The IRB has revised its human subject research determination form to make it easier to request HIPAA authorization waivers for research projects using material subject to HIPAA, but which aren’t really identifiable as far as the human subject research regulations are concerned.
Let us explain.
One thing that has long gotten our collective goat is the discrepancy between the Common Rule’s and the HIPAA regulations definitions of identifiable information. In a nutshell, medical information is considered identifiable under HIPAA if it includes any of the 18 HIPAA identifiers (find the list of identifiers here). However, as far as OHRP and UAMS IRB Policy 1.4 policy are concerned, material is identifiable only if the identity of the subject is or may be readily ascertained by those doing the research.
What this meant that if we got a human subject research determination saying the only information the project will involve would be something like heart disease diagnosis and county of residence, our first instinct would be to call it not human subject research, because we don’t think subject identities are “readily identifiable” from just that information. However, since a geographic division smaller than a state is an identifier, and heart disease diagnosis is medical information, the two together constitute PHI. Since we had no easy way of granting HIPAA authorization waivers without a full IRB submission, we had no choice but to ask that PI to submit a complete protocol for review and approval. That was a big inconvenience for the investigator.
Now, however, we’ve amended the HSR determination form so we can send it back to you with a “determination deferred; this project needs a HIPAA authorization waiver” letter. Then the study team just needs to log back into the HSR determination form, complete the HIPAA authorization waiver request section that will now be accessible, and resubmit the form to the IRB. We can use the information in the HSR form to grant you the authorization waiver.
A couple of caveats:
- The IRB limits these waivers to data containing only two types of identifiers: subject-specific dates other than birth or death date AND geographical area smaller than a state. The other HIPAA identifiers are generally more closely tied to individual identities, throwing the study data into the realm of human subject material.
- The data you actually use in your project must exactly match what you say you’re going to use in your project. Just like in a regular new submission, the HIPAA authorization waiver must specify the data to which it applies, which is why we need a complete list.
- We cannot guarantee that we will not make you complete a full submission anyway, even if you’re using only one of the above identifiers. Like so many things in the IRB realm, “it depends.” We can’t make blanket statements because there will always be an exception. We expect these exceptions to be rare, but we can’t rule them out completely.