Download | A Microsoft Word Document Version of This Page
Download | The Authorization for Release of Protected Health Information for Research Purposes Form
Download | The Revocation of Authorization for Release of Protected Health Information for Research Purposes Form

1. Use and Disclosure with Authorization of the Subject
   
   The most direct method of using and disclosing data is to ask the permission of the subject of that data. The permission is termed "authorization" in the Privacy Rule. A VHA researcher may use or disclose PHI for research purposes after obtaining a privacy-related authorization from the individual who is the subject of the information. Such authorization is distinct fromÑbut may be combined in a form withÑan informed consent for participation in a research study.
   
   The Privacy Rule defines a valid authorization as having six "core elements" and three "required statements." These are detailed below. In addition to these items, the authorization must be written in plain language and a signed copy must be given to the individual. An authorization form does not have to be approved by an IRB or Privacy Board to be valid for purposes of the Privacy Rule. However, because it will generally be part of the informed consent process, an IRB or Privacy Board may review the authorization as part of its review of the informed consent process proposed by the researcher.
   
   
   1. Core Elements of an Authorization
      
      
      • Description of the PHI to be used and disclosed "in a specific and meaningful fashion" Ð To meet this definition, the description should be understandable to the individual; not a mere recitation of data elements understandable only to the research team. The description should be specific and the request should be limited to that information necessary to the research protocol. Examples of specific and meaningful descriptions include "Lab tests" "clinic visit data" "X-ray readings." Do not use medical jargon or test codes ("Chem7").
      • Name or specific identification of the person or class of persons authorized to make the disclosure Ð This refers to the "covered entity" that holds the information. Because the VHA is a single covered entity, use of "VHA" as the releasing entity is acceptable.
      • Name or specific identification of the person or class of persons authorized to receive the information Ð It is advisable to identify the principal investigator as receiving this information. An authorization also should refer to the "research team" that will work with the PI in conducting the research.
      • Description of each purpose of the requested use or disclosure Ð The authorization should include a clear, concise and understandable description of the purpose of the research. This description may be drawn from the explanation of the research contained in the informed consent form.
      • Expiration date or event Ð This is the date that the authorization to use or disclose the information will expire. For research purposes, this may be the end of the study. It is acceptable, for studies that will include development of a database, for the authorization to indicate "no expiration date." If a study has a specific end date or event that will occur at the end, this should be used. However, the authorization must include this information in some form.
   2. Required Statements in an Authorization Form
      
      
      • A statement that the individual has a right to revoke the authorization in writing and EITHER
        
        
        • The exceptions to this right and description of how the individual may revoke OR
        • A reference to the covered entity's notice of privacy practices, if the exception information is contained there.
        
        
      • Ability or inability to condition treatment, etc., on signing the authorization Ð Because research may be dependent on the use and disclosure of PHI, participation in the study may be conditioned on the subject signing the authorization.
      • The potential for information to redisclosed and no longer protected under HIPAA.


Appendix A contains a template form for an authorization that can be used by VHA researchers. All indicated information must be inserted at the appropriate places in the document. Although IRB approval is not required to make the authorization valid under HIPAA, your IRB may require prior approval of this document as part of the overall informed consent process. It is the responsibility of the researcher to obtain IRB approval of this form, if necessary. Once the form has been signed, a copy must be given to the individual. In addition, Appendix B contains a template form for a revocation of authorization that can be given to a subject who expresses a desire to revoke a previously granted authorization.


2. Waiver of Authorization
   
   An alternative to asking each research subject for an authorization is to ask an IRB or Privacy Board for a waiver of authorization or an alteration of the standard elements of an authorization. The Privacy Rule includes specific guidelines for the IRB or Privacy Board to follow in granting the request for a waiver of authorization.
   
   The IRB or Privacy Board must obtain from the researcher a statement that is sufficient for the IRB or Privacy Board to determine the following:
   
   
   • The use or disclosure of PHI for the study involves no more than minimal risk to the privacy of the subject individual(s) based on the presence of:
     
     
     • An adequate plan by the researcher to protect the identifiers from improper use or disclosure. A full explanation of the plan is required.
     • An adequate plan to destroy the identifiers at the earliest opportunity UNLESS there is a health or research justification for retaining the identifiers is required by law
     • Adequate written assurances by the researcher that all efforts will be made to protect the information
     
     
   • The research could not practicably be done without the requested waiver or alteration
   • The research could not practicably be done without access to and use of the PHI
   
   Once a waiver has been granted by the IRB or Privacy Board, the researcher must have in his or her file, documentation of the action taken by the IRB or Privacy Board to grant the waiver. The documentation must include the following:
   
   
   • Identification of the IRB and the date of the action
   • The waiver criteria used by the IRB in reaching its decision
   • A description of the PHI being requested
   • Review and approval procedures used by the IRB in reaching its decision
   • Signature of the IRB Chairman or authorized member.



