STANDARD OPERATING PROCEDURE (SOP) IRB-031
TITLE: HIPAA REQUIREMENTS
ORIGINAL DATE: 4/13/03 SUPERCEDES SOP#: n/a
EFFECTIVE DATE: 4/24/03
NEXT REVIEW: 4/24/04
OBJECTIVE: To describe the requirements of HIPAA in relation to research.
Children’s Hospital collects and maintains a great deal of personal health information about our patients.
The federal HIPAA regulations on patient privacy and confidentiality place restrictions on the release of
patient information for research. In order to protect the privacy and confidentiality of our patients' protected
health information and to comply with federal law, all employees and staff who use or disclose patient
information for research purposes are required to comply with the provisions of this policy.
Research is defined as a systematic investigation, including research development, testing, and evaluation,
designed to develop or contribute to generalizable knowledge. Research does not include any of the
following activities undertaken by Children’s Hospital: quality assessment and improvement activities,
including outcomes evaluation and development of clinical guidelines, protocol development, case
management and care coordination. However, if any of this data gathered is analyzed and presented
outside our covered entity, it becomes research.
Accessing Patient Information for Research.
No person, whether or not affiliated with Children’s Hospital, shall access, use, review, study, examine or
analyze the medical records or other patient information of Children’s Hospital for research purposes
unless prior approval has been obtained from the Children’s Hospital Institutional Review Board (IRB).
Releasing Patient Information for Research.
No person, whether or not affiliated with Children’s Hospital, shall release, disclose, or otherwise provide
access to the medical records or other patient information of Children’s Hospital for research purposes to
any person unless prior approval has been obtained from the IRB.
Approving Requests for Access to Patient Information for Research.
Requests for access to patient information may be approved by the IRB in the following circumstances:
1. There is a signed authorization from the patient or the patient's representative authorizing the use
or disclosure of that patient's information for research; or
2. Only de-identified information will be used or disclosed; or
3. The information used or disclosed is in the form of a limited data set and a data users agreement or
confidentiality agreement is obtained; or
4. A waiver of authorization has been obtained from the Institutional Review Board in accordance
with the Waiver of Authorization guidelines; or
Page 1 of 2
5. The request is for the design of a research protocol and researcher representations obtained in
accordance with the Preparatory to Research guidelines; or
6. The request is for research on decedents and researcher representations are obtained in accordance
with the Representation for Research on Decedents guidelines.
7. For information created before April 14, 2003 if none of the above are applicable:
there is an authorization or other express legal permission from the patient to use or
disclose that patient's information for the research; or
the patient has signed an informed consent to participate in the research; or
the Institutional Review Board has waived informed consent for the research, in
accordance with the Common Rule or FDA's human subject protection regulations.
1. Submission of new studies to the IRB for review must include the appropriate HIPAA request.
The IRB will review the HIPAA request using the same procedure as a new study review request.
HIPAA guidelines and forms may be accessed on the IRB website.
2. Some HIPAA research categories are subject to an “accounting of disclosures” as described in the
Notice of Privacy Practices document. All disclosures of subject information for research
purposes must be maintained by the researcher in the event that a subject requests an accounting
of disclosures. Disclosures that are fall under the authorized, de-identified, or limited data set
categories are not subject to accounting.
IRB Chair Signature Date
CRI Medical Director Signature Date
CHI Medical Director Signature Date
IRB Committee Revision Approval Dates:
Page 2 of 2