The IRB also serves as the Privacy Board for UPMC facilities and may approve a HIPAA authorization process for studies taking place in UPMC facilities which does not include, or which alters some or all of the elements of a valid written authorization (as specified under 45 CFR 164.508(c)), or waives the requirement for written HIPAA authorization if the IRB finds and documents that the use of the subjects’ protected health information meets the criteria for a waiver as addressed under 45 CFR 164.512 (i)(2)(ii). In granting an alteration or waiver of HIPAA authorization, the IRB must determine that the alteration or waiver, in whole or in part satisfies each of the following criteria:
- The use or disclosure of protected health information involves no more than minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
- an adequate plan to protect the identifiers from improper use and disclosure;
- an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
- an adequate written assurance that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted (i.e., under the HIPAA regulations).The research could not practicably be conducted without the waiver or alteration.
2. The research could not practicably be conducted without access to the use of the protected health information.
Documentation of Approval Concurrence
Documentation of the IRB’s approval of an alteration or waiver of HIPAA authorization must include:
- a statement that the alteration or waiver of authorization has been reviewed under either full-board or expedited review procedures;
- a statement that the IRB has determined that the alteration or waiver, in whole or in part, of the authorization satisfies each of the waiver criteria under 45 CFR 164.512(i)(2)(ii);
- a statement identifying the date on which the alteration or waiver of authorization was approved;
- a brief description of the protected health information for which use or access has been determined to be necessary by the IRB; and the documentation of the alternation or waiver of authorization must be signed by the IRB Chair or other IRB member, as designated by the IRB Chair.
The IRB reviewer utilizes the Waiver of HIPAA Authorization form found at (http://www.osiris.pitt.edu)and documents in the minutes (if full board) or in a note to Vice Chair (if expedited) that the applicable criteria have been met. Note that the IRB cannot approve alteration or waiver of HIPAA authorization for protected health information from covered entities other than UPMC.