Waiver of HIPAA Authorization

Waiver and Alteration

The IRB may approve a HIPAA authorization process which does not include, or which alters some or all of the elements of a valid written authorization (as specified under 45 CFR 164.508(c)), or waives the requirement for written HIPAA authorization if the IRB finds and documents that the use of the subjects’ protected health information meets the criteria for a waiver as addressed under 45 CFR 164.512 (i)(2)(ii).  In granting an alteration or waiver of HIPAA authorization, the IRB must determine that the alteration or waiver, in whole or in part satisfies each of the following criteria:

  1. The use or disclosure of protected health information involves no more than minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
    1. an adequate plan to protect the identifiers from improper use and disclosure;
    2. an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
    3. an adequate written assurance that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted (i.e., under the HIPAA regulations).
  2. The research could not practicably be conducted without the waiver or alteration; and
  3. The research could not practicably be conducted without access to or use of the protected health information.

Documentation of Approval Concurrence

Documentation of the IRB’s approval of an alteration or waiver of HIPAA authorization must include:

  • A statement that the alteration or waiver of authorization has been reviewed;
  • A statement that the IRB has determined that the alteration or waiver, in whole or in part, of the authorization satisfies each of the waiver criteria under 45 CFR 164.512(i)(2)(ii);
  • A statement identifying the date on which the alteration or waiver of authorization was approved;
  • A brief description of the protected health information for which use or access has been determined to be necessary by the IRB.

The IRB Coordinator utilizes the Waiver of HIPAA Authorization form in the PittPRO Library: and documents in the minutes (if full board) or in the Designated Review note (if expedited) that the applicable criteria have been met.