1. HIPAA 2017 JHSPH IRB Clarifications and Changes
Accessing protected health information from Johns Hopkins Medicine

2. Quick Review of Hipaa & research
Protected Health Information (PHI): Individually identifiable health information that is transmitted or maintained in any form or medium (electronic, oral, or paper) by a covered entity or its business associates

3. “covered entity”
Health Care Provider: Doctor, Hospital, Clinic, Pharmacy, Chiropractor, Dentist, Psychologist, Nursing Home - but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.
Health Plan: Health Insurance Companies, HMOs, Company Health Plans, Government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans health care programs
Health Care Clearinghouse: Entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa

4. Clarifications for JHM
Some People Think
Clarifications for JHM
PHI “once disclosed” for research is still PHI
IRB must grant a waiver to access medical records for recruitment
Researchers may access medical records, with permission from clinicians
PHI properly disclosed for research is no longer covered by HIPAA
HIPAA permits access to medical records for recruitment “Preparatory to Research” without authorization or waiver
Only “HIPAA Workforce Members” may access medical records

5. What is “Proper disclosure” for research?
Disclosure of PHI after obtaining signed HIPAA Authorization from research participant
Disclosure of PHI “Preparatory to Research”
Disclosure of PHI via HIPAA Waiver approved by the IRB
Disclosure of PHI via Limited Data Set created by JHHS Workforce Member (likely an Honest Broker)
Disclosure of PHI for Research on Decedents Only

6. HIPAA Privacy Authorizations
Are usually combined with informed consent document and are signed
Specific regulatory requirements are included in JHSPH consent/authorization template
Data disclosed via authorization for research are no longer “PHI” under HIPAA, but are “sensitive private information” requiring appropriate data security protections

7. Preparatory to research
REQUIREMENTS FOR JHM RECRUITMENT
Access to PHI only by a “JHHS HIPAA Workforce Member”
Access to PHI must be to identify potential participants “within the covered entity”
Clinician with treatment relationship must first contact potential participant to get permission for disclosure
Clinicians must record patient permission to disclose PHI to researcher in patient medical record
Disclosure to researcher is limited to “minimum necessary” information for eligibility and contact

8. Jhm HIPAA WORKFORCE MEMBERS
Credentialed JHHS-privileged professional or staff who have access to EPIC for patient care (credentialed JHHS Workforce Member)
Students in health care professions (SON, SOM, SPH) who access PHI under direction of credentialed JHHS Workforce Member and who have signed a HIPAA Workforce Agreement
JHU Research Personnel (faculty, staff) working under direction of credentialed JHHS Workforce Member who have signed HIPAA Workforce Agreement
JHU Research Personnel serving as JH Privacy Office credentialed “Honest Brokers”

9. Preparatory to research Recruitment mechanism #1
Contacting the potential participant within the covered entity:
Clinician with treatment relationship must ask patient for permission to disclose PHI to researcher
Clinician must document permission to disclose “minimum necessary” PHI (name, eligibility criteria) to researcher in medical record
Researcher contact with potential participant must occur in the covered entity
PHI cannot leave the covered entity

10. PREPARATORY TO RESEARCH RECRUITMENT MECHANISM #2
Contacting the potential participant outside the covered entity
Clinician with a treatment relationship must contact potential participant (by mail, phone, etc.) to ask permission to disclose PHI to researcher
Clinician must be added to study as co-investigator and must document permission to disclose in the patient’s medical record
Researcher may use the PHI to contact the potential participant outside the covered entity
The IRB must waive/alter the signature requirement for consent/authorization, allowing record of patient permission in medical record to serve as documentation
Researcher must obtain a signed consent/authorization from participants if the research involves access/use of additional PHI

11. HIPAA Waiver: Regulatory Requirements
The use or disclosure of PHI must pose no more than minimal risk to privacy of individuals because:
Researcher provides adequate plan to protect identifiers
Researcher provides adequate plan to destroy identifiers
Researcher provides written assurance that the PHI will not be reused or disclosed, with a few exceptions
The research could not practicably be conducted without the Waiver
The research could not practicably be conducted without the PHI
Disclosures of JHM PHI under HIPAA Waiver must be tracked

12. When is HIPAA Waiver likely to be approved?
For recruitment in circumstances for which it is impracticable to have a clinician with a treatment relationship contact potential participants (expected to be rare at JHM)
Most likely cases:
For secondary data analysis of existing, identifiable data
For broad program evaluation

13. Tracking for approved JHM HIPAA waivers
Patients have the right to an accounting for all disclosures of PHI under an IRB approved HIPAA Waiver, up to 6 years post-disclosure
Researchers with fewer than 50 JHM participants must track the disclosures in the SPH JH Compliance Tracking System ( Compliance/)
Researchers with 50 or more JHM participants will have their studies reported by the IRB to the JHM Privacy Office

14. Limited data set and de-identified data set
Must be created by credentialed JHHS Workforce Member
May include:
Admission, discharge, service dates
DOB, DOD
Age, including 90 and over
Five digit zip code or any other geographic subdivision, such as state, county, city, precinct, census tract and equivalent geocodes except street address

15. Use of decedents’ information
Deceased individuals are not “human subjects” under the DHHS Common Rule, but are protected under HIPAA
Researchers seeking to use Decedent PHI must be JHHS Workforce Members
Researchers must obtain IRB permission to use PHI of deceased individuals by completing HIPAA Form 5, “Representations Form for Research Involving Only Decedents’ Information” board/hipaa_research/forms.html