1 HIPAA, Researchers and the IRB: Part Two Alan Homans, IRB Chair and Nancy Stalnaker, IRB Administrator

2 Introduction AGAIN… Don’t kill the messenger – we didn’t write this rule!Don’t kill the messenger – we didn’t write this rule! Be kind – we do NOT have all the answers – but we do want to hear the questions - we will will continue to work towards answering them.Be kind – we do NOT have all the answers – but we do want to hear the questions - we will will continue to work towards answering them.

3 What Research is Affected? Privacy rule applies to research that uses Protected Health Information (PHI). PHI is individually identifiable health information received from a covered entity.

4 What Research is Affected? Three categories of identifiability: Three categories of identifiability: 1.PHI – Identifiable – rule applies 2.De-Identified Information - rule does not apply 3.Limited Data Set – a middle option - limited parts of the rule apply

5 What Research is Affected? “De-Identified” – there are 18 specific identifiers which must be removed to be considered de- identified – thus not covered by rule.“De-Identified” – there are 18 specific identifiers which must be removed to be considered de- identified – thus not covered by rule. Limited Data Set – Not fully “de-identified” – can retain certain dates, geographic info and unique identifying numbers. Most privacy rule requirements do not apply, the minimum necessary standard does apply and a data use agreement is required.Limited Data Set – Not fully “de-identified” – can retain certain dates, geographic info and unique identifying numbers. Most privacy rule requirements do not apply, the minimum necessary standard does apply and a data use agreement is required.

6 18 Items Which Must Be Removed to Be “De-identified” 1.Names 2.ALL geographic subdivisions smaller than the state 3.All elements of dates smaller than a year (i.e. birth date, admission, discharge, death, etc.) 4.Phone numbers 5.Fax numbers 6. addresses 7.SS numbers 8.Medical record number 9.Health plan beneficiary

7 10.Any other account numbers 11.Certificate/license numbers 12.Vehicle identifiers 13.Device identification numbers 14.WEB URL's 15.Internet IP address numbers 16.Biometric identifiers (fingerprint, voice prints, retina scan, etc) 17.Full face photographs or comparable images 18.Any other unique number, characteristic or code. 19.Diagnoses are not included in this list 18 Items Which Must Be Removed to Be “De-identified” (continued)

8 How to obtain PHI for research? 1.Authorization from Research Subject 2.Waiver of Authorization

9 Elements of Authorization Required elements in an authorizationRequired elements in an authorization  Specific and meaningful description of what information will be used or disclosed  Who may use or disclose  To whom the PHI will be disclosed  Why the use or disclosure is being made (each purpose) Notice that authorization may be revoked;  Notice that the information may be disclosed to others not subject to the Privacy Rule

10 Elements of Authorization II Required elements in an authorizationRequired elements in an authorization  Statement of how long the use or disclosure will continue (no expiration date is allowed for research purposes - but this must be explicitly stated in the authorization form)  Notice that the covered entity may or may not condition treatment or payment on the individual’s signature  Individual’s signature and date Required elements in an authorizationRequired elements in an authorization  Statement of how long the use or disclosure will continue (no expiration date is allowed for research purposes - but this must be explicitly stated in the authorization form)  Notice that the covered entity may or may not condition treatment or payment on the individual’s signature  Individual’s signature and date

11 How to obtain Authorization? The Draft FAHC Authorization language template is now finished and will be piloted beginning this week. It is a SEPARATE document to be executed in addition to the Informed Consent Document.

12 How to obtain Authorization Protocols Approved Prior to 4/14/03: Surveys were sent to PIs to determine which approved protocols will require authorization (PHI + new accruals after 4/14/03).Surveys were sent to PIs to determine which approved protocols will require authorization (PHI + new accruals after 4/14/03). Forms and processes will be piloted beginning this week and adjustments made.Forms and processes will be piloted beginning this week and adjustments made. IRB will PIs having protocols identified as needing an authorization with instructions and the template, as soon as possible.IRB will PIs having protocols identified as needing an authorization with instructions and the template, as soon as possible.

13 How to obtain Authorization? Review of authorization forms for existing protocols will be done on a first-come, first-serve basis – if you know you will be entering new subjects soon after 4/14/03, get your authorizations as soon as possible.

14 How to obtain Authorization? NEW PROTOCOLS: The process for determining which new protocols will require authorization is currently being developed, including a revision to our protocol cover sheet. We will let you know as soon as this is available.

15 How to obtain Waiver of Authorization? In research, authorization is not required if it meets the criteria for waiver outlined in the privacy rule.

16 No more than minimal riskNo more than minimal risk Not adversely affect rights and welfare of subjectsNot adversely affect rights and welfare of subjects Research cannot be done without waiverResearch cannot be done without waiver When appropriate, information will be provided to subjects of researchWhen appropriate, information will be provided to subjects of research No more than minimal risk to privacy, based on, at least:  Plan to protect identifiers  Plan to destroy identifiers ASAP  Written assurance that PHI will not be used/disclosed with few exceptions Research cannot be done without waiver, and Research cannot be done without this PHI COMMON RULEPRIVACY RULE CRITERIA FOR WAIVER OF AUTHORIZATION

17 How to obtain Waiver of Authorization? The process and forms are currently being developed to address the required criteria necessary for the IRB to approve a waiver. We will let you know when these are available.

18 TRANSITION TO PRIVACY RULE Compliance date: April 14, 2003Compliance date: April 14, 2003 If you have a waiver of consent under the common rule prior to 4/14/03, you do NOT need to apply for a waiver under HIPAAIf you have a waiver of consent under the common rule prior to 4/14/03, you do NOT need to apply for a waiver under HIPAA All new enrollment of subjects on research involving PHI falls under HIPAA & requires an authorizationAll new enrollment of subjects on research involving PHI falls under HIPAA & requires an authorization

19 Authorization/Waiver Reminders If you need to do an authorization, the IRB will contact you to inform you what you need to do If you need to do an authorization, the IRB will contact you to inform you what you need to do If you haven’t completed your survey yet, please do so immediately! If you haven’t completed your survey yet, please do so immediately! HIPAA is in addition to current IRB human subject requirements - when both regulations apply, both requirements must be followed. HIPAA is in addition to current IRB human subject requirements - when both regulations apply, both requirements must be followed.

20 DATABASES/REGISTRIES HIPAA will add a new level of scrutiny to use of all PHIHIPAA will add a new level of scrutiny to use of all PHI UVM and FAHC need to place ourselves in the best compliance position possibleUVM and FAHC need to place ourselves in the best compliance position possible

21 DATABASES/REGISTRIES In order to ensure that the development, maintenance and release of data involving PHI meets these requirements, we will be surveying all researchers about existing databases.In order to ensure that the development, maintenance and release of data involving PHI meets these requirements, we will be surveying all researchers about existing databases. Processes are being developed for the IRB to review existing databases and, when appropriate, approve waiver of consent and/or authorization.Processes are being developed for the IRB to review existing databases and, when appropriate, approve waiver of consent and/or authorization.

22 DATABASES/REGISTRIES Model procedures for developing and operating databases and registries will be drafted and made available upon completion.Model procedures for developing and operating databases and registries will be drafted and made available upon completion.