2. Informed Consent and HIPAA Tim Noe Coordinating Center

4. Overview of the Informed Consent Process Why do we need to get consent? Training for staff obtaining consent Setting where consent is obtained Assessing comprehension of participant Providing a copy of consent to participant

5. Why do we need to get consent? Federal regulations (45 CFR, Part 46) As an extra precaution To ensure participants know what they can expect

6. Training for staff obtaining consent All staff who will be obtaining informed consent should complete human subjects protection training. Online courses are offered at http://cme.cancer.gov/clinicaltrials/learni ng/humanparticipant-protections.asp or http://www.citiprogram.org/default.asp

7. Setting The setting where informed consent is obtained should be private The environment should be appropriate (minimal noise and distractions) There should be adequate time to complete the consent process

8. Assessing Comprehension and Autonomy It is very important to assess whether or not a participant understands what s/he is agreeing to do. To assess comprehension it will be important to ask the participant to explain in her/his own words what s/he is agreeing to do. You may also want to ask him/her questions You should also assess if the participant is self-sufficient to make the decision to participate

9. Provide Participant with a Copy of the Consent It is important that every participant receives a copy of the consent form Usually it is best to bring two copies, have the participant sign both, and give her/him one copy Both consents should also be signed by the local Program Director/Coordinator and by the person explaining the consent to the participant

10. Review Sample Consent Form (Appendix U)

11. HIPAA New law, known as “HIPAA” (the Health Insurance Portability and Accountability Act of 1996), requires that we establish new policies and procedures to ensure patient confidentiality. The HIPAA Privacy Rule regulates the use and disbursement of individually identifiable health information and gives individuals the right to determine and restrict access to their health information

12. HIPAA The HIPAA Security Rule requires that reasonable and appropriate technical, physical, and administrative safeguards be taken with electronic individually identifiable health information. Because of HIPAA requirements two types of Authorization are often required (HIPAA Authorization A and B).

13. HIPAA Authorization A allows a health entity to share information about a patient to an outside entity for recruitment purposes Authorization B allows a health care entity to share health information about a patient to outside entities for research and evaluation purposes

14. HIPAA Authorization AHIPAA Authorization B Typical Requirements:  Applies to health care entities only  Providers must have permission to disclose a patient’s name for recruitment by an outside agency  Providers can recruit patients without prior authorization Typical Requirements:  Applies to health care entities only  Participants in evaluation studies must give their permission for personal health information to be shared with other outside of the health care organization  This is usually signed at the same time as a consent form Variability:  Depends on whether or not the person recruiting participants has a clinical relationship with them  Depends on whether the organization is a health care entity  This requirement is usually dependent upon the local HIPAA policy  Evaluators can be granted a waiver if they meet the requirements Variability:  If the data collected are de-identified (no personal identifiers are included in the data), no authorization is required.  Often the best approach is to obtain HIPAA Authorization B from everyone who signs a consent form. This ensures compliance.  Evaluators can be granted a waiver if they meet the requirements

15. IHS IRB Waiver of HIPAA Authorization The National IHS IRB determined that the project is in compliance with HIPAA requirements which allow for a waiver of HIPAA Authorization. Therefore, grantees can access medical records in order to get information to use in recruiting participants into the program without having a HIPAA Authorization A signed by the potential participant. However, as an extra precaution, we still plan to obtain HIPAA Authorization B at the time of consent.

16. Obtaining HIPAA Authorization B Authorization B should be obtained during the Informed Consent Process All guidelines for obtaining consent should be followed (i.e., setting, assessing comprehension, etc) Again, two copies should be signed by the participant and s/he should receive one copy Staff are also encouraged to complete HIPAA Training. Contact your local HIPAA Privacy Officer for information about training opportunities.

17. Review Sample HIPAA Authorization B Form (Appendix U)

18. Questions?