1. 1 Strategies & Protections that Have Worked!: HIPAA & Common Rule Doc Muhlbaier lawrence.muhlbaier@duke.edu PRIM&R – 5 May 2004

2. 2 Duke University Health System n Duke University – hybrid covered entity l Duke Health Enterprise (Affiliated Covered Entity): Health System Schools of Medicine/Nursing/Allied Health Affiliated Organizations l Non-health care University activities are outside of the covered function n IRB is given responsibility for HIPAA implementation in research

3. 3 Duke University Health System HIPAA Implementation Features n Combined ICF & Authorization for Research n Most HIPAA Waivers combined with Common Rule Waivers n IRB Chair signs Data Use Agreements for research n IRB receives HIPAA notices l Review Preparatory to Research l Decedent Research

4. 4 Duke University Health System HIPAA Implementation Tools n IRB Policies l Exemption Policy l Database Policy n Web Tools l Notice of Reviews Preparatory to Research l Disclosure Accounting (ACE provided) (most research activities are uses or with Authorization)

5. 5

6. 6 Duke University Health System Database & Tissue Repository Policy n Handout is still Draft Policy n Check http://irb.mc.duke.edu for final.

7. 7 Duke University Health System HIPAA Data Hierarchy n In Notebook n Provided by NCHICA Members n Helps to determine minimum identifier level

8. 8 Duke University Health System HIPAA Implementation Headaches n Non-patients are covered under HIPAA in this schema l surveys l normal volunteers n Providing Notice of Privacy Practices n Tracking Acknowledgements n Tracking Disclosures

9. 9 Duke University Web Resources n DUHS IRB: http://irb.mc.duke.edu http://irb.mc.duke.edu n NCHICA: www.nchica.org www.nchica.org l AMC & HIPAA conference in June n NIH: http://privacyruleandresearch.nih.gov/