HIPAA FAQs

HIPAA FAQ

 What is the IRB Role under the Privacy Rule?

Beginning on April 14, 2003, the Privacy Rule’s compliance date for most covered entities, IRBs gained authority to consider, and act upon, requests for a partial or complete waiver or alteration of the Privacy Rule’s Authorization requirement for uses and disclosures of PHI for research. Although HHS and FDA Protection of Human Subjects Regulations include protections to help ensure the privacy of subjects and the confidentiality of information, the Privacy Rule supplements these protections by requiring covered entities to implement specific measures to safeguard the privacy of PHI. If certain conditions are met, an IRB may grant a waiver or an alteration of the Authorization requirement for research uses or disclosures of PHI.

When can a CE release PHI to a researcher?

There are 3 conditions under which a CE can release PHI to a researcher:

  1. Every subject has signed an authorization for the CE to release the PHI to the researcher.
  2. An IRB has granted the researcher a waiver of authorization.
  3. The researcher de-identifies the health information to HIPAA standards.

Authorization: In most research cases, each subject must sign an authorization for the CE to release PHI to the researcher. Authorizations are separate from consent forms, and must contain specific information. Hospitals and other large CEs may require the researcher to use their standard agency authorization form. Researchers are advised to contact CEs and determine this before investing time in creating an authorization form specific to their research study.

Waiver of Authorization: An IRB can grant a waiver of authorization for release of PHI for a research study if it determines that obtaining a signed authorization from each subject is impractical, and that the researcher has taken sufficient safeguards to protect the data. A Request for Waiver of Authorization form is attached. However, researchers should be aware that CEs with their own IRBs might require that the waiver be granted by the agency IRB, rather than UNCG’s IRB. Researchers are advised to contact CEs and determine this before applying for a Waiver of Authorization from the UNCG IRB.

De-identification and Limited Data Sets: De-identification to HIPAA standards requires removing considerable information, in addition to names. A list of data elements that must be removed is shown on page

Note: The burden for complying with HIPAA falls on the CE, so it is ultimately the responsibility of the CE to determine if the conditions that allow disclosure of PHI have been met. The UNCG IRB can help researchers throughout the process, but the CE will always be the one to make the final decision about whether PHI can be shared with a researcher.

What criteria have to be met in order to obtain a Waiver of Authorization for Release of HIPAA?

Waiver of Authorization*: An IRB can grant waiver of authorization for a research study if it determines that (45 C.F.R. 164.512(i)):

(A) The use or disclosure of protected health information (PHI) involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements;

(1) An adequate plan to protect the identifiers from improper use and disclosure;

(2) An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and

(3) Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted by this HIPAA and approved by the IRB;

(B) The research could not practicably be conducted without the waiver or alteration; and

(C) The research could not practicably be conducted without access to and use of the PHI.

For more information:

Who are the covered entities (CE’s) at UNCG?

  • Psychology Clinic
  • Speech and Hearing Clinic
  • Speech and Hearing Program (Gateway North)
  • Student Health Services

What is the role of the HIPAA Privacy officer at UNCG?

  • The Privacy officer is responsible for providing information, receiving complaints and handling the administration of patients’ records rights such as access, amendment, and confidential communications.
  • The HIPAA Privacy officer at UNCG is: Kathleen Baber, Interim Director, Student Health Services, (336) 334-3147, kababer@uncg.edu

What is the role of the HIPAA Security officer at UNCG?

  • The Security officer is responsible for the development and implementation of the policies and procedures required by the HIPAA Security Rule.

What information does the IRB need if I am working with HIPAA-related data or PHI?

  • The IRB requests one or both of the following when reviewing an IRB submission using PHI:
  1. HIPAA authorization – written permission from the patients that allows use or disclosure of their protected health information for purposes other than treatment, payment or health care operations. This is usually obtained from the covered entity.
  2. HIPAA Waiver of Authorization– Under limited circumstances, a waiver of the requirement for authorization for use or disclosure of private health information may be obtained from the IRB by the researcher. A waiver of authorization can be approved only if specific criteria have been met.

Further information can be found in the Application to Use PHI in Research, available on the ORI website at integrity.uncg.edu.

When would I need the UNCG Business Associate Agreement?

  •  If other parties have access to, or may need to review, PHI pertaining to the covered entity’s patients, a covered entity (CE) may have to enter business associate agreements with a number of other parties with whom the covered entity has a business relationship. Business associates of the UNCG covered entities may be other UNCG units that perform work on behalf of the CE; and UNCG units may also serve as a business associate to a CE other than UNCG.

Where can I find the UNCG Business Associates agreement?

What are three ways a researcher can collect PHI without adhering to HIPAA regulations?

  • When it is de-identified from the covered entity.
  • When it has been given to the participant by the doctor and that participant provided it to the researcher.
  • When it is given to the researcher through interviews or questionnaires from the participants as part of the study.

Where can I find additional HIPAA information?

 

 

 

 

 

 

Emergency Info

The Office of Research Integrity
Location 2720 MHRA Building
Mailing Address 1111 Spring Garden Street, Greensboro, NC 27412
Email ORI@uncg.edu

Copyright © 2024. UNC Greensboro. All rights reserved. | Privacy Policy