HIPAA FAQS

F​AQs CONCERNING the HIPAA PRIVACY RULE in RESEARCH at UI

1. Can I keep screening logs?  Can I send screening logs to the study sponsor?

2. The sponsor has asked for changes in the UI Informed Consent Document template for the HIPAA section 'Will My Health Information be Used in This Study?'.  Can we make those changes?

3. The sponsor has developed a separate authorization form and wants subjects to sign the sponsor's form, along with the UI Informed Consent Document.  Can we do that?

4. I want to do a retrospective chart review study.  Do I have to write to the patients to get their permission first?

5. What's the difference between the Privacy Notice that UIHC patients receive when they are admitted and the authorization in the Informed Consent Document?

6. Does the HIPAA privacy rule require any changes in the way we store Consent Documents and data collection forms, or store computer records?

7. How should I explain the HIPAA privacy rule section in the Consent Document when explaining the study to a potential subject?

1.  Can I ke​ep screening logs?  Can I send screening logs to the study sponsor?

Let's presume the screening log contains some sort of identifier the persons initials and date of admission or clinic visit, or the hospital number, or some other way that you would be able to figure out who each person is along with other demographic information and the reason the person was not eligible for the study.  Such information may be kept by the research team so long as it does not leave the University.  Appropriate measures should be taken to protect the confidentiality of the information, such as keeping identifiers to a minimum, keeping the information in a file cabinet, and so on.  Screening log information may NOT be sent to the study sponsor UNLESS the IRB has approved a waiver of consent/authorization on the New Project application form, or the investigator has obtained consent/authorization from each person whose name is on the log.

2.  The s​ponsor has asked for changes in the UI Informed Consent Document template for the HIPAA section 'Will My Health Information be Used in This Study?'.  Can we make those changes?

No.  The language in the Consent Document has been approved by UIHC and the University's privacy officer and may not be changed.  The University is the covered entity, and as such, has both the responsibility and the liability for complying with the rule, rather than the sponsor.  In addition, the University has defined itself as a hybrid entity, which has implications for the wording of the authorization language used in the Consent.

3.  The sponsor has developed a separate authorization form and wants subjects to sign the sponsor's form, along with the UI Informed Consent Document.  Can we do that?

No, all study materials presented to the subject must be approved by the IRB.  Only the UI authorization language may be used, and that language is included within the Informed Consent Document.

4.  I want to do a retrospective ch​art review study.  Do I have to write to the patients to get their permission first?

Generally not.  Most retrospective chart reviews involve a large number of records, and therefore the IRB would consider it impracticable (not possible) to do the study if informed consent and authorization were required.  However, the investigator must answer the waiver of consent/authorization questions (section IV.3) on the New Project application form.  It is possible that the IRB would require consent and authorization if a retrospective chart review involved a small number of records from recently-seen patients.  

5.  What's the difference between the Privacy Notice that UIHC patients receive when they are admitted and the authorization in the Informed Consent Document?

Health care and research fall into two different worlds in the Privacy Rule regulations.   An institution providing health care must notify patients regarding how it will use and disclose the patients health information for treatment, payment, and health care operations.  Patient permission is not required for the institution to carry out these activities.  The privacy rule stipulates that research is not included in the definition of treatment, payment, and health care operations, and patients must give their permission for the research use or disclosure of their health information, even if the researcher is the same individual who provides treatment to the patient outside of a research context.

6.  Does the HIPAA privacy rule require any changes in the way we store Consent Documents and data collection forms, or store computer records?

Probably not.  Even before the privacy rule took effect, the IRB expected investigators to protect subject confidentiality.  UI Investigators Guide (Chapter 5.D.) describes issues to consider in protecting subject confidentiality.  The same measures for protecting subject confidentiality would still be expected.  The privacy rule requires, however, that study subjects be given specific information about how their personal information will be used/shared during the course of a study.  This generally means that more detail is now included in a Consent Document.

7.  How should I explain the HIPAA privacy rule section in the Consent Document when explaining the study to a potential subject?

The federal government has set up some regulations concerning how your health information can be used and shared.  You've probably been given a Privacy Notice about how the hospital will use and share your health information.  You dont need to give your permission to the hospital for the way it will use your health information in providing care or treatment.  But research studies are different.  To be in a research study that uses your health information, you need to give specific permission so that your health care provider can share that information with the researcher, even if the researcher is also your regular doctor.  The section titled 'Will My Health Information be Used in This Study?' explains that to be in the research study, we need your permission to use your health information.