Guidance

Request for Waiver of HIPAA Authorization

IRBMED
Feb 7, 2018 2:15 pm

To use and/or disclose Protected Health Information (PHI) for research purposes, the HIPAA Privacy Rule in general requires that researchers obtain signed authorization from the individual. An IRB or Privacy Board can grant a Waiver of HIPAA Authorization to permit use and/or disclosure of PHI for research purposes, without obtaining authorization. Michigan Medicine study teams request full or partial waiver of HIPAA authorization through eResearch Regulatory Management application sections 25-1 and 25-2.

  • Criteria for Waiver

    The following three criteria must be satisfied for an IRB or Privacy Board to approve a waiver of authorization under the Privacy Rule:

    1. The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements: 

    • an adequate plan to protect the identifiers from improper use and disclosure; 
    • an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and 
    • adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;

    2. The research could not practicably be conducted without the waiver or alteration; and

    3. The research could not practicably be conducted without access to and use of the protected health information. 

  • When may a Waiver of Authorization be appropriate?

    Waiver of HIPAA Authorization is often appropriate for:

    • identifying eligible potential subjects for a clinical trial through medical record review (partial waiver)
    • secondary use research on a large set of medical records (full waiver)

    Partial or complete waiver can also be appropriate in other situations.

    Research activities that involve PHI should be conducted whenever practicable with patient authorization.

    Comparison to Waiver of Informed Consent under Common Rule

    A Waiver of HIPAA Authorization is similar to partial or full waiver of informed consent under OHRP (Common Rule) or FDA regulations, but the regulatory criteria are not identical.

    Informed consent processes and HIPAA authorization processes should be compatible in any study that

    • Is subject to IRB oversight, and
    • Involves PHI

    Examples:

    Consent process

    HIPAA authorization How
    Full waiver of informed consent Full waiver of HIPAA authorization Request in eResearch sections 10-3 and 25-2
    Partial waiver of informed consent Partial waiver of HIPAA authorization Request in eResearch sections 10-3 and 25-2
    Request in eResearch sections 10-3 and 25-2 Signed HIPAA authorization IRBMED Informed consent templates incorporate HIPAA authorization
    Waiver of documentation of informed consent Waiver of HIPAA authorization                   

     

    **NOTE: Waiver of documentation is not available for HIPAA authorization

    Request in eResearch sections 10-4 and 25-2

     

    Alterations

    IRBs and Privacy Boards also can approve alterations to the HIPAA authorization requirements, when an alteration is justified by the same criteria of (1) minimal risk to privacy, (2) impracticability of the research without alteration, and (3) impracticability of the research without PHI use and/or disclosure.

  • Authorization Waiver Regulations, Guidance and Policies

     

    Website Approved by IRBMED Chairs and Director: October 14, 2011

    Updated: February 7, 2018

Questions?

Contact us at irbmed@umich.edu or 734-763-4768 / (Fax 734-763-1234)

2800 Plymouth Road, Building 520, Room 3214, Ann Arbor, MI 48109-2800

A list of IRBMED staff is available in the Personnel Directory, or view the list of Regulatory Teams.

Edited By: mhayward@umich.edu
Last Updated: May 31, 2018 1:00 PM