HIPAA and RESEARCH “ 101”

1. HIPAA and RESEARCH“101” HIPAA & Research 101

2. Name Address Telephone Number Fax Number Email Address Date of Birth Social Security Number Medical Record Number Account numbers Diagnosis Test results Dates of Treatment Vehicle ID numbers Device ID numbers Biometrics Photos What is Protected Health Information (PHI)? HIPAA & Research 101

3. Specific Authorization Signed by patient/patient representative. Projects approved after 4/13/03: Authorization to be incorporated into the research informed consent. See ‘Informed Consent Guidelines with HIPAA Language’. Projects approved before 4/13/03: use stand alone Authorization. See ‘Authorization to Release PHI for Research Purposes’. At Continuing Review revise consent to include HIPAA language. Researcher must save for 6 years. Waiver of Authorization PI must submit a ‘Request for Waiver of Authorization’. Waiver must be approved and signed by the IRB. PI must save for 6 years. HIPAA Research Requirements for Using/Disclosing PHI HIPAA & Research 101

4. Exceptions to HIPAA Authorization or WaiverIf the Research falls into one of the following 4 categories, it does not require HIPAAA review by the IRB, however, it still requires IRB review and approval • De-Indentified PHI • PHI used to ‘develop’ a research proposal • PHI of Deceased Individuals • Limited Data Set HIPAA & Research 101

5. 1. DE-IDENTIFIED PHI • Limited identifiers may remain if, even in combination, the identifiers could not realistically be traced to an individual patient. • Example: zip code and date of admission/service • Submit proposal for IRB review and approval. HIPAA & Research 101

6. 2. PHI Used Preparatory to Research • PHI can not be removed from covered entity (Children’s). • PI must submit a ‘Data Collection for Review Preparatory to Research’ form to the IRB with proposal for review and approval. HIPAA & Research 101

7. 3. PHI of Deceased Individuals • PI must submit a ‘Research on Decedent’s Information’ form to the IRB with proposal for review and approval. HIPAA & Research 101

8. A Limited Data Set may include: Town, city, state and zip code. Elements of dates directly related to an individual including: Birth Date Admission Date Discharge Date Date of Death A Limited Data Set must exclude: Direct identifiers of the individual or their relatives, employers, or household members. Name Address (other than town, city, state,zip code) Telephone and/or Fax numbers Email address Social Security Number Medical Record Number Health Plan numbers Account Numbers Certificate/Licenses numbers Vehicle Identifiers Device Identifers Biometric Identifiers Full face photos Any other number, characteristic or code that could be used to identify the individual 4. Limited Data SetThere must be a ‘Data Use Agreement’ between Children’s and the recipient of the Limited Data Set HIPAA & Research 101

9. IRB approval before 4/13/03 Patients enrolled after 4/13/03 must sign an Authorization to Release PHI for Research Purposes. See ‘Authorization to Release Protected Health Information for Research Purposes’. When annual Continuing Review is due a revised informed consent incorporating HIPAA language must be reviewed and approved by the IRB. IRB approval after 4/13/03 Informed Consent with HIPAA language must be reviewed and approved by the IRB. IRB approval after 10/31/03 Informed Consent and Stand Alone Authorization must be reviewed and approved by the IRB. How can you be HIPAA Compliant? HIPAA & Research 101

10. For Clinical Purposes only: No IRB Requirement For Research Purposes: Submit proposal to IRB for review and approval with Informed Consent containing HIPAA language; OR Submit proposal to IRB for review and approval with ‘Request for Waiver of Authorization’ and waiver of informed consent. DATA BASES CONTAINING PHI HIPAA & Research 101