Research subject to the Health Insurance Portability and Accountability Act (HIPAA) must comply with the Fred Hutch Privacy and Confidentiality Policy. Research is subject to HIPAA when research personnel:
- are part of a covered entity or receive information from a covered entity or a business associate, and;
- access, use, collect, or generate protected health information (PHI) for any part of the research, including recruitment.
General Instructions for HIPAA Authorizations
To determine whether your research study will require study participants to sign a HIPAA authorization form, first determine the type of Protected Health Information (PHI) to be accessed, used, or disclosed.
Use of De-identified Health Information
Properly de-identified health information is not considered PHI and may be used or disclosed for research purposes without authorization from the research participant or a waiver of authorization from the IRB or Privacy Board. Research personnel using de-identified information must be able to provide documentation, upon request, that the health information was de-identified by expert determination or the safe harbor method outlined in the De-identification of Protected Health Information and Limited Data Sets policy.
Use of a Limited Data Set
A Limited Data Set is PHI that excludes direct identifiers and may be used or disclosed for research purposes without authorization from the research participant or a waiver of authorization from the IRB or a Privacy Board when there is an executed HIPAA-aligned Data Use Agreement with the covered entity disclosing the Limited Data Set.
A Limited Data Set may not include any of the identifiers which must be removed for the safe harbor method of de-identifying PHI, with the exception of the following direct identifiers:
- Town, city, county, precinct, state, and Zip code
- All elements of dates directly related to an individual, including birth date, admission date, discharge date, and date of death
- Unique identifying numbers, characteristics, and codes
For more on Limited Data Sets see the De-identification of Protected Health Information and Limited Data Sets policy.
Use of, or Access to, More than a Limited Data Set
When using or accessing more than a Limited Data Set for research purposes, a HIPAA Authorization from the participant or a waiver of HIPAA from the IRB is necessary.
When planning to obtain a signed HIPAA authorization from participants, select the correct form to use depending on the type of activity or the location where the activity will take place:
| Who is conducting the activity or the location of the activity? | Use this authorization form |
|---|---|
| 1. Fred Hutch or UW Investigators, non-transplant-related research | Joint Fred Hutch/UW Protocol Specific HIPAA Authorization Form (approved for use at both Fred Hutch and UW Medicine) See HIPAA Authorization FAQs for more details. You must not change the content of the form; you may only update the protocol number, study title, and PI name on page 1 to reflect the individual study. |
| 2. Fred Hutch Investigators conducting transplant-related research at Fred Hutch or UW | Fred Hutch Transplant Program General HIPAA Authorization Form This form is used for transplant program studies only. Age-specific versions are available via CTMS OnCore. To locate these forms, perform a Document Search in CTMS for the protocol number 'SHELL-CC-HIPAA'. |
| 3. All activities taking place at Seattle Children's | Seattle Children's HIPAA Authorization Form |
Also see Compliance's HIPAA Authorization FAQs page to learn more.
Note: HIPAA authorization forms do not receive IRB approval stamps from the Fred Hutch IRB.
Responsibility for the legal acceptability of HIPAA authorization rests with the covered entity from which researchers will obtain the PHI. Local requirements will vary. To determine what is needed, check with the institution where the PHI resides.
Waiver of HIPAA Authorization
PHI may be used or disclosed for research purposes when the IRB or Privacy Board approves a waiver of authorization.
- Investigators requesting a complete waiver of HIPAA authorization from the Fred Hutch IRB submit the HIPAA Supplement and Waiver of Authorization Form along with the submission in Hutch IRB.
- Those accessing medical records solely for purposes of identifying potential subjects may request a "partial" waiver for recruitment purposes from the Fred Hutch IRB, also using the HIPAA Supplement and Waiver of Authorization Form.
Additional HIPAA Topics
HIPAA Authorization Forms from other covered entities
If a covered entity requires the use of their own stand-alone HIPAA authorization form, their form may be used in place of the Fred Hutch approved HIPAA authorization form. In these situations, provide the following in Hutch IRB:
- A cover memo that outlines the other entity's request to use its HIPAA authorization form
- One copy of each of the covered entity's forms to be included in the IRB file. The form will not receive a Fred Hutch IRB approval stamp.
Inclusion of Covered Entity's HIPAA Authorization Language in Fred Hutch Research Informed Consent Forms
Fred Hutch prefers investigators use a stand-alone HIPAA authorization. To instead include HIPAA language within the research informed consent form (a “blended” HIPAA) requires approval by Fred Hutch Office of General Counsel or the Privacy Office. If advised to do so, provide the following:
- One copy of the consent form with HIPAA language included
The Institutional Review Office facilitates ancillary review of blended HIPAA language by OGC or the Privacy Office prior to IRB review of the consent form.
Revisions to a Currently Approved Stand-alone HIPAA Authorization
Submit the following in Hutch IRB:
- A Modification Supplement that notes the IRB file is being updated with the revised HIPAA authorization
- One copy of the revised HIPAA Authorization for inclusion into the IRB file. The updated form will not receive an IRB approval stamp.
Revisions to Research Informed Consent Forms that have HIPAA Language Inserted within the Consent Forms
Submit the following in Hutch IRB:
- A Modification Supplement
- One copy of the revised consent form
Status Changes (Such as the Request for a New HIPAA Waiver of Authorization)
Submit the following in Hutch IRB:
These changes will be reviewed and approved by the IRB.