To learn more about this topic, view the Fred Hutch Privacy and Confidentiality Policy.
General Instructions for HIPAA Authorizations
To determine whether your research study will require HIPAA authorization from study participants, first determine the type of protected health information, or PHI, which will be accessed or used.
The sections below cover the following:
- Use of a limited data set
- Use of, or access to, more than a limited data set
- Waiver of HIPAA authorization
- Use of other covered entities' HIPAA forms outside of Fred Hutch, UW and Seattle Children's
Use of a Limited Data Set
By definition, a limited data set may include categories of PHI such as ZIP codes, geocodes, date of birth, data of admission/discharge/service and other unique codes.
Research studies that will only access a limited data set are not required to obtain a HIPAA authorization from study participants. However, the covered entity from the location where the limited data set will be accessed may require a HIPAA-compliant Data Use Agreement.
Use of, or Access to, More than a Limited Data Set
When using or accessing more than a limited data set, separate HIPAA Authorization forms are required depending on the type of activity or the location where the activity will take place.
| Who is conducting the activity or the location of the activity | Use this authorization form |
|---|---|
| 1. Fred Hutch Investigators, non-transplant-related research: most locations | Fred Hutch Protocol Specific Authorization Form |
| 2. Fred Hutch Investigators conducting transplant-related research at Fred Hutch or UW | Fred Hutch Transplant Program General HIPAA Authorization Form Updated, age-specific versions were posted to CTMS on June 7, 2021. To locate these forms, perform a Document Search in CTMS for the protocol number 'SHELL-CC-HIPAA'. This form is used for transplant program studies only. |
| 3. UW Consortium investigator | UW HIPAA forms |
| 4. All activities taking place at Seattle Children's | Seattle Children's HIPAA Form |
Waiver of HIPAA Authorization
Investigators requesting a complete waiver of HIPAA authorization are to use the HIPAA Supplement and Waiver of Authorization Form.
Those accessing medical records solely for purposes of ascertaining potential subjects may request a partial waiver for recruitment purposes using the HIPAA Supplement and Waiver of Authorization Form.
Note: The Fred Hutch IRB does not "approve" HIPAA authorization forms. Responsibility for the legal acceptability of HIPAA authorization rests with the covered entity from which researchers will obtain the PHI. Local requirements will vary. To determine what is needed, check with the institution where the PHI resides.
Use of Other Covered Entities' HIPAA Forms Outside of Fred Hutch, UW and Seattle Children's
Review the following scenarios to determine what information must be submitted to the Fred Hutch IRO for review:
- Separate PHI authorization to a research consent
- Inclusion of covered entity's HIPAA language into Fred Hutch consent forms
- Revisions to a currently approved separate HIPAA authorization to a research consent
- Revisions to consent forms that have HIPAA language inserted within the consent forms
- Status changes
Separate HIPAA Authorization to a Research Consent
If a covered entity requires the use of their own HIPAA forms, their forms will be used in place of the Fred Hutch HIPAA forms. In these situations, provide the following in Hutch IRB:
- A cover memo that outlines the other entity's request to use its HIPAA forms
- One copy of each of the covered entity's forms to be included in the IRB file
These forms will not receive Fred Hutch IRB approval dates.
Inclusion of Covered Entity's HIPAA Language into Fred Hutch Consent Forms
Contact the Fred Hutch Office General Counsel before using this method. If advised to do so, provide the following:
- One copy of the consent form
The consent form will be reviewed and approved by the IRB.
NOTE: This method is not recommended, but it may be used in some situations.
Revisions to a Currently Approved Separate HIPAA Authorization to a Research Consent
Submit the following:
- A Modification Supplement that notes the IRB file is being updated to contain the revised HIPAA
- One copy of the revised Separate HIPAA Authorization for inclusion into the IRB file
NOTE: These updated forms will not receive IRB approval dates.
Revisions to Consent Forms that have HIPAA Language Inserted within the Consent Forms
Submit the following:
- A Modification Supplement
- One copy of the revised consent form with track changes
- One original clean copy
These modifications will be reviewed and approved by the IRB.
Status Changes (Such as the Requirement of a New HIPAA Waiver)
Submit the following:
These changes will be reviewed and approved by the IRB.