Home : Academic/Research : Health Sciences

AUTHORIZATION PROCESS REQUIREMENTS
A valid written authorization is required for use or disclosure of PHI for research purposes except where the use or disclosure is otherwise permitted. All uses and disclosures made pursuant to an authorization must be consistent with the authorization. Individual authorization is required for all research involving treatment or intervention.

Researchers must provide a copy of the signed authorization to the research participants.

Researchers will retain the signed authorizations for a period of no less than 6 years from the end of the research study.

Researchers must obtain the valid, written authorization of individual participants in the research using a consent form that incorporates the HIPAA authorization elements, or a separate Authorization that meets HIPAA requirements for use or disclosure of PHI in research. Either document must be completed and signed by a person with authority to authorize, i.e. the individual or personal representative. Researchers must verify that the person who signs the authorization has this authority.

AUTHORIZATION DOCUMENT REQUIREMENTS
A valid Authorization is written in plain language and contains at least the following elements:

1. Participant Name;
2. Name/Identification of person or class of persons authorized to use or release the information;
3. Name/Identification of person or class of persons authorized to receive the information;
4. Specific and meaningful description of the information being used or disclosed;
5. Description of each purpose of the disclosure;
6. Date and signature of the individual or a personal representative and a description of such person's authority to sign on behalf of the individual;
7. Expiration date of the authorization, or event which would cause the authorization to expire. The statement "end of research study", "none" or similar language is sufficient when the authorization is for a research purpose;
8. Statement of the individual's right to revoke the authorization in writing, and either a description of the exceptions to the right to revoke and a description of how to revoke, or if this information is in a Provider Component's Notice of Privacy Practices, a reference to the Notice;
9. Statement of prohibition on conditioning treatment, payment, enrollment or eligibility for benefits on authorization, except in certain circumstances;
10. Statement that information disclosed to recipients who are not covered by HIPAA may be subject to re-disclosure by these recipients and no longer be protected by this rule;
11. If the authorization is part of a consent for treatment that involves treatment or intervention, and the researcher wishes to deny access to the information for the duration of the research study, a statement that the individual agrees that access to the information will be denied and that the right to access will be reinstated upon completion of the research study.

SPECIAL RULES FOR CONDITIONED AUTHORIZATIONS
Provision of treatment, payment, enrollment in a health plan or eligibility for benefits may not be conditioned on authorization except a provider may condition research related treatment on authorization for use or disclosure of the information for the research.

SPECIAL RULES FOR COMBINING RESEARCH AUTHORIZATIONS
A research authorization may be combined with another authorization or consent form for the same research study. However, an authorization for use or disclosure of psychotherapy notes may only be combined with other authorizations to use or disclose psychotherapy notes.

If research related treatment (or other treatment, payment, enrollment in a health plan or eligibility for benefits) is conditioned on the individual providing an authorization, the portion of the authorization on which the service is conditioned may not be combined with other authorizations.

Except as described above, authorizations may not be combined with other documents to create a compound authorization. If the PHI falls into one of the categories requiring separate authorization, a separate valid Authorization must be obtained.

DELAYING ACCESS TO INFORMATION OBTAINED IN RESEARCH INVOLVING TREATMENT OR INTERVENTION
A researcher may temporarily deny the individual access to information obtained in research involving treatment or intervention for the duration of the research study. To do so, the researcher must include in any consent to participate in the research, a statement that the individual agrees that access to the information will be denied temporarily and that the right to access will be reinstated upon completion of the research study. If the individual does not agree to an authorization with this provision, the individual may be denied participation in the research study.

REVOCATION OF AUTHORIZATION
The individual may revoke authorization at any time in writing, except to the extent that the health care component has taken action in reliance on the authorization. Data already collected under the authorization can be used to a limited extent if necessary to preserve the integrity of the research study, e.g. as necessary to account for the participant's withdrawal.

EFFECT OF PRIOR PERMISSIONS FOR RESEARCH
Special transition rules apply to uses and disclosures of PHI where prior permission or authorization for research purposes has been obtained.

PHI may be used or disclosed for research purposes to the extent allowed by any of the following prior permissions if the permission was obtained prior to April 14, 2003:

1. An authorization or other express legal permission to disclose PHI for the research;
2. Informed consent of an individual to participate in the research; or
3. Waiver of informed consent by the IRB.

If informed consent is sought after April 14, 2003, authorization must be obtained in accordance with the Authorization procedure. For ongoing research where an individual's permission was obtained prior to April 14, 2003, the individual's permission remains valid through the duration of the study, unless a new consent document is obtained for other reasons (e.g. significant change to research protocol, minor achieves adult status). Any such new consent must meet the HIPAA authorization requirements. For research subjects enrolled after April 14, 2003, the consent document or research authorization must meet the HIPAA requirements.