HIPAA and Research

The Privacy Rule has important implications for human research.

• New administrative requirements are mandated by HIPAA that must be met before you can access, study, and disclose Protected Health Information (PHI).
• HIPAA defines research as "any systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."
• The HIPAA Privacy Rule does not override the Common Rule or FDA's human subjects regulations.
• Researchers must now address regulatory requirements by both the IRB and HIPAA.
• The HIPAA regulations do not differentiate between treatment and non-treatment related human research studies.
• HIPAA applies to all human research, regardless of the funding source.

The Use or Disclosure of Protected Health Information (PHI) for research purposes requires either:

A written Authorization from the subject OR a Waiver approved by the Privacy Board / IRB /HIC OR Verification that the research involves:

• De-Identified Information
• Limited Data Sets
• Reviews Preparatory to Research
• Decedents' Information

Patient Authorization for the Use and Disclosure of PHI may be the most advantageous route to research

• No Representations (Assurances) required
• No Privacy Board review required
  (but the project must be reviewed and approved by the IRB)
• No Accounting of Disclosures required
• No "Minimum Necessary" limitations

Note:  Patient Authorization (HIPAA - privacy issues) is NOT the same as Patient Consent (IRB - risk versus benefits)

HIPAA compliant forms for Patient Authorization for the Use and Disclosure of PHI can be obtained from the WSU HIC website (www.hic.wayne.edu)
There Are 5 Pathways to Obtain Protected Health Information for Research Without Individual Patient Authorization

• Waiver of Authorization Requirement
• Use of De-identified Information
• Use of Limited Data Sets
• Research using Decedents' Information
• Reviews Preparatory to Research

Detailed information can be obtained from the WSU HIC website at www.hic.wayne.edu.

Psychotherapy Notes

• Are recorded in any medium by a health care provider who is a mental health professional
• Document or analyze the content of conversation during a private counseling session or a group, joint or family counseling session
• Are separated from the rest of the medical record

Psychotherapy Notes do NOT include:

• Medication prescription and monitoring
• Session start and stop times
• Modalities and frequencies of treatment furnished
• Results of clinical tests
• Any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress

Psychotherapy Notes Authorization and Research Consent

An Authorization for the Use and Disclosure of Psychotherapy Notes

• May NOT be combined with Informed Consent for Research
• May ONLY be combined with another Authorization for use or disclosure of Psychotherapy Notes

What about research that was approved before April 14, 2003, but continues to enroll new subjects after April 14, 2003?

Subjects enrolled after April 14, 2003 must sign an Authorization for Use and Disclosure of Protected Health Information in Research.