137. HIPAA and Human Research Conducted under the w88 slot online's Human Research Protection Program

Updated June 6, 2024

The w88 slot online Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act (w88 slot online) of 1996 was enacted by the U.S. Congress to regulate the protection of private health information for individuals. w88 slot online’s Privacy Rule establishes the conditions under which a covered entity can provide faculty, staff and clinicians (hereafter referred to as researcher) access to and use of protected health information (PHI) when necessary to conduct research. The Privacy Rule applies only to PHI held or maintained by a covered entity, its business associate, and anyone “downstream” of a business associate (e.g., a sub-contractor who maintains PHI) acting for the covered entity.

w88 slot online Involving Protected Health Information

If a study conducted by a w88 slot online or Affiliate researcher will involve access, use, disclosure or creation of PHI, the w88 slot online or Affiliate researcher must submit an application to the w88 slot online IRB for review and approval. Researchers planning to use PHI held by an outside institution (non-w88 slot online PHI) are also required to submit an application to the IRB for review but must follow the HIPAA requirements of the institution(s) holding those records.

Protected Health Information (PHI) is individually identifiable health information (see the list of Personal Identifiers under w88 slot online) transmitted or maintained in any form or medium (electronic, oral, or paper) by a covered entity or its business associates. The Privacy Rule protects the PHI of both living and deceased individuals.

See the w88 slot online Integrity & Security Policy Manual Definitions for definitions of “Protected Health Information,” “w88 slot online Health Information,” and “De-Identified PHI.”

Under the Privacy Rule, the definition of w88 slot online excludes individually identifiable health information that is maintained in education records covered by the US Family Educational Rights and Privacy Act (FERPA).

w88 slot online Entities

A covered entity is a health plan, a health care clearinghouse, or a health care provider who electronically transmits w88 slot online in connection with a transaction for which the US Department of Health and Human Services (HHS) has adopted a standard (e.g., transactions concerning billing and payment for services or insurance coverage). A covered entity can be an institution, organization, or individual.

w88 slot online of Nevada, Reno

The Regents of the Nevada System of Higher Education (NSHE) have elected to make the system, including the w88 slot online of Nevada, Reno as a “hybrid entity” under HIPAA, which means the w88 slot online has both covered and non-covered functions. Most HIPAA regulations only apply to covered functions. Units within the w88 slot online’s health care component are the w88 slot online Nevada School of Nevada School of Medicine (UNSOM), which includes Campus Pharmacy – Reno, Department of Psychiatry and Behavioral Sciences, Department of Speech Pathology and Audiology, Family Medicine Center, Internal Medicine and Multispecialty Clinic, Mojave Adult, Child and Family Services, Patient-Centered Family Medicine Center, Pediatric Center, and the Wellness and Weight Management Center.

Additional covered entities at the w88 slot online include the w88 slot online of Nevada Student Health Center, the w88 slot online of Nevada Psychological Services Center, and the Behavioral Health Patient Care Center.

Additionally, to the extent that other campus units perform services to these covered components (e.g., storage of PHI, legal, audit, accounting, information technology, Institutional Review Boards, etc.), they are part of the health care component and must comply with the Privacy Rule. Disclosures of PHI by these covered functions to the rest of the w88 slot online are regulated by the Privacy Rule and treated like disclosures to entities outside the w88 slot online.

Affiliated Sites

For purposes of compliance with w88 slot online, Renown Health, Saint Mary’s Regional Health Center, and the VA Sierra Health Care System are also covered entities which must comply with w88 slot online requirements.

Research Subject to w88 slot online Privacy Requirements

Research is subject to w88 slot online privacy requirements when it is conducted alone or in conjunctions with the provision of health care services by individuals who are part of a covered entity or component.

For example, an optometrist who conducts a clinical trial with experimental contact lenses in the course of providing routine care to patients would be subject to the w88 slot online Privacy Rule and would produce Protected Health Information (PHI) as part of the study.

De-identified w88 slot online

De-identified health information is a record in which identifying information has been removed to render the health information not subject to w88 slot online’s Privacy Rule. Researchers may use or disclose de-identified health information, without restriction, since it is not PHI and thus is not protected by the Privacy Rule.

Covered entities seeking to release health information to researchers must determine that the information has been de-identified using either of the following methods: (1) by removing all 18 elements that could be used to identify the individual or the individual's relatives, employers, or household members (see the list of Personal Identifiers under w88 slot online), or (2) by using statistical methods to establish de-identification.

Accessing PHI for w88 slot online

  1. Obtaining Participant Permission through an w88 slot online Form
  2. Obtaining an IRB Waiver or Alteration of w88 slot online
  3. Using a Limited w88 slot online Set with a w88 slot online Use Agreement
  4. Using PHI for Activities Preparatory to w88 slot online
  5. Use or Disclosure of Decedents’ w88 slot online

w88 slot online Form

An Authorization Form is a form through which a w88 slot online participant’s signed permission is obtained to allow a covered entity to use and disclose the participant's PHI for w88 slot online purposes. In the case of minors, a signed Authorization Form is obtained from the minor’s parent or legal guardian.

Obtaining w88 slot online Authorization is required in addition to obtaining informed consent to participate in research. An Authorization Form focuses on privacy risks and states how, why, and to whom the PHI will be used and/or disclosed for research. This Authorization pertains to a specific research study.

The participant must be given a copy w88 slot online signed form to keep for their records. Also, the researcher must retain the signed form for six (6) years from the date of creation or the date it was last in effect, whichever is later.

