HIPAA Research Policies and Procedures Q & A

Saint Louis University HIPAA Research Policies and Procedures Q & A

GENERAL QUESTIONS

Q: What is PHI? A: PHI = Health Information + Personal Identifiers

Q: What is Health Information? A: Any information, whether oral or recorded in any form or media, that (1) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

Q: What is research? A: A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. This includes the development of research repositories and databases for research.

Q: What constitutes “Research Records?” A: Research records constitute more than just Case Report Forms. It contains any PHI in the research records or notes the investigator collects.

Q: What is a database custodian? A: A database custodian is an individual who maintains a log of individuals who receive PHI from the database.

Q: What is a Limited Data Set? A: Refers to PHI that excludes 16 categories of direct identifiers and may be used or disclosed, for purposes of research, public health, or health care operations, without obtaining either an individual’s Authorization or a waiver or an alteration of Authorization for its use and disclosure, with a data use agreement. Elements of a limited data set include ZIP codes, geocodes (town, city, state), dates of birth and other dates.

Q: What is a Data Use Agreement? A: An agreement into which the covered entity enters with the intended recipient of a limited data set that establishes the ways in which the information in the limited data set may be used and how it will be protected.

Q: What is a covered entity? A: Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. Covered

Version: 8/1/11 entities can be institutions, organizations, or persons. Researchers at SLU are included as part of the SLU single covered entity.

Q: What is a designated record set? A: A group of records maintained by or for a covered entity that includes (1) medical and billing records about individuals maintained by or for a covered health care provider; (2) enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (3) used, in whole or in part, by or for the covered entity to make decisions about individuals. A record is any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a covered entity. It can also include research records.

Preparatory to Research

Q: Is there any part of the research data collection process that is not required to be reviewed by the IRB for privacy review assuming other Common Rule requirements do not require IRB review? A: Yes, information that is preparatory to research, decedent research, limited data sets with data use agreements, and information that comes to the PI de-identified and information stripped of all 18 identifiers* listed in HIPAA: *address, account number, any vehicle or device serial number, certificate/license number, date of birth, e-mail address, fax number, finger or voice prints, health plan, internet protocol (IP) address number, name, name of employers, photographic images (x-rays), social security number, telephone number, web universal resource locator (URL).

Q: How can I review medical records of patients with a particular disease to identify participants for my research study? A: Apply to the custodian of the records to review the records under Preparatory to Research. However, recruitment of subjects, other than medical practitioners own patients, must be with IRB approval.

Submitting to the IRB Authorizations Q: When do I need a HIPAA research authorization? A: When you plan on collecting PHI for research to be used or disclosed.

Q: How do I complete an authorization and what information must be included? A: The template authorization is linked to the IRB website.

Q: Do I need a HIPAA research authorization for subjects recruited into a previously IRB approved study? A: If the consent form was signed before April 14, 2003, no additional form is needed. If you enroll subjects into a research study April 14, 2003 or later, you will need to have each subject sign an approved HIPAA Addendum form. If you re-enroll or if the IRB determines that re- consent of subjects is needed you will need a HIPAA Addendum. Version: 8/1/11 Waivers

Q: When do I seek a waiver of authorization for access to PHI and how do I obtain it? A: If your study meets the criteria for a waiver, you may request a Waiver of Authorization in the IRB Application. These criteria are: 1. Protected Health Information (PHI) to be used and/or disclosed is the minimum necessary information for the study. 2. The use or disclosure of PHI involves no more than minimal risks to the privacy of individuals based on, at least, the presence of the following three elements: a. There is an adequate plan to protect the identifiers from improper use and disclosure. b. There is an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law. c. PHI information will not be reused or disclosed to any other person or entity, except as required by law for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted by HIPAA. 3. The research could not practicably be conducted without the waiver or alteration. 4. The research could not practicably be conducted without access to and use of PHI.

Q: Who will be doing the review of the research authorizations and waivers? A: The IRB.

ONCE RESEARCH IS APPROVED

Q: How does the Certificate of Confidentiality relate to the HIPAA changes? A: HIPAA does not affect on the protections provided by a Certificate of Confidentiality.

Q: Do my obligations to report serious adverse events or data required by state laws change under HIPAA? A: No

Q: How should I store my paper and/or electronic data to be compliant with HIPAA? A: Your electronic and paper copies should be stored in a safe place where the information can be kept confidential. For example, in a locked filing cabinet in a locked office or password protected.

