{"id":764,"date":"2018-05-07T11:52:18","date_gmt":"2018-05-07T11:52:18","guid":{"rendered":"https:\/\/az.research.umich.edu\/medschool\/document\/waiver-or-alteration-hipaa-authorization\/"},"modified":"2026-04-15T09:16:53","modified_gmt":"2026-04-15T13:16:53","slug":"waiver-or-alteration-hipaa-authorization","status":"publish","type":"document","link":"https:\/\/az.research.umich.edu\/medschool\/guidance\/waiver-or-alteration-hipaa-authorization\/","title":{"rendered":"Waiver or Alteration of HIPAA Authorization"},"template":"","categories":[24],"tags":[],"content-type":[41],"topic":[45],"update-type":[],"class_list":["post-764","document","type-document","status-publish","hentry","category-institutional-review-boards-irbmed","content-type-guidance","topic-hipaa-protected-health-information"],"acf":{"use_legacy_editor":true,"updated_date":"2020-09-21 15:00:00","update_notice":false,"author":"IRBMED","summary":"To use and\/or disclose\u00a0Protected Health Information (PHI)\u00a0for research purposes, the\u00a0<a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/hipaa\">HIPAA Privacy Rule<\/a>\u00a0<strong>in general<\/strong>\u00a0requires that researchers obtain signed authorization from the individual. An IRB can grant a Waiver of HIPAA Authorization to permit\u00a0<a href=\"https:\/\/az.research.umich.edu\/medschool\/document\/uses-disclosures-protected-health-information-phi\/\">use and\/or disclosure<\/a>\u00a0of\u00a0<a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/protected-health-information-phi\">PHI<\/a>\u00a0for research purposes, without obtaining authorization. An IRB may also approve an alteration of the requirements of written HIPAA Authorization provided the research meets the criteria for waiver or alteration (see info below).\r\n\r\nMichigan Medicine\u00a0study teams request waivers and alterations of HIPAA authorization through\u00a0<a href=\"http:\/\/www.umich.edu\/~eresinfo\/rm.html\">eResearch Regulatory Management<\/a>\u00a0application sections 25-1 (select the box for waiver) and 25-2 (complete the waiver request).\r\n\r\n<strong>NOTE<\/strong>: If the HIPAA authorization will be<a href=\"\/medschool\/guidance\/informed-consent-procedures-using-electronic-systems-and-remote-use-paper\"> obtained electronically<\/a>, the electronic medium should be HIPAA compliant. For example: <a href=\"https:\/\/its.umich.edu\/enterprise\/administrative-systems\/signnow\/guidance-on-use\">SignNow<\/a> or <a href=\"https:\/\/www.qualtrics.com\/support\/survey-platform\/survey-module\/editing-questions\/question-types-guide\/specialty-questions\/signature\/\">Qualtrics with signature question<\/a>.","button_links":null,"related_content":[744,745,752,885],"legacy_path":"waiver-or-alteration-hipaa-authorization","legacy_node_id":306,"legacy_related_nids":"284, 285, 293, 1551","legacy_content_section":[{"legacy_section_type":"heading","legacy_heading":"Criteria for Waiver or Alteration","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"The following three criteria must be satisfied for an <a class=\"gtip\" href=\"\/medschool\/glossary\/institutional-review-board-irb\">IRB<\/a> to approve a waiver of authorization under the\u00a0<a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/guidance\/research\/index.html\">Privacy Rule<\/a>:\r\n\r\n1. The use or disclosure of protected health information involves<strong>\u00a0no more than a <a class=\"gtip\" href=\"\/medschool\/glossary\/minimal-risk-0\">minimal risk<\/a> to the privacy<\/strong> <strong>of individuals<\/strong>, based on, at least, the presence of the following elements:\r\n<ul>\r\n \t<li>an adequate plan to protect the identifiers from improper use and disclosure;<\/li>\r\n \t<li>an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the <a class=\"gtip\" href=\"\/medschool\/glossary\/research\">research<\/a>, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and<\/li>\r\n \t<li>adequate written <a class=\"gtip\" href=\"\/medschool\/glossary\/assurance\">assurances<\/a> that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;<\/li>\r\n<\/ul>\r\n2. The research\u00a0<strong>could not practicably be conducted without the waiver\u00a0<\/strong>or alteration; and\r\n\r\n3. The research<strong>\u00a0could not practicably be conducted without<\/strong>\u00a0access to and use of\u00a0the <strong>protected health information.