FORM J HUMAN USE RESEARCH 1. Study Title: UT Health Science Center San Antonio HIPAA Waiver/Alteration Application for (choose one) Waiver of Authorization Alteration of Authorization
Click here for a complete set of instructions for this form. (Read all instructions carefully. Call (210) 567-3083 for questions. Tools, Macro, Security must be set to medium and macros enabled to take advantage of available automations.) Definition of Protected Health Information (PHI).
1. Principal Investigator Information Principal Investigator: [Click once to type or paste PI name] Address, and Telephone number: [Click once to type or paste address and phone] Sponsor: [Click once to type or paste Sponsor name] Address, and Telephone number: [Click once to type or paste address and phone]
2. The Privacy Rule requires researchers obtain written authorization to access individually identifiable health information. Describe the activity you are requesting a waiver or alteration of written authorization (“waived activity”). (Click for instructions): Examples (revise –change your answer to black type - or delete as needed) This waiver is needed because the researchers plan to access identifiable medical information in order to obtain and record data from individual medical records. This waiver is needed to allow the researchers to identify eligible subjects for recruitment in this research. The researchers will access private identifiable health information to screen for patients who may be eligible for this study. Continued access to PHI will be limited to those who later volunteer for the study and provide written authorization.
3. Explain why it is not practicable to contact or attempt to contact each individual to obtain written authorization to access their PHI. Consider feasibility and design issues. [Click once to type your reason: (e.g., " need to review charts to obtain contact information to obtain authorization"]
4. Describe the criteria you will use to decide which health records to access (Click for instructions): [Click once to type criteria]
1
FORM J HUMAN USE RESEARCH 1. Study Title: 5. Which institutions (or covered entities) maintain the records/ health information you will be accessing? (Click for instructions): UTHSCSA Click Once to specify location(s) (i.e., Dental Clinic, RIC, CTRC, etc.) South Texas Veteran’s Healthcare System (STVHS) Click once to specify location(s) (i.e., AMVAH, Bartter Research Unit, Frank Tejeda, etc.) University Health System (UHS) Click once to specify location(s) (i.e., University Hospital, University Hospital Downtown, TDI,etc.) Christus Santa Rosa Health Care (CSRHC) Click once to specify location(s) (i.e., CHART, Christus Santa Rosa Children's Hospital,etc.) Other Click once to specify location(s)
6a. Will you access identifiable health information from more than one covered entity (i.e., did you list more than one institution in item 5)? Yes (go to 6b ) No (skip to Item 7 and complete only one table) 6b. Will you access the exact same health information from all the covered entities? Yes (Go to Item 7 and complete only one table) No (Go to Item 7 and complete one table for each institution – copy and paste the table as needed)
7. Provide details of the information to be used, recorded or disclosed without written authorization. 7a. Institution / Covered Entity (List the institution(s) which maintains materials for this activity) All Institutions or [Click once to type Institution name from item 5 above] 7b. Type of materials being used (List the type(s) of materials to be used, such as electronic medical records (CPRS, Sunrise, etc), paper records, etc.) [Click once to type]
7c. Nature of the Health Information Provide a summary of the actual health information you will be accessing and/or collecting under this waiver/alteration) [Click once to type summary - (for example "current medications, treatment and medical history relating to hypertension")] 7d. In addition to accessing health information, will you record any identifiable information from this source as part of the waived activities listed in Item 2? No ( delete 7e. and skip to 8) Yes If yes, will you disclose the recorded identifiable information to an individual outside the covered entity? No (Go to 7e) Yes (explain below and complete 7e)
2
FORM J HUMAN USE RESEARCH 1. Study Title: If Yes, Explain here 7e. Identifiers Recorded with Health Information Using the 18 HIPAA identifiers below, select the identifiers you will record with the health information from this covered en tity (delete those you will not be recording) Account numbers Names Certificate/license numbers Address Health plan beneficiary numbers Dates except year Vehicle identifiers and serial numbers, or license plate numbers Ages over 89 (can be grouped as age 90 or older) Device identifiers and serial numbers Phone numbers Web Universal Resource Locators (URLs) Fax numbers Internet Protocol (IP) address numbers E-mail addresses Biometric Identifiers, including finger and voice prints Social security numbers Full face photographic images and any comparable images Medical record numbers Any other unique identifying number, characteristic, or code
