAA Waiver)

Submit the following:

• A HIPAA Supplement and Waiver of Authorization Form

These changes will be reviewed and approved by the IRB.