<\/strong>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"When Is This Appropriate?","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area_with_subheading","legacy_heading":"","legacy_subheading":"Waiver","legacy_section_text":"Waiver of <a class=\"gtip\" href=\"\/medschool\/glossary\/hipaa\">HIPAA<\/a> Authorization is often appropriate for:\r\n<ul>\r\n \t<li>identifying <a class=\"gtip\" href=\"\/medschool\/glossary\/eligible\">eligible<\/a> potential participants for a <a class=\"gtip\" href=\"\/medschool\/glossary\/clinical-trial\">clinical trial<\/a> through medical record review (Part of the project)<\/li>\r\n \t<li><a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/secondary-use-research\/\">secondary use research<\/a> on a large set of medical records (Entire project)<\/li>\r\n<\/ul>\r\nWaiver\u00a0for part of a project, or an entire project, can also be appropriate in other situations.\r\n\r\nResearch activities that involve PHI\u00a0<strong>should<\/strong>\u00a0be conducted\u00a0<strong>whenever practicable<\/strong>\u00a0with patient authorization.\r\n<ul>\r\n \t<li>It may be feasible to obtain signed authorization from each individual in a small data set.<\/li>\r\n \t<li>Data custodians may be able to provide a study team with a\u00a0<a href=\"https:\/\/privacyruleandresearch.nih.gov\/pr_08.asp#8a\">de-identified<\/a>\u00a0or\u00a0<a href=\"https:\/\/privacyruleandresearch.nih.gov\/pr_08.asp#8d\">Limited Data Set<\/a>\u00a0that fulfills the research needs. Contact the <a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/data-office-clinical-translational-research\">UMMS\u00a0Data Office for Clinical and Translational Research<\/a>.<\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area_with_subheading","legacy_heading":"","legacy_subheading":"Alteration","legacy_section_text":"Any of the HIPAA authorization requirements in <a href=\"https:\/\/www.ecfr.gov\/current\/title-45\/subtitle-A\/subchapter-C\/part-164\/subpart-E\">45 CFR 164<\/a>.508 can be altered (modified or removed) by the IRB. \u00a0The most frequent HIPAA alterations accompany a waiver of documentation of informed consent under <a href=\"https:\/\/www.ecfr.gov\/current\/title-45\/subtitle-A\/subchapter-A\/part-46#subpart-A\">45 CFR 46<\/a>.117(c)(1):\r\n<ul>\r\n \t<li>Removal of the requirement that the participant signs and dates the HIPAA authorization form<\/li>\r\n \t<li>Removal of the requirement that the participant receives a copy of the signed, dated form<\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Requesting Waivers and Alterations in eResearch","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area_with_subheading","legacy_heading":"","legacy_subheading":"Comparison to Informed Consent Regulations under Common Rule","legacy_section_text":"A Waiver of HIPAA Authorization is similar to waiver of\u00a0informed consent\u00a0under\u00a0OHRP (Common Rule) or FDA regulations, but <a href=\"https:\/\/az.research.umich.edu\/medschool\/guidance\/waivers-and-alterations-under-ohrp-fda-and-hipaa\/\">the\u00a0regulatory criteria are not identical<\/a>.\r\n\r\nInformed consent processes and <a class=\"gtip\" href=\"\/medschool\/glossary\/health-insurance-portability-and-accountability-act-1996-hipaa\">HIPAA<\/a> authorization processes should be compatible in any study that\r\n<ul>\r\n \t<li>Is subject to <a class=\"gtip\" href=\"\/medschool\/glossary\/institutional-review-board-irb\">IRB<\/a> oversight, and<\/li>\r\n \t<li>Involves <a class=\"gtip\" href=\"\/medschool\/glossary\/protected-health-information-phi\">PHI<\/a><\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area_with_subheading","legacy_heading":"","legacy_subheading":"Examples:","legacy_section_text":"<table style=\"width: 500px\" border=\"1\" cellspacing=\"1\" cellpadding=\"1\">\r\n<tbody>\r\n<tr>\r\n<td><strong>Consent process<\/strong><\/td>\r\n<td><strong>HIPAA authorization<\/strong><\/td>\r\n<td><strong>How<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Waiver of <a class=\"gtip\" href=\"\/medschool\/glossary\/informed-consent\">informed consent<\/a> for \"ALL of the study\"<\/td>\r\n<td>Waiver of <a class=\"gtip\" href=\"\/medschool\/glossary\/hipaa\">HIPAA<\/a> authorization for \"Entire project\"<\/td>\r\n<td>Request consent waiver in <a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/10-3-non-exempt.pdf\">Section 