VCOM Institutional Policy and Procedure Manual

Criterion 1: “The use or disclosure of protected health information involves no more than a minimal risk to privacy of individuals based on (a) an adequate plan to protect the identifiers from improper use and disclosure; (b) an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research (unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law); and (c) adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by this subpart.” Justification: This criterion is readily met by investigators insofar as the medical information will be recorded without patient identifiers (e.g., names, phone numbers, addresses, etc.) or linkage codes (e.g., social security numbers, medical record numbers, etc.). Thus, there is no collection of protected health information (e.g., identifiable medical record information) or any possibility of subsequent disclose of protected health information. Furthermore, and consistent with this waiver request, the investigators who will access the protected health information also provide related care, or are in the position to provide that care, to these patients, thus minimizing privacy and confidentiality concerns. Criterion 2: “The research could not practicably be conducted without the waiver or alteration.” Justification: This criterion is met by investigators insofar as the patients, whose protected health information will be accessed under this waiver request, have not previously provided informed consent for this retrospective research activity and it is impractical to obtain consent from these individuals because they are no longer in the hospital and contacting them is precluded by the researcher’s inability to use patients’ identifiable contact information without their prior consent. Thus, obtaining the HIPAA authorization of these patients for the research use of their heath information is impracticable. Criterion 3: “The research could not practicably be conducted without access to and use of the protected health information.” Justification: This criterion is met by the overall scientific design of the study with focuses on identifying and/or evaluating inter-relationships among various medical variables. Consistent with the “minimum necessary standard” of the HIPAA privacy rule, investigators will access and collect only the specific health information necessary to complete this research study. This HIPAA Privacy Rule (45 CFR 164.512.i) gives individuals the right to receive an accounting of certain disclosures of protected health information made by a covered entity. It also allows for a simplified accounting of disclosures of protected health information for research purposes, when at least 50 patient records are reviewed as part of the research activity. Because this simplified accounting procedure permits covered entities to provide individuals with a list of all protocols for which the patient’s protected health information may have been disclosed, the IRB will keep on file a listing of each IRB protocol approved with a waiver of HIPAA authorization. This listing will include the title of this protocol, the researcher’s name and the researcher’s contact information. If the I of the retrospective research study does not provide related care or is not in the position to provide related care to the patients whose medical records are being accessed, it is recommended that the investigator utilize the services of a College IRB certified honest broker system. The honest broker by definition, involves an individual (e.g., clinical clerk, nurse) who would normally have access to the desired medical records information by virtue of her/his hospital responsibilities and who is not involved 3. U SE OF A C ERTIFIED H ONEST B ROKER S YSTEM