HSPP HIPAA and Research
HIPAA Privacy Rule
The privacy provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) have been in effect since April 2003. The Privacy Rule (HIPAA) contains basic practices for protecting the privacy of patients' health information which are implemented across the CHLA health-care system. HIPAA also contains specific requirements for research with human subjects and their protected health information (PHI).
What is PHI?
PHI is information that can be linked to a particular person and that is created, used or disclosed in the course of providing a health care service (i.e., diagnosis or treatment), and includes research. It includes any individually identifiable health information collected or created as a consequence of the provision of health care by a covered entity, in any form, including verbal communications.
Role of the IRB
The CHLA IRB acts as a Privacy Board to review the creation, use, and disclosure of PHI for research. For research activities involving PHI, the IRB must determine whether research subjects should sign a written authorization, and/or whether a waiver or alteration of written authorization is permissible.
- When the IRB determines that research subjects should sign a written authorization, the CHLA HIPAA Research Authorization must be used.
- When certain regulatory criteria are met, the CHLA IRB may grant a waiver or alteration of the requirement for written Authorization.
Research studies that create, use or disclose PHI are subject to HIPAA regulations. The IRB approval letter will indicate when HIPAA applies, whether a written authorization is required, and/or whether a HIPAA waiver or alteration is approved.
CHLA HIPAA research authorization forms are located on the HSPP website under Short Form Consents, HIPAA Research Authorizations, CA Subject’s Bill of Rights, Other IRB Forms.
Reviews of PHI Preparatory to Research
Reviews of PHI preparatory to research are activities required for planning or to determine the feasibility of a study before developing or submitting a protocol to the IRB. For example, an investigator may be interested in studying a rare condition but doesn't know if there are enough prospective subjects available to perform the study. Note: No data may be recorded for research purposes. Recording data for research requires IRB review.
Investigators may use or disclose PHI for reviews preparatory to research without written authorization, provided CHLA receives from the investigator: 1) representation that the use and disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research, 2) no PHI is removed from the covered entity by the researcher in the course of the review, and 3) the PHI for which use or access is sought is necessary for research purposes.
Research Involving Decedents’ PHI
Research that uses or discloses decedent PHI does not require IRB review, but it is covered by HIPAA. Investigators may use or disclose the PHI of decedents without written authorization, provided CHLA receives from the investigator: 1) representation that the use or disclosure is solely for research on the PHI of decedents, 2) documentation of death of such individuals (if requested by CHLA), and 3) representation that the PHI for use or disclosure is necessary for research purposes. Investigators should complete and provide this form to CHLA Health Information Management when accessing records.
Limited Data Sets
Research involving the use of a limited data set does not require IRB review. Because a limited data set is still PHI, HIPAA regulations apply. A limited data set of information may be disclosed without written authorization if certain conditions are met (1) The purpose of the disclosure may only be for research, public health or health care operations and (2) the person or entity receiving the information must sign a data use agreement with CHLA. Data use agreements are reviewed and approved by the CHLA Contracts and Clinical Research Office. For disclosure of a CHLA limited data set, complete and submit a data use agreement to: chlaclinicalresearch@chla.usc.edu.
More Information about HIPAA at CHLA
For more information on CHLA’s HIPAA policies and requirements, consult the CHLA Compliance Department maintained by the Office of Compliance and Policy.