3. De-Identification (Safe Harbor)
   
   The HIPAA Privacy Rule applies only to identifiable information. If information is de-identified, it no longer is subject to the Privacy Rule. CAUTION: de-identification for HIPAA purposes may not be the same as "anonymizing" data as commonly understood by researchers.
   
   To meet the standard for de-identified data under the Privacy Rule, a data set cannot include any of the following 18 elements:
   
   
   1. Names
   2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of the zip code if according to the current publicly available data from the Bureau of the census: a) the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and b) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
   3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older.
   4. Telephone numbers
   5. Fax numbers
   6. Electronic mail addresses
   7. Social security numbers
   8. Medical record numbers
   9. Health plan beneficiary numbers
   10. Account numbers
   11. Certificate/license numbers
   12. Vehicle identifiers and serial numbers, including license plate numbers
   13. Device identifiers and serial numbers
   14. Web Universal Resource Locators (URLs)
   15. Internet Protocol (IP) address numbers
   16. Biometric identifiers, including finger and voice prints
   17. Full face photographic images and any comparable images
   18. Any other unique identifying number, characteristic, or code.



4. Statistical Method of De-identification
   
   An alternative to the "safe harbor method" is the statistical method. This standard is met if a person with appropriate knowledge and experience applying generally acceptable statistical and scientific principles and methods for rendering information not individually identifiable makes and documents a determination that there is only a small risk that the information could be used by others to identify a subject of the information. These techniques include removing all direct identifiers, reducing the number of variables on which a match might be made, and limiting the distribution of records through a "data use agreement"' or "restricted access agreement" in which the recipient agrees to limits on who can use or receive the data.



5. Limited Data Set
   
   The limited data set option is less restrictive than complete de-identification but does not allow unfettered access to identifiable information but requires certain safeguards. A limited data set is one that has been stripped of the following elements:
   
   
   1. Name
   2. Street address (specifically, a postal address other than city, State and Zip code)
   3. Telephone and fax numbers
   4. E-mail address
   5. Social security number
   6. Certificate/license number
   7. Vehicle identifiers and serial numbers
   8. URLs and IP addresses
   9. Full face photos and any other comparable images
   10. Medical record numbers, health plan beneficiary numbers, and other account numbers
   11. Device identifiers and serial numbers
   12. Biometric identifiers, including finger and voice prints
   
   The key differences between a de-identified data set and a limited data set would be the inclusion, in the latter, of dates and some geographic codes.
   
   The use of a limited data set requires a data use agreement. This document is intended to provide assurance of the limited use or disclosure of the information in the limited data set. Under the Privacy Rule, a valid data use agreement must specify 1) the permitted uses and disclosures of information by the recipient, consistent with the purposes of the research, 2) the limits on who can use or receive the data, 3) that the recipient will not re-identify the data or contact the individuals, and 4) that the recipient will use appropriate safeguards to prevent use or disclosure of the limited data set other than as permitted by the Privacy Rule and data use agreement or as required by law.
   
   Disclosure of the information in a limited data set does not require review by an IRB or Privacy Board.

• An authorization or other express legal permission from the individual to use or disclose his or her information for research,
  
  
• The legally effective informed consent of the individual to participate in the research, OR
  
  
• A valid waiver of informed consent from an IRB according to the Common Rule or an exception under the FDA's human subject protection regulation at 21 CFR 50.24

• Waiver of informed Consent obtained prior to April 14, 2003: No action necessary. The waiver is deemed "authorization" for Privacy Rule purposes.
  
  
• Informed Consent obtained prior to April 14, 2003: Information obtained pursuant to an informed consent signed prior to April 14, 2003, even if the information is not obtained until after April 14, 2003, is "grandfathered" under the Privacy Rule. HOWEVER, if the subject is "re-consented," that is, asked for a new informed consent ON OR AFTER April 14, 2003, a valid authorization must be obtained.
  
  
• Informed Consent obtained ON OR AFTER April 14, 2003: Must include a separate authorization form or authorization language within the informed consent form, or must obtain waiver of informed consent from IRB.