8. List the individual(s) who will be conducting the waived activities listed in Item 2. Include whether the individual(s) have privileges under the Privacy Rule to access PHI at the covered entities listed in Item 5. Name of research team members who will access PHI under this waiver. List each individual on a separate row From the covered entities listed above, list those that this individual has privileges to access PHI under the Privacy Rule Will this person access PHI from a covered entity that he/she does not have privileges? Yes Yes No No
9. Describe the plan to protect the identifiable health information and indicate where it will be stored and who will have access to it. Indicate all safeguards which will be used to protect identifiers to ensure minimal risk of improper use or disclosure of the subject's identifiable information. Edit this section as necessary – remove instructions and unneeded text. Measures to protect health information during the time the researcher will have access: [Click once to type]
Measures to protect the recorded data: If your study is Exempt, this section is not applicable A coding system will be created. During the transfer of information from the source document to the research document, all direct identifiers (e.g., name, address, etc.) will be replaced with a unique code. The key to decipher the code will be kept in a separate, secure location from the data. The information obtained will be stored in the following location: [Click once to type] Only the following individuals will have access to the stored data: [Click once to type] The identifiable information collected will not be disclosed to persons outside of the covered entity unless [Click once to type]
(Choose one of the two statements below) Since authorization will not be obtained, all identifiers collected during the study (listed in 7.d.) and key to decipher the code will be permanently destroyed at the earliest opportunity consistent with the conduct of research, which is: [Click once to type]
OR Since authorization will be obtained from subjects who later volunteer for this research, only the information collected from those who do not later sign a written authorization will be permanently de-identified (all identifiers collected
3
FORM J HUMAN USE RESEARCH 1. Study Title: during the study (listed in 7.d.) and key to decipher the code will be permanently destroyed) at the earliest opportunity consistent with the conduct of research, which is: [Click once to type]
Protection measures while transmitting PHI (disclosing): If you are not disclosing PHI collected under this waiver/alteration this section is not applicable [Click once to type]
10. The HIPAA regulation requires reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. Are you obtaining only the minimum information necessary to complete the waived activities listed in Item 2? Yes No (explain/justify why not):
11. Identify the ending date (last day) which you will need access to PHI (without subject authorization) for the waived activity listed in Item 2. Note: this Waiver is effective beginning on the date it is approved. You will only be permitted to access PHI beginning on the approval date and ending on the date you enter here. Last date of activity: [Click once to type date]
4
FORM J HUMAN USE RESEARCH 1. Study Title: The information listed in the waiver/alteration application is accurate and all research staff (ALL study personnel including PI that are involved in the research) will comply with the HIPAA regulations and the waiver/alteration criteria. All research staff will complete HIPAA Research Training. I assure that the information I obtain as part of this waiver/alteration (including protected health information) will not be reused or disclosed to any other person or entity except as permitted by this waiver/alteration, by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information has been permitted by the IRB. If at any time, I want to reuse this information obtained under waiver/alteration of authorization for other purposes or disclose the information to other individuals or entity. I will seek approval by the Privacy Board (the IRB). _______________________ PI Signature _______________ Date
[Principal Investigator’s Typed Name]
_____________________________________________________________________________________________
For IRB Office Use Only:
Type of Review Expedited Full Board The following criteria as required by 45CFR164.512(i) were satisfied: The intended use and/or disclosure of PHI involves no more than a minimal risk to the privacy of individuals. There is an adequate plan to protect the identifiers from improper use and disclosure There is an adequate plan to destroy the identifiers at the earliest opportunity consistent with the c onduct of the research unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and There are adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by this subpart The research could not practicably be conducted without the waiver The research could not practicably be conducted without access to and use of the protected health i nformation
______________________________________________
____________ Date
5