- Criteria for Waiver
- When may a Waiver of Authorization be appropriate?
- Comparison to Waiver of Informed Consent under Common Rule
- Authorization Waiver Regulations, Guidance and Policies
To use and/or disclose Protected Health Information (PHI) for research purposes, the HIPAA Privacy Rule in general requires that researchers obtain signed authorization from the individual. An IRB or Privacy Board can grant a Waiver of HIPAA Authorization to permit use and/or disclosure of PHI for research purposes, without obtaining authorization. UMHS study teams request full or partial waiver of HIPAA authorization through eResearch Regulatory Management application sections 25-1 and 25-2.
Criteria for Waiver
The following three criteria must be satisfied for an IRB or Privacy Board to approve a waiver of authorization under the Privacy Rule:
- The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
- an adequate plan to protect the identifiers from improper use and disclosure;
- an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
- adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;
When may a Waiver of Authorization be appropriate?
Waiver of HIPAA Authorization is often appropriate for:
- identifying eligible potential subjects for a clinical trial through medical record review (partial waiver)
- secondary use research on a large set of medical records (full waiver)
Partial or complete waiver can also be appropriate in other situations.
Research activities that involve PHI should be conducted whenever practicable with patient authorization.
- It may be feasible to obtain signed authorization from each individual in a small data set.
- Data custodians may be able to provide a study team with a de-identified or Limited Data Set that fulfills the research needs. Contact the UMMS Data Office for Clinical and Translational Research.
Comparison to Waiver of Informed Consent under Common Rule
Informed consent processes and HIPAA authorization processes should be compatible in any study that
- Is subject to IRB oversight, and
- Involves PHI
|Consent process||HIPAA authorization||How|
|Full waiver of informed consent||Full waiver of HIPAA authorization||Request in eResearch sections 10-3 and 25-2|
|Partial waiver of informed consent||Partial waiver of HIPAA authorization||Request in eResearch sections 10-3 and 25-2|
|Comprehensive written informed consent||Signed HIPAA authorization||IRBMED Informed consent templates incorporate HIPAA authorization|
|Waiver of documentation of informed consent||Waiver of HIPAA authorization
**NOTE: Waiver of documentation is not available for HIPAA authorization
|Request in eResearch sections 10-4 and 25-2|
IRBs and Privacy Boards also can approve alterations to the HIPAA authorization requirements, when an alteration is justified by the same criteria of (1) minimal risk to privacy, (2) impracticability of the research without alteration, and (3) impracticability of the research without PHI use and/or disclosure.
Authorization Waiver Regulations, Guidance and Policies
- 45CFR164.512(i)(1)(i) and 45CFR46.164.512(i)(2)
- Office of Civil Rights main HIPAA site
- Research and HIPAA Privacy Rule page. Heading: "Documented Institutional Review Board (IRB) or Privacy Board Approval."
- HIPAA Privacy Rule Information for Researchers from NIH
- U-MIC IRB Board Tip: The HIPAA Privacy Rule: Requirements and Waivers
- IRBMED Educational Course Offerings including "HIPAA Requirements and Waivers of Authorization"
Website Approved by IRBMED Chairs and Director: October 14, 2011
Updated: February 7, 2018