{"id":893,"date":"2022-03-02T10:48:37","date_gmt":"2022-03-02T10:48:37","guid":{"rendered":"https:\/\/az.research.umich.edu\/medschool\/document\/statement-practice-hipaa-and-u-m-study-team-members-outside-michigan-medicine\/"},"modified":"2026-04-13T15:41:00","modified_gmt":"2026-04-13T19:41:00","slug":"statement-practice-hipaa-and-u-m-study-team-members-outside-michigan-medicine","status":"publish","type":"document","link":"https:\/\/az.research.umich.edu\/medschool\/policies\/statement-practice-hipaa-and-u-m-study-team-members-outside-michigan-medicine\/","title":{"rendered":"Statement of Practice: HIPAA and U-M study team members outside Michigan Medicine in eResearch applications"},"template":"","categories":[24],"tags":[91,79,78,57],"content-type":[72],"topic":[43,45,66,75,46],"update-type":[98],"class_list":["post-893","document","type-document","status-publish","hentry","category-institutional-review-boards-irbmed","tag-irbmed-statement-of-practice","tag-principal-investigator","tag-study-coordinator","tag-study-teams","content-type-policies","topic-eresearch-regulatory-management-errm","topic-hipaa-protected-health-information","topic-investigator-study-team-responsibilities","topic-regulations-policies-federal-state-local","topic-statements-of-practice","update-type-new-resource"],"acf":{"use_legacy_editor":true,"updated_date":"2022-03-02 14:30:00","update_notice":false,"author":"IRBMED","summary":"<em>Consult guidance from <a href=\"https:\/\/umhealth.sharepoint.com\/sites\/Corporate-Compliance\/SitePages\/HIPAA-.aspx\">Michigan Medicine Corporate Compliance Office<\/a> (level-2 login required) and <a href=\"\/medschool\/guidance\/hipaa\/\">IRBMED<\/a> for general definitions (PHI, HIPAA, Covered Entity, etc.) and concepts.<\/em>\r\n\r\nThe vast majority of studies subject to IRBMED oversight involve access to Michigan Medicine <a href=\"\/medschool\/guidance\/protected-health-information-phi\">Protected Health Information (PHI)<\/a>. The study team members listed in an IRB application (Section 01) may fall into one of the following categories:\r\n<ul>\r\n \t<li>within the U-M and the <a href=\"https:\/\/umhealth.sharepoint.com\/sites\/Corporate-Compliance\/SitePages\/The-University-of-Michigan-HIPAA-Hybrid-Covered-Entity.aspx\">University of Michigan Hybrid Covered Entity (CE)<\/a> <em>(level-2 login required) <\/em>(Michigan Medicine)<\/li>\r\n \t<li>within the U-M but outside the CE<\/li>\r\n \t<li><a href=\"\/medschool\/guidance\/external-non-um-study-team-members\">external (not affiliated with U-M)<\/a>.<\/li>\r\n<\/ul>\r\nIf you have questions about a member status related to CE, contact the U-M Compliance Office. U-M faculty\/staff\/students\/trainees <u>outside <\/u>the CE do <u>not<\/u> typically view\/access PHI as part of their current appointment\/affiliation with U-M.\r\n\r\nThis document provides guidance on how to complete the IRB application (especially Section 25 HIPAA and sub-sections), for study team members who are <u>within the U-M<\/u> but <u>outside the CE<\/u>. This guidance does <u>not<\/u> apply to study team members within the CE, nor to <a href=\"\/medschool\/guidance\/external-non-um-study-team-members\">external study team members<\/a> or disclosing\u00a0PHI to external entities.","button_links":null,"related_content":[883,745,752],"legacy_path":"statement-practice-hipaa-and-u-m-study-team-members-outside-michigan-medicine","legacy_node_id":1637,"legacy_related_nids":"1533, 285, 293","legacy_content_section":[{"legacy_section_type":"heading","legacy_heading":"Statement of Practice","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"For IRB applications, it is important to identify the status of a study team member (within the CE or outside CE) and how the PHI will be utilized so the IRB application can be reviewed according to the applicable regulations and institutional policies.\r\n<ol>\r\n \t<li>In question 01.8 Project Summary of the IRB application, identify the study team members who are within U-M and outside the CE.\r\nIndicate whether these study team members will have access to Michigan Medicine PHI (i.e., any identifiable health information collected from U-M medical records (Michart, etc.) or the health information collected from a research study and then entered into U-M medical records). Note that the 'dates of service' are also <a href=\"\/medschool\/guidance\/protected-health-information-phi\">considered PHI<\/a>.<\/li>\r\n \t<li>If these members (within-U-M and outside-CE) <strong>will NOT<\/strong> have access to Michigan Medicine PHI:\r\n<ol style=\"list-style-type: lower-alpha\">\r\n \t<li>answer \u201cNo\u201d to any questions <strong><a href=\"\/medschool\/guidance\/eresearch-regulatory-management-errm\">on system-activated pages<\/a><\/strong> asking about sharing PHI outside the CE:\r\n<ul>\r\n \t<li><a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/res_irbmed_eResearch.Application.Section25-2.2011.06.03_0.pdf\">25-2.7<\/a> (HIPAA waiver page)<\/li>\r\n \t<li><a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/res_irbmed_eResearch.Application.Section25-3.2011.06.03_0.pdf\">25-3.3<\/a> (Certification Preparatory to Research)<\/li>\r\n \t<li>25-4.3 (Limited Data Set)<\/li>\r\n<\/ul>\r\n(unless PHI is disclosed outside U-M entirely)<\/li>\r\n \t<li>Secondary Use Research applications: answer \u201cYes\u201d to question 8.1 on page <a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/01-1.2-non-exempt-eR4.4-1.pdf\">01-1.2 (Scope)<\/a> to indicate all PHI is kept within the CE (unless PHI is shared outside U-M entirely).