Q: How do I dispose of my research data that contains PHI? A: Possible suggestions are to shred the data, clear the hard drive, destroy CDs, strip data of all identifiers, etc. Keep in mind the data retention policies of sponsors (e.g., NIH, NSF, commercial sponsors).

Q: How long must signed Authorizations and disclosures of PHI be tracked? A: The signed Authorization and any disclosures made under a HIPAA Waiver must be retained by the covered entity for 6 years from the date of creation or the date it was last in effect, whichever is later.

Version: 8/1/11 Q: Who will handle requests for use and disclosure of PHI? A: For research related requests: email the IRB at [email protected], or phone (314) 977-7744. For all other requests: email the University Privacy Officer, at [email protected], or phone (314) 977-5545.

Q: What must I do if a subject revokes authorization to use their PHI for research purposes? A: Send the participant notification in writing that his/her request has been received. Track this information, and count this as a subject withdrawal on your continuing review application.

Q: How do I track the research authorizations from each patient and his/her wishes regarding the use of their PHI for research? A: Authorizations should be put in the research file along with the consent. Also keep documentation of:  Any requests for revocation of authorization ( kept in the participant’s research file)  IRB granted waivers of authorization

Q: What information must be conveyed to a research subject if they submit a withdrawal letter from the study? A: The PI or study representative can write on the letter “Receipt of the letter and withdrawal from the study acknowledged.” The PI or study representative should sign and date the acknowledgement and return a copy of the letter to the study subject.

Q: Can I expect audits or inspections for HIPAA compliance? A: Yes, the federal government or University Compliance could audit. There are heavy monetary fines for non-compliance. Therefore, internal audits to monitor compliance may take place.

Q: What research data may I share with research collaborators who are at another university? A: If the investigator is part of your research team and as long as it is so designated in the authorization, PHI may be shared with the collaborator. Other options include use of a Limited Data Set with a Data Set Agreement.

Q: I am performing clinical research that also involves treatment. What steps do I need to take to deal with both the clinical and research issues? A: Either an authorization or a waiver of authorization will cover all aspects of the research study. It is important that your clinical authorization for each participant contains a copy of your research authorization or waiver (if appropriate) to identify the participant as a research participant as well as a clinical patient. All participants undergoing clinical treatment should be given the Notice of Privacy Practices prior to collection of PHI.

Q: After the IRB approved HIPAA Authorization form is signed by a subject, along with the IRB approved consent form, allowing investigators to use and disclose PHI for purposes explained in the consent form, how, or is the Disclosure Tracking Log then utilized? A: If you have received authorization to use and disclose PHI, there is no tracking requirement so long as you only disclose to the individual/entity described in the HIPAA Addendum. If you have a Waiver of Authorization, you must track any disclosures.

Version: 8/1/11 Q: Are there research studies in which both a Waiver of HIPAA authorization is allowed and a requirement for a HIPAA Authorization needed? A: Yes, as examples, emergency research or a telephone interview that includes potential recruitment may qualify for a Waiver, but a subsequent collection of prospective research information with an encounter with the study subject may require an Authorization.

Q: We obtain IRB approved consents from mothers providing tissue for our cord blood collection program. Do we also need a HIPAA authorization? A: Because the Saint Louis Cord Blood Bank is part of the NMDP (National Marrow Donor Program), under HIPAA, there is no requirement to obtain authorization to share cord donor information even though it is considered protected health information. Consents for treatment are not part of the HIPAA authorization requirement; however you indicated an informed consent that mothers sign when donating cords. If it is just consent for treatment, there is no special change that needs to take place for HIPAA. Your reference to IRB approval would seem to imply research. If research is involved a specific authorization or waiver would be required to utilize the protected health information (PHI).

Q: I understand that the acknowledgement of NPP signed by the patient goes to Medical Records but we have several patients who are referred for research studies by physicians who never go to the DOB and therefore do not have a medical record. Should the copy of the acknowledgement go in the research chart? A: Yes, the acknowledgement should go into the research chart. You may also wish to indicate, by using a sticker or some other means, that the patient has received a copy of the Privacy Notice and therefore will not need to receive a notice on subsequent visits.