10-3<\/a>\r\nRequest HIPAA waiver in <a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/res_irbmed_eResearch.Application.Section25-2.2011.06.03_0.pdf\">Section 25-2<\/a><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Waiver of informed consent for \"part of the study\u201d<\/td>\r\n<td>Waiver of HIPAA authorization for specific purpose chosen in 25-2.1<\/td>\r\n<td>Request consent waiver in Sec 10-3\r\n\r\nRequest HIPAA waiver in Sec 25-2<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Signed (or, Written) informed consent<\/td>\r\n<td>Signed HIPAA authorization<\/td>\r\n<td>IRBMED\u00a0<a href=\"https:\/\/az.research.umich.edu\/medschool\/templates\/standard-informed-consent-template\/\">Informed consent templates<\/a>\u00a0incorporate HIPAA authorization<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Waiver of documentation of informed consent<\/td>\r\n<td>Alteration of HIPAA authorization to remove the documentation requirement<\/td>\r\n<td>Request Documentation waiver in Section 10-4\r\n\r\nEnter \u201dHIPAA alteration\u201d as the type in question 25-2.1 and fill out the rest of Sec 25-2.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n&nbsp;","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"See Also","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"<ul>\r\n \t<li>45 CFR 164.512(i)(1)(i) and <a href=\"https:\/\/www.ecfr.gov\/current\/title-45\/subtitle-A\/subchapter-C\/part-164#subpart-E\">45 CFR 164<\/a>.512(i)(2)<\/li>\r\n \t<li>Office of Civil Rights\u00a0main <a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/index.html\">HIPAA Privacy<\/a> site\r\n<ul>\r\n \t<li><a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/guidance\/research\/index.html\">Research<\/a>\u00a0and HIPAA Privacy Rule page. Heading: \"Documented <a class=\"gtip\" href=\"\/medschool\/glossary\/institutional-review-board-irb\">Institutional Review Board (IRB)<\/a> or Privacy Board Approval.\"<\/li>\r\n<\/ul>\r\n<\/li>\r\n \t<li><a href=\"https:\/\/hrpp.umich.edu\/u-mic\/\">U-MIC<\/a>\u00a0IRB Board Tip: The\u00a0HIPAA Privacy Rule: Requirements and Waivers<\/li>\r\n \t<li><a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/institutional-review-boards-irbmed\/irbmed-education\">IRBMED Educational<\/a>\u00a0Course Offerings\u00a0including \"HIPAA Requirements and Waivers of Authorization\"<\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null}],"update_notice_type":[],"update_notice_start":"2020-09-21 12:30:00","update_notice_end":"2020-11-21 14:00:00","update_notice_text_blocks":null,"global_contact_block":false,"contact_name":"","contact_email":"","contact_additional_info":"Contact us at\u00a0<a href=\"mailto:irbmed@umich.edu\">irbmed@umich.edu<\/a>\u00a0or 734-763-4768 \/ (Fax 734-763-1234)\r\n2800 Plymouth Road, Ann Arbor, MI 48109-2800\r\n\r\nA <a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/institutional-review-boards-irbmed\/irbmed-contacts-roster#irbmed-staff\">list of IRBMED staff<\/a> is available at our website.\r\n\r\nEdited By: <a href=\"mailto:larkspur@umich.edu\">larkspur@umich.edu<\/a>\r\nLast Updated: April 15, 2026 9:15AM","global_contact_block_select":null},"_links":{"self":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/764","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document"}],"about":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/types\/document"}],"version-history":[{"count":1,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/764\/revisions"}],"predecessor-version":[{"id":1979,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/764\/revisions\/1979"}],"acf:post":[{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/885"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/752"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/745"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/744"}],"wp:attachment":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/media?parent=764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/categories?post=764"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/tags?post=764"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/content-type?post=764"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/topic?post=764"},{"taxonomy":"update-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/update-type?post=764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}