HIPAA has been confusing for all of us as it applies to research. Even though we’ve been dealing with it for years, we still see scenarios that make us wonder whether HIPAA applies to a particular study and, if so, how to best meet HIPAA requirements.
One thing to keep in mind is that HIPAA applies only to studies that involve protected health information (PHI). The policy definition of PHI is material that is part of an individual’s health information that identifies the individual or there is a reasonable basis to believe the information could be used to identify the individual, including demographic information, and that (i) relates to the past, present or future physical or mental health or condition of the individual; (ii) relates to the provision of health care services to the individual; or (iii) relates to the past, present, or future payment for the provision of health care services to an individual (emphasis added).
This definition means that both the health information and something allowing relinkage to an individual have to be involved in a research study for HIPAA to be applicable. Collecting your study subjects’ names and addresses doesn’t automatically mean the study is subject to HIPAA. Perhaps the only reason you’re collecting that information is so you can send your subjects a check for participating in a study that doesn’t involve health information. No health information means no HIPAA. An anonymous survey that collects health information but nothing allowing reidentification of subjects means no HIPAA. However, accessing identifiable medical records to to collect study data means HIPAA applies, even if you won’t write down any identifiers with your data.
Keep HIPAA in mind when writing your protocol and completing the CLARA new submission form. If HIPAA doesn’t apply, make it clear in the new submission form’s HIPAA section that the study involves no PHI. Remember, if you’re collecting just names and contact information but no associated health information, you’re not collecting PHI. If HIPAA is not applicable, you don’t need a HIPAA authorization waiver, so you can click “no” in the response to the “are you requesting a waiver or alteration of the HIPAA authorization requirement” query. And be careful to avoid any mention of “PHI” in the protocol if your study does not involve PHI. But if you’re accessing or collecting any identifiable health information, HIPAA becomes an issue, and the protocol and new submission form should both address the use of PHI accurately.