Q: When do I need to give a Notice of Privacy Practices to the research subject? A: At the first face to face meeting with the subject, you should give them a copy of the NPP and ask that they sign the receipt acknowledge form.

Q: We do not use Study Manager so is it acceptable to track disclosures using an Excel database? A: HIPAA does not specify how we track disclosure. In those situations that we don't have access to more sophisticated means of electronic tracking, an Access database or Excel spreadsheet is acceptable as long as it contains the required elements of information. There is a sample Excel spreadsheet that is available on the IRB-HIPAA Web site.

Q: Our department utilizes shadow charts. The Study Unit will copy from the shadow chart to make the research chart for source documentation purposes. Is this still acceptable under HIPAA? A: We do not want to use shadow charts as the documentation source but use Medical Records as the source for disclosure accountability purposes. The expectation is that you will not use Shadow Charts as the source document.

Q: Research charts are currently locked at night but not in locked cabinets. Our space is locked at night and the doors into the area itself are locked by security. In essence, our files are double- locked with limited access. Is that sufficient? A: Absolutely reasonable.

Version: 8/1/11 DATABASE RESEARCH

Q: Do I need to seek any review and approval before I conduct database research? A: Yes, you should submit an application for a HIPAA Waiver.

Q: What do I do if I have a database that is used for clinical purposes? A: Clinical database registration will be handled through the business units. Contact your HIPAA Liaison or Trainer for more information.

Q: What should I do if I have an existing research database that contains lots of patient information? A: If you have not already done so, fill out an application to list your database with the IRB so that you will be able to use the database for research purposes.

Q: I work with existing or discarded tissue specimens. Am I affected by the new HIPAA rules? A: It depends – if the samples are de-identified (contain no PHI), the research is not affected by HIPAA. If PHI is associated with the tissue sample you should apply for a HIPAA waiver If samples are collected prospectively and consent is sought, HIPAA authorization will be required.

Q: Do I have to seek a waiver of authorization or an authorization every time I do a data search in my database? A: No, as long as you are not conducting research, you are allowed to conduct searches on your private databases.

Q: Does SLU have a standard Data Use Agreement? A: A standard Data Use Agreement is available on the SLU IRB HIPAA web site.

TELEPHONE INTERVIEWS Q: In regard to subjects where we consent them by telephone, do we have to make any changes associated with HIPAA language? A: The researcher should first apply for a HIPAA Waiver. The interviewer should then incorporate HIPAA related privacy information into the telephone script and inform the subject that the Notice of Privacy Practices (NPP) is available via the web or the investigator can send a copy of the NPP if the subject provides a name and mailing address

Q: If I am approved by the IRB for a HIPAA Waiver because I am conducting a telephone survey, do I need to collect additional PHI so I can send a Notice of Privacy Practices to the research subject? A: Under a HIPAA waiver there is no need to send NPP but it is suggested that your phone script state that NPP is available via the web or the investigator can send a copy of the NPP if the subject provides a name and mailing address

Version: 8/1/11 RECRUITMENT ISSUES Q: Typically, our physicians see patients in clinic and send us a memo asking us to put the patient in our database for potential studies. Is this allowable under HIPAA? A: The patient should sign a letter authorizing permission to keep their name, address, phone number, etc. in a database for purposes of future recruitment for research. The letter must also indicate that the patient has the right to opt out at any time. This authorization should be obtained at the time of treatment.

Q: We usually prescreen charts to see if a patient will qualify for a study. Does this require authorization? A: Please see the Preparatory to Research Review Application.

Q: Normally, patient information in our database is used at the beginning of a clinical research project to help identify patients with a specific diagnosis who therefore may be a good candidate to include in a study. If I receive a request from a SLU clinician for a list of patients with a particular diagnosis, do I need a waiver? If yes, does the clinician submitting the request to me need to provide the waiver? A: Under HIPAA, access to this information is allowable under the Preparation for Research. Please see the Preparatory to Research Review Application.

Q: We do many collaborative projects and receive requests from researchers outside of the SLU community. Do we need any additional releases, waivers? If so, what? A: Collaborative studies involving HIPAA could have any range of requirements, including IRB review, code access agreements and/or if PHI is limited to dates and certain geographic data (a Limited Data Set), a Data Use Agreement may be needed. Contact the IRB to determine how to proceed with the collaboration in a fully compliant manner.

Version: 8/1/11