HIPAA INFORMATION

(Health Insurance Portability and Accountability Act)

The investigator is responsible for implementing HIPAA-compliant steps to protect the privacy of a research subject's personally identifiable health information.

The privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA) require that additional safeguards be put in place to protect the privacy and security of an individual's health information, including persons enrolled as research subjects.

Although the UB research function has been explicitly defined as a non-covered function under HIPAA, research protocols involving the provision of health care, or that will be obtaining health information from a third party entity will be required by the UB IRBs to adhere to the HIPAA regulations as they relate to a non-covered entity for acquiring individually identifiable health information for research purposes from a covered entity.

In general, protocols that must comply with UB HIPAA policy will need to secure from each research subject a signed HIPAA compliant authorization form to use or disclose their personally identifiable health information for research purposes. In some instances, there are alternatives to obtaining authorization including a waiver of authorization and a certificate of de-identification. The HIPAA Worksheet will guide you to the correct option available to fulfill the new regulatory requirements and UB's policy for implementing them.

Important reminder: your research protocol may obtain individually identifiable health information from different locations, and for different uses in various stages of the protocol (e.g., subject identification, recruitment, data collection and analysis). A protocol that is required to comply with UB's HIPAA research policies MUST have a HIPAA mechanism in place for every piece of individually identifiable health information it obtains.

For more information about UB?s HIPAA compliance efforts, see the UB HIPAA website: UB HIPAA

(Note: All HIPAA forms can be found in IRBNet in the CYIRB Document Library.)