Part 2, Chapter 7: Manual Exhibit 2-7-O
Policy and Procedure for use and Disclosure of
Protected Health Information for Research Purposes
- PURPOSE. To publish the Indian Health Service (IHS) policy and procedures on how the IHS may use or disclose protected health information (PHI) for research purposes without authorization by a patient.
- 45 Code of Federal Regulations (CFR) 164.512(i)
- 5 United States Code 552a (b)(5)
- POLICY. It is IHS policy to use or disclose PHI for research purposes in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the Privacy Act. For research purposes and educational materials, follow the Department of Health and Human Services, National Institute of Health research guidelines.
- PROCEDURES. The following procedures will be used for the use or disclosure of PHI for research purposes.
- Institutional Review Board. Upon receipt of the Institutional Review Board (IRB) Approval of Waiver of Authorization, the IHS will use or disclose PHI for research when its IRB has approved, in whole or in part, a waiver of the patient’s authorization for its use or disclosure.
- Documentation of Waiver Approval. Documentation of IRB approval of waiver must include the following:
- Identification. A statement identifying the IRB and the PHI for which the use or disclosure has been determined to be necessary by the IRB.
- Date of Action. Date on which the alteration or waiver of authorization was approved.
- Waiver Criteria. The IRB must include a statement that has determined that the alteration or waiver, in whole or in part, of authorization satisfies the following criteria:
- Use or disclosure of PHI involves no more than minimal risk to the privacy of individuals based on, at least, the presence of the following elements:
- An adequate plan to protect the identifiers from improper use and disclosure, including reasonable administrative, technical and physical safeguards against unauthorized use and disclosure.
- An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
- Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law for authorized oversight of the research study if personal identifiers are removed at the earliest opportunity consistent with the oversight activity or for other research for which the use or disclosure of PHI would be permitted under the HIPAA Privacy Rule, the Privacy Act and any other applicable law.
- The research could not practicably be conducted without the alteration or waiver; and
- The research could not practicably be conducted without access to and use of the PHI.
- Review/Approval Process. The IRB chair, or designee, shall sign a statement that the alteration or waiver of authorization was reviewed and approved under either normal or expedited review procedures. The statement shall also set out that the IRB followed the requirements of the Common Rule (45 CFR Part 46), as applicable.
- Reviews Prior To Research. An IHS facility may allow PHI to be reviewed in preparation for research if the researcher represents that:
- The use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes in preparation for research;
- No PHI will be removed from the facility by the researcher in the course of the review; and
- The PHI for which use or disclosure is sought is necessary for the research purposes.
- Research Involving Decedents’ PHI.
- The IHS may use or disclose PHI if the researcher represents that:
- the use or disclosure is sought solely for research on the PHI of decedents; and
- the PHI for which use or disclosure is sought is necessary for the research purposes.
- The IHS may require the researcher to provide documentation of the subject individuals’ death.
Back To Top