Waiver or Alteration of HIPAA Authorization

The following three criteria must be satisfied for an IRB to approve a waiver of authorization under the Privacy Rule:

1. The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:

• an adequate plan to protect the identifiers from improper use and disclosure;
• an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
• adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;

2. The research could not practicably be conducted without the waiver or alteration; and

3. The research could not practicably be conducted without access to and use of the protected health information.

Waiver of HIPAA Authorization is often appropriate for:

• identifying eligible potential participants for a clinical trial through medical record review (Part of the project)
• secondary use research on a large set of medical records (Entire project)

Waiver for part of a project, or an entire project, can also be appropriate in other situations.

Research activities that involve PHI should be conducted whenever practicable with patient authorization.

• It may be feasible to obtain signed authorization from each individual in a small data set.
• Data custodians may be able to provide a study team with a de-identified or Limited Data Set that fulfills the research needs. Contact the UMMS Data Office for Clinical and Translational Research.

Any of the HIPAA authorization requirements in 45 CFR 164.508 can be altered (modified or removed) by the IRB.  The most frequent HIPAA alterations accompany a waiver of documentation of informed consent under 45 CFR 46.117(c)(1):

• Removal of the requirement that the participant signs and dates the HIPAA authorization form
• Removal of the requirement that the participant receives a copy of the signed, dated form

A Waiver of HIPAA Authorization is similar to waiver of informed consent under OHRP (Common Rule) or FDA regulations, but the regulatory criteria are not identical.

Informed consent processes and HIPAA authorization processes should be compatible in any study that

• Is subject to IRB oversight, and
• Involves PHI

• 45 CFR 164.512(i)(1)(i) and 45 CFR 164.512(i)(2)
• Office of Civil Rights main HIPAA Privacy site
  • Research and HIPAA Privacy Rule page. Heading: “Documented Institutional Review Board (IRB) or Privacy Board Approval.”
• HIPAA Privacy Rule Information for Researchers from NIH
  • Waiver or Alteration of the Authorization Requirement
• U-MIC IRB Board Tip: The HIPAA Privacy Rule: Requirements and Waivers
• IRBMED Educational Course Offerings including “HIPAA Requirements and Waivers of Authorization”