Circular Exhibit 2003-02-P

POLICY AND PROCEDURE FOR USE AND DISCLOSURE OF
PROTECTED HEALTH INFORMATION
FOR RESEARCH PURPOSES

45 CFR 164.512(i), 5 USC 552a(b)(5)

1.

PURPOSE. To establish policy and procedures on how Indian Health Service (IHS) may use or disclose Protected Health Information (PHI) for research purposes without authorization by a patient.
 
2.

POLICY. To establish policy and procedure for the use and disclosure of PHI for research purposes in accordance with the Health Insurance and Privacy Accountability Act Privacy Rule and the Privacy Act. For research authorizations follow the Department of Health and Human Services (HHS) research guidance.
 
3.

PROCEDURES. The following procedures will be used for the use/disclosure of PHI for research purposes.
 
A.

Institutional Review Board. Upon receipt of the Institutional Review Board (IRB) Approval of Waiver of Authorization, the IHS will use and disclose PHI for research when its IRB has approved, in whole or in part, a waiver of the patient's authorization for its use and disclosure.
 
B.

Documentation of Waiver Approval. Documentation of IRB approval of waiver must include the following:
 
(1)

Identification.  A statement identifying the IRB and the PHI for which the use/disclosure has been determined to be necessary by the IRB.
 
(2)

Date of Action. Date on which the alteration or waiver of authorization was approved.
 
(3)

Waiver Criteria.  The IRB must include a statement that it has determined that alteration or waiver, in whole or in part, of the authorization satisfies the following:
 
a.

Use or disclosure of PHI involves no more a minimal risk to the privacy of individuals based on, at a minimum, the presence of the following elements:
 
(i)

An adequate plan to protect the identifiers from improper use/disclosure, including reasonable administrative, technical and physical safeguards against unauthorized use/disclosure.
 
(ii)

An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
 
(iii)

Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law; for authorized oversight of the research study, if personal identifiers are removed at the earliest opportunity consistent with the oversight activity or for other research for which the use/disclosure of PHI would be permitted under the HIPAA Privacy Rule, the Privacy Act and any other applicable law.
 
(4)

The research could not practically be conducted without the alteration or waiver; and
 
(5)

The research could not practically be conducted without access to and use of the PHI.
 
C.

Review/Approval Process. The IRB chair, or his/her designee, shall sign a statement that the alteration or waiver of authorization was reviewed and approved under normal and/or expedited review procedures. The statement shall also set out that an IRB followed the requirements of the Common Rule (45 Code of Federal Regulations Part 46), as applicable.
 
D.

Reviews Prior To Research. An IHS facility may allow PHI to be reviewed in preparation for research if the researcher represents that:
 
(1)

The use/disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes in preparation for research;
 
(2)

No PHI will be removed from the facility by the researcher in the course of the review; and
 
(3)

The PHI for which use/disclosure is sought is necessary for the research purposes.
 
E.

Research Involving Decedents' PHI. The IHS may use and disclose PHI if the researcher represents that:
 
(1)

the use/disclosure is sought solely for research on the PHI of decedents; and
 
(2)

the PHI for which use/disclosure is sought is necessary for the research purposes.
 
F.

Documentation . The IHS may require the researcher to provide documentation of the subject individuals' death.