Researchers can find a copy of the w88 slot online's HRPP HIPAA Authorization Form in the forms library of the online IRB protocol submission system, IRBNet.

w88 slot online Waiver or Alteration of Authorization

A Waiver or Alteration of Authorization can be requested when researchers are unable to use de-identified health information and the w88 slot online could not practicably be conducted if w88 slot online participants’ authorization were required.

For research uses and disclosures of the w88 slot online's PHI, the IRB may approve a waiver or an alteration of the Authorization requirement in whole or in part. A complete waiver is when the IRB determines that no Authorization is required for use or disclosure of PHI for a particular research project. A partial waiver of Authorization occurs when the IRB determines that a covered entity does not need Authorization for certain PHI uses and disclosures for research purposes, such as disclosing PHI for research recruitment purposes. An Alteration of Authorization occurs when the IRB is asked to waive one or more required elements of informed consent. For example, if the purpose of the study will not be disclosed to participants in order to avoid bias, this is an alteration because disclosure of the "purpose" is a required element of participant authorization. The IRB may also approve a request to alter or waive the requirements for Authorization under the condition that some PHI be removed from the proposed use or disclosure.

All of the following criteria must be met for the IRB approval of a waiver or alteration of Authorization requirements for use or disclosure of w88 slot online patient data:

  1. The use or disclosure of the w88 slot online involves no more than minimal risk to the privacy of individuals based on the presence of, at minimum, the following elements:
    1. An adequate plan to protect w88 slot online identifiers from improper use and disclosure;
    2. An adequate plan to destroy identifiers at the earliest opportunity consistent with conduct of the w88 slot online (absent a health or w88 slot online justification for retaining them or a legal requirement to do so); and
    3. Adequate written assurances that the PHI will not be reused or disclosed to (shared with) any other person or entity, except as required by law, for authorized oversight of the w88 slot online study, or for other w88 slot online for which the use or disclosure of the PHI would be permitted under the Privacy Rule.
  2. The w88 slot online could not practicably be conducted without the waiver or alteration.
  3. The w88 slot online could not practicably be conducted without access to and use of the PHI.

If a researcher has used or disclosed PHI for w88 slot online with the IRB approval of a waiver or alteration of Authorization, documentation of that approval must be retained by the researcher for six (6) years from the date of its creation or the date it was last in effect, whichever is later.

Researchers can find a copy of the w88 slot online's HRPP HIPAA Waiver of Authorization Form in the forms library of the online IRB protocol submission system, IRBNet.

Limited w88 slot online Set with a w88 slot online Use Agreement

With the establishment of an appropriate data use agreement (i.e., meets w88 slot online requirements, including limiting further use or disclosure of PHI) between the holder of the PHI and the researcher, a limited data set may be used or disclosed for research purposes without obtaining either an individual's Authorization or a waiver or an alteration of Authorization.

A Limited Data Set refers to PHI that excludes the following 18 categories of direct identifiers under w88 slot online. Inclusion of any of the following 18 variables means the health information is individually identifiable.

  • Names
  • Geographic subdivisions smaller than a state (e.g., street address, city, county, etc.)
  • All elements of dates (except year) for dates directly related to an individual, w88 slot online birth date, admission date, discharge date, date of death, and all ages over 89
  • Telephone numbers
  • Fax numbers
  • Electronic mail addresses
  • Social Security numbers
  • Medical record numbers
  • w88 slot online plan beneficiary numbers
  • Account numbers
  • Certificate/license numbers
  • Vehicle w88 slot online and serial numbers, including license plate numbers
  • Device w88 slot online and serial numbers
  • Web URLs
  • Biometric w88 slot online, including finger or voice prints
  • Full face photographic images and any comparable images
  • Internet Protocol address numbers
  • Any w88 slot online unique identifying number characteristic or code

The above identifiers must be removed from w88 slot online about the individual and the individual's relatives, employers, or household members if the data are to qualify as a limited data set.

Activities Preparatory to w88 slot online

For activities involved in preparing for w88 slot online, covered entities may disclose PHI to a researcher without an individual's Authorization, a waiver or an alteration of Authorization, or a data use agreement. However, the covered entity must obtain from the researcher the following written or oral representations:

  1. The use or disclosure is requested solely to review PHI as necessary to prepare a w88 slot online protocol or for similar purposes preparatory to w88 slot online.
  2. The w88 slot online will not be removed from the covered entity in the course of review.
  3. The PHI for which use or access is requested is necessary for the w88 slot online.

Decedents’ w88 slot online

The Privacy Rule protects the PHI of deceased individuals. Research that uses or discloses decedent PHI must comply with applicable w88 slot online regulations. (Note that w88 slot online protections cease for PHI of individuals deceased for more than 50 years.) Authorization from the personal representative or next of kin, a waiver or alteration of the Authorization, and/or a data use agreement are not required by w88 slot online in order to use decedent PHI.

Use of decedent health information does not require the IRB review and approval if it has been de-identified before receipt by the researchers or does not meet the definition of w88 slot online, as described in the sections above. However, if the study involves the researchers having direct access to decedent medical records or w88 slot online, even if identifiers will not be recorded by the researchers, an application must be submitted for the IRB review and approval.

Before releasing decedent w88 slot online, the covered entity must obtain the following information from the researcher:

  1. The researcher provides oral or written representations that the use and disclosure is sought solely for w88 slot online on the PHI of decedents.
  2. The researcher provides oral or written representations that the PHI for which use or disclosure is sought is necessary for the w88 slot online purposes.
  3. The researcher provides documentation of the death of the individuals whose w88 slot online is sought by the researchers.

Additional w88 slot online

For additional information on research and w88 slot online, please visit the links below and/or contact Research Integrity & Security.