<\/li>\r\n<\/ol>\r\n<\/li>\r\n \t<li>If these members (within U-M and outside the CE) <strong>will <\/strong>have access to Michigan Medicine PHI (generally because Michigan Medicine study team member(s) access\/collect PHI and share it with the U-M study team member outside the CE)\r\n<ol style=\"list-style-type: lower-alpha\">\r\n \t<li>answer \u201cYes\u201d to any questions <strong><a href=\"\/medschool\/guidance\/eresearch-regulatory-management-errm\">on system-activated pages<\/a><\/strong> asking about sharing PHI outside the CE:\r\n<ul>\r\n \t<li><a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/res_irbmed_eResearch.Application.Section25-2.2011.06.03_0.pdf\">25-2.7<\/a> (HIPAA waiver page)<\/li>\r\n \t<li><a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/res_irbmed_eResearch.Application.Section25-3.2011.06.03_0.pdf\">25-3.3<\/a> (Certification Preparatory to Research)<\/li>\r\n \t<li>25-4.3 (Limited Data Set)<\/li>\r\n<\/ul>\r\n<\/li>\r\n \t<li>Secondary Use Research applications: answer \u201cNo\u201d to question 8.1 on page <a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/01-1.2-non-exempt-eR4.4-1.pdf\">01-1.2 (Scope)<\/a>. This will most usually open additional sections (05, 10, and <a href=\"https:\/\/az.research.umich.edu\/medschool\/wp-content\/uploads\/sites\/3\/2024\/12\/res_irbmed_eResearch.Application.Section11.2017.03.28.pdf\">11<\/a>) for the study team to complete to request \u2018standard\u2019 IRB approval.\u00a0(as opposed to <a href=\"\/medschool\/guidance\/exempt-human-subjects-research\">Exempt human subjects research<\/a> determination).<\/li>\r\n \t<li>The Responsible Data Use &amp; Disclosure Attestation document should be completed per the Michigan Medicine <a href=\"https:\/\/michmed-administration.policystat.com\/policy\/6450653\/latest\/\">Limited Data Sets Policy, 01-04-342<\/a> <em>(level-2 login required) <\/em>(U-M internal sharing template is available as an Attachment on the Policy 01-04-342 page).\r\n<ul>\r\n \t<li>Upload the signed copy into the IRB application at 25-4.3 (if system-activated) or 44.1 (additional supporting documents).<\/li>\r\n \t<li>If there is a delay in completing and uploading this document to the IRB application for any reason, communicate this information with the IRB staff and re-submit the IRB application\/submission.<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ol>\r\n<\/li>\r\n<\/ol>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Helpful Notes","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"<ul>\r\n \t<li>IRBMED will not hold the IRB approval for the signed copies of the attestation document. However, completion of the document is important as part of compliance with appropriate U-M policies and HIPAA regulations.<\/li>\r\n \t<li>Per the Michigan Medicine <a href=\"https:\/\/michmed-administration.policystat.com\/policy\/10356462\/latest\/\">Policy 01-04-342<\/a> <em>(level-2 login required)<\/em>\u00a0the attestation document should be utilized for a limited data set scenario, but it is also in use for sharing full PHI. Note that access to and use of PHI must be limited to the minimum necessary to perform the work.<\/li>\r\n \t<li>For any questions regarding the attestation document or a member status as it relates to CE, contact the U-M Corporate Compliance\r\n<ul>\r\n \t<li>phone 734-615-4400<\/li>\r\n \t<li>email <a href=\"mailto:compliance-group@med.umich.edu?subject=Who%20is%20part%20of%20Hybrid%20CE%3F\">compliance-group@med.umich.edu<\/a><\/li>\r\n \t<li>website: <a href=\"https:\/\/umhealth.sharepoint.com\/sites\/Corporate-Compliance\/SitePages\/HIPAA-.aspx\">https:\/\/umhealth.sharepoint.com\/sites\/Corporate-Compliance\/SitePages\/HIPAA-.aspx<\/a> <em>(level-2 login required)<\/em><\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null}],"update_notice_type":[98],"update_notice_start":"2022-03-02 11:30:00","update_notice_end":"2022-04-29 14:00:00","update_notice_text_blocks":[{"update_notice_text":"<p>This new Statement of Practice page codifies guidance from IRBMED regulatory staff on a common situation.<\/p>"}],"global_contact_block":false,"contact_name":"","contact_email":"","contact_additional_info":"Contact us at\u00a0<a href=\"mailto:irbmed@umich.edu\">irbmed@umich.edu<\/a>\u00a0or 734-763-4768 \/ (Fax 734-763-1234)\r\n2800 Plymouth Road, Ann Arbor, MI 48109-2800\r\n\r\nA <a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/institutional-review-boards-irbmed\/irbmed-contacts-roster#irbmed-staff\">list of IRBMED staff<\/a> is available at our website.\r\n\r\nEdited By: <a href=\"mailto:larkspur@umich.edu\">larkspur@umich.edu<\/a>\r\nLast Updated: April 13, 2026 3:40PM","global_contact_block_select":null},"_links":{"self":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/893","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document"}],"about":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/types\/document"}],"version-history":[{"count":2,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/893\/revisions"}],"predecessor-version":[{"id":1965,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/893\/revisions\/1965"}],"acf:term":[{"embeddable":true,"taxonomy":"update-type","href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/update-type\/98"}],"acf:post":[{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/752"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/745"},{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/883"}],"wp:attachment":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/media?parent=893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/categories?post=893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/tags?post=893"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/content-type?post=893"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/topic?post=893"},{"taxonomy":"update-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/update-type?post=893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}