The following slides explain the required elements that must be included for ahipaaauthorization to be valid
ICF and HIPAA Authorization Differences
An ICFand the IC process pertains to obtaining the subject’s permission (both initially and continually) for participation in a study after outlining forsubjects clearfacts, implications, and future consequences oftaking part in the research study.A HIPAAauthorization focuses on the rights of persons to control disclosure of their legally protected health information. Whenthe subject signsthe research HIPAA authorization they areeffectively transferringthat right to the researcher (foronlythe data outlined in the authorization)who is then allowed to obtain and potentially release the subject’s health-related information(onlyto entities outlined in the authorization).
ICF, HIPAA, and Protocol Similarities
Ensuring Consistency of Informed Consent Form, Protocol, and HIPAA Authorization.This means ensuring the language in the informed consent form is consistent with that in the protocol and, when applicable, in the HIPAA authorization.Ref: VHA Handbook 1200.05, ¶9k
Subject Identity: The HIPAA authorization has a place for the subject’s identity, i.e. name. (Ref: VHA Handbook 1605.1, ¶14b.)Description of Information:The protected health information to be used or disclosed is specifically listed on the HIPAA authorization. Note: If HIV, sickle cell anemia, drug and/or alcohol abuse treatment information will be disclosed, it must be specifically stated in the HIPAA Authorization. (Ref: VHA Handbook 1605.1, ¶14b)
Authorization to Use or Disclose:The HIPAA authorization identifies the people and organizations authorized to make the requested use or disclosure.(Ref: VHA Handbook 1605.1, ¶14b)Recipient Identification: The HIPAA authorization identifies to whom the information will be disclosed or released for use. (Ref: VHA Handbook 1605.1, ¶14b)
Description of Purpose:The HIPAA authorization includes a description of each purpose for which the information will be used or disclosed. A statement such as “for research purposes” is sufficient, though a more thorough description is preferred. If the study will eventually close, but the data will remain in a repository, the authorization should cover both events.(Ref: VHA Handbook 1605.1, ¶14b)
Expiration: The HIPAA authorization includes a date or event that explains when the authorization expires. “End of the research study” is sufficient for III in research. “None” is sufficient for III including for the creation and maintenance of a research database or research repository.(Ref: VHA Handbook 1605.1, ¶14b)
Signature and Date: The HIPAA authorization contains the signature line of the subject as well as the date signed. If subjects who are incompetent or lack decision making capacity will be included, a signature line for the person legally authorized in writing by the individual (or the individual’s legal guardian) to act on behalf of the individual, (i.e. power of attorney) is listed.(Ref: VHA Handbook 1605.1, ¶¶5b and 14b)Right to Revoke: The HIPAA authorization includes a statement that the subject has the right to revoke the authorization in writing, except to the extent that the entity has acted in reliance on it. (Ref : VHA Handbook 1605.1, ¶14b)
How to Revoke: The HIPAA revocation statement includes a description of how the subject may revoke the authorization, i.e. to whom it should be submitted. (Ref: VHA Handbook 1605.1, ¶14b)Conditioning: The HIPAA authorization includes a statement that treatment, payment, enrollment, or eligibility for benefits cannot be conditioned on the subject completing the authorization, but participation in the study may be conditioned on the subject signing the authorization.(Ref VHA: Handbook 1605.1, ¶14b)
Data Protection and Re-disclosure: The HIPAA authorization includes a statement that individually identifiable health information disclosed pursuant to the authorization may no longer be protected by Federal laws or regulations and may be subject to re-disclosure by the recipient.(Ref: VHA Handbook 1605.1, ¶14b)
For more Information
Contact the facility PO.Consult VHA Handbooks: 1605.1 (Privacy and Release of Information) and/or 1200.05 (Requirements for the Protection of Human Subjects in Research).