HIPAA WORKSHEET Guidance for Investigators using Health information for Research Purposes Federal regulations concerning the use and disclosure of an individual's health information impact research. The provisions of the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA), which took effect on April 14, 2003, are complex and offer several options for researchers. This worksheet will assist you in selecting the appropriate option. 1. HEALTH INFORMATION: Does your research protocol propose to use or create health information concerning the past, present or future physical or mental condition of your research subjects, or will you need to access medical records in order to collect information about your research subjects? If you answered NO, stop here. You do not need to answer any additional questions. You do not need to take any action to bring your research into compliance with the HIPAA Privacy Rule.
2. INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION: If you answered YES, review the general categories of personal information about your research subjects that you will be using for your study. This information includes any of the following identifiers of the individual or of relatives, employers, or household members of the individual as listed below. Determine if you will be using information described in any of the following categories. 1. 2. _____Names _____Geographic information smaller than a State except for the initial 3 digits of a zip code, including street address, city, county and precinct. _____All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, etc. and all ages 89 or over and all elements of dates (including year) indicative of such age. _____Telephone numbers _____Fax numbers _____Electronic mail addresses _____Social security numbers _____Medical record numbers _____Health plan beneficiary numbers _____Account numbers _____Certificate / license numbers _____Vehicle identifiers and serial numbers, including license plate numbers _____Device identifiers and serial numbers
3.
4. 5. 6. 7. 8. 9. 10. 11. 12. 13.
14. 15. 16. 17. 18.
_____Web Universal Resource Locators (URLs) _____Internet Protocol (IP) address numbers _____Biometric identifiers, including finger and voice prints _____Full face photographic images and any comparable images _____Any other unique identifying number, characteristic, code, re-identification algorithm or general knowledge that the information collected in your protocol could be used alone or in combination with other available information to identify an individual who is a subject of the information. If you are not using any of these identifiers, your research information is considered "de-identified." De-identified information is not subject to the HIPAA Privacy Regulations. Please complete and submit the "Certification of De-Identification" Form as part of your submission to the IRB. You do not need to answer any additional questions on this worksheet.
3. TYPE OF RESEARCH: If you checked off any of the personal identifiers (1-18) listed above and have indicated that you will be collecting health please consider the type of research that you are conducting: a. ______Clinical Trial (funded or unfunded) or other research where the research subject will be able to sign an informed consent If you are proposing to conduct a clinical trial or its equivalent, where research subjects will be able to sign an informed consent to participate in the research study, then, under the HIPAA Privacy regulations, research subjects must now, in addition to the traditional informed consent, authorize the use and disclosure of their individually identifiable health information. As the investigator you may choose to combine the informed consent and the authorization in one document or you may have research subjects sign separate informed consent and authorization documents. Use the "Authorization for Use and Disclosure of Individually Identifiable Health Information" template to prepare your authorization form and include with your submission packet to the IRB.
b. ______Medical Records Research or related research where it is not practicable to obtain a subject's signed informed consent If you propose to conduct medical records research where no research subjects are being consented because it would not be practicable for you to obtain signed consent, you may be able to qualify for both a waiver of informed consent and a waiver of authorization from the IRB. Complete the "Waiver of Authorization for Use of Individually Identifiable Health Information" and submit with your application for IRB approval.