1. Paula Peyrani, MD Medical/Project Director, HIV Program at the 550 Clinic Assistant Director, Research Design and Development Clinical and Translational Research Support Center Division of Infectious Diseases University of Louisville p0peyr01@louisville.edu Privacy Practices A practical approach to HIPAA Privacy Practices A practical approach to HIPAA

2. Implemented in 2003 Protect individual’s right to control their private and confidential information The HIPAA Privacy and Security Rules apply to covered entities Health plan Healthcare clearinghouse Healthcare provider Health plan Healthcare clearinghouse Healthcare provider HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

3. Implemented in 2003 Protect individual’s right to control their private and confidential information The HIPAA Privacy and Security Rules apply to covered entities Use ≠ Disclose CRC in clinic “uses” PHI when seeing a study subject USE Occurs within the cover entity USE Occurs within the cover entity HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

4. A sponsor monitor sees study subject’s chart DISCLOSE Occurs when the PHI moves outside the covered entity DISCLOSE Occurs when the PHI moves outside the covered entity Implemented in 2003 Protect individual’s right to control their private and confidential information The HIPAA Privacy and Security Rules apply to covered entities Use ≠ Disclose HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

5. Implemented in 2003 Protect individual’s right to control their private and confidential information The HIPAA Privacy and Security Rules apply to covered entities Use ≠ Disclose Covered entity is required to disclose if requested by the patient or by the DHHS HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

6. Health Information At least ONE of the HIPAA Identifiers WHAT IS PROTECTED HEALTH INFORMATION?

7. 1.Names 2.Street address, city, county, precinct, zip code, and equivalent area geo-codes 3.ALL elements of dates (except year) for dates directly related to an individual (includes procedure dates, date of admission, lab work dates) and all ages over 89 4.Telephone numbers 5.Fax numbers 6.Electronic mail addresses 7.Social security numbers 8.Medical record numbers 9.Health plan ID numbers 10.Account numbers 11.Certificate/license numbers 12.Vehicle identifiers and serial numbers, including license plate numbers 13.Device identifiers/serial numbers 14.Web addresses (URLs) 15.Internet IP addresses 16.Biometric identifiers, including finger and voice printing 17.Full face photographic images and any comparable image 18.Any other unique identifying number, characteristic, or code WHAT IS PROTECTED HEALTH INFORMATION?

8. A clinical trial with the subjects authorization Recruitment within the researcher’s covered entity Recruitment by obtaining PHI from another covered entity through a partial waiver of the requirement to obtain an authorization from the subject Retrospective records reviews with a complete waiver of the requirement to obtain an authorization from the subject Research on decedent information Research using a limited data set Preparing a research protocol Research using a de-identified data set In order to look at, collect, share, or disclose patient information you must have the patient’s permission using a form called the “Research Authorization” OR meet a HIPAA exception In order to look at, collect, share, or disclose patient information you must have the patient’s permission using a form called the “Research Authorization” OR meet a HIPAA exception HOW CAN WE USE/DISCLOSE PHI IN RESEARCH?

9. A clinical trial with the subjects authorization HOW CAN WE USE/DISCLOSE PHI IN RESEARCH? UofL VA

10. A clinical trial with the subjects authorization Recruitment within the researcher’s covered entity Recruitment and review of PHI through a partial waiver of the requirement to obtain an authorization from the subject Retrospective records reviews with a complete waiver of the requirement to obtain an authorization from the subject Research on decedent information Research using a limited data set Preparing a research protocol Research using a de-identified data set HOW CAN WE USE/DISCLOSE PHI IN RESEARCH?

11. Permits access to the PHI described by the researcher in the waiver application No more than minimal risk to the individual’s privacy based on:  Plan to protect and destroy identifiers  Written assurances that PHI will not be reused and/or disclosed  Research could not be practicably conducted without access the PHI  Research could not be practicably done without the waiver HOW CAN WE USE/DISCLOSE PHI WITHOUT A RESEARCH AUTHORIZATION? IRB WAIVER

12. PARTIAL WAIVER  Generally used for recruitment purposes (during screening phase)  Covers the use of PHI up to contacting a potential subject. Then, to continue using PHI, a RA needs to be signed. COMPLETE WAIVER  Not restricted to screening or recruitment purposes  Generally used for retrospective chart reviews HOW CAN WE USE/DISCLOSE PHI WITHOUT A RESEARCH AUTHORIZATION? IRB WAIVER

13. Information on living patients is not included CE obtains assurances from researcher  The use or disclosure involves information that is solely that of decedents  The PHI is necessary for the research purpose.  Upon request from the CE, proof of death of individuals whose information is sought. HOW CAN WE USE/DISCLOSE PHI WITHOUT A RESEARCH AUTHORIZATION? RESEARCH ON DECEDENT INFORMATION

14. Allows certain identifiers to be associated with the data Can only be used for purposes of research, public health, or health care operations Must obtain a Data Use Agreement from the recipient of the LDS HOW CAN WE USE/DISCLOSE PHI WITHOUT A RESEARCH AUTHORIZATION? LIMITED DATA SET

15. Allows certain identifiers to be associated with the data. 1.Names 2.Street address, city, county, precinct, zip code, and equivalent area geo-codes 3.ALL elements of dates (except year) for dates directly related to an individual (includes procedure dates, date of admission, lab work dates) and all ages over 89 4.Telephone numbers 5.Fax numbers 6.Electronic mail addresses 7.Social security numbers 8.Medical record numbers 9.Health plan ID numbers 10.Account numbers 11.Certificate/license numbers 12.Vehicle identifiers and serial numbers, including license plate numbers 13.Device identifiers/serial numbers 14.Web addresses (URLs) 15.Internet IP addresses 16.Biometric identifiers, including finger and voice printing 17.Full face photographic images and any comparable image 18.Any other unique identifying number, characteristic, or code HOW CAN WE USE/DISCLOSE PHI WITHOUT A RESEARCH AUTHORIZATION? LIMITED DATA SET

16. PHI is needed in order to prepare a research protocol and/or for limited recruitment activities Applies when researcher is workforce member of the CE (otherwise, obtain a partial waiver) HOW CAN WE USE/DISCLOSE PHI WITHOUT A RESEARCH AUTHORIZATION? PREPARATORY FOR RESEARCH

17. None of the 18 HIPAA identifiers are part of the information. 1.Names 2.Street address, city, county, precinct, zip code, and equivalent area geo-codes 3.ALL elements of dates (except year) for dates directly related to an individual (includes procedure dates, date of admission, lab work dates) and all ages over 89 4.Telephone numbers 5.Fax numbers 6.Electronic mail addresses 7.Social security numbers 8.Medical record numbers 9.Health plan ID numbers 10.Account numbers 11.Certificate/license numbers 12.Vehicle identifiers and serial numbers, including license plate numbers 13.Device identifiers/serial numbers 14.Web addresses (URLs) 15.Internet IP addresses 16.Biometric identifiers, including finger and voice printing 17.Full face photographic images and any comparable image 18.Any other unique identifying number, characteristic, or code HOW CAN WE USE/DISCLOSE PHI WITHOUT A RESEARCH AUTHORIZATION? DE-IDENTIFIED DATASET

18. References 1. Woodin K. The CRC’s Guide to Coordinating Clinical Research. Thompson Centerwatch. 2004 2. University of Louisville. Investigator’s Guide for Human Research. Version November 29, 2010.