1. H I P A A T R A I N I N G Self Directed Module 7 Research Disclosures For Data Custodians START Click to begin…

2. Prev Introduction In this course, you will learn about HCHC’s policies and procedures regarding disclosure of PHI for research purposes. All HCHC workforce members involved with research must comply with these policies and procedures. Next

3. Prev Use and Disclosure of PHI in Research The HIPAA Privacy Rule establishes the conditions under which PHI may be used or disclosed by a covered entity for research purposes. Research using patient records, both paper and electronic format, or excess human tissues, must be –conducted by a full time member of the Medical Attending Staff or his/her designee –approved by the Chair of the clinical department involved and –approved by the Committee on the Protection of the Rights of Human Subjects (IRB). Next

4. Prev Use and Disclosure of PHI in Research In those instances where projects proposed by the Medical Allied Health Staff do not fall within the areas of concern of a member of the attending staff, the President of the Hospitals or the Chief of Staff may provide sponsorship. HCHC staff are responsible for understanding: –the documentation requirements prior to releasing PHI for research purposes; and –the accounting of disclosure requirements when PHI is released for research purposes. Next

5. Prev Use and Disclosure of PHI in Research HCHC staff use and disclose PHI for both treatment and research purposes. Different requirements and procedures apply to each. These requirements are included in the HCHC Release of PHI for Research Purposes Policies and the Privacy Guidelines. Next

6. Prev Use and Disclosure of PHI in Research Any use of PHI for research purposes, even if the investigator is the patient’s treating physician, must be reviewed and approved by the IRB. Requests for use of excess surgical pathology tissue in research must be approved by the Director of Surgical Pathology. Next

7. Prev Use and Disclosure of PHI in Research HCHC is permitted to use and disclose PHI for research with individual authorization or, under limited circumstances, without individual authorization. PHI may be used for research with: –Authorization signed by the patient (or copy of informed consent document signed before 4/14/03); OR –Waiver of Authorization approved by the Internal Review Board (IRB) (or copy of IRB waiver of informed consent approved prior to 4/14/03); OR –Limited Waiver of Authorization approved by the IRB for research eligibility prescreening and/or recruitment contact. Next

8. Prev Use and Disclosure of PHI in Research PHI may be used for research if it is: Completely “de-identified” –requires the removal of the 18 identifiers listed in the HCS Release of PHI for Research Purposes policy. A “limited data set” which requires –specific direct identifiers to be removed and –compliance with specified terms of a data use agreement. Reviewed solely in preparation for research which requires that –no PHI will be removed from records –no PHI will be recorded, –no patients will be contacted using PHI obtained from records Research on decedents which –requires the researcher to present a written statement that access is solely for research of decedents and that decedent’s PHI is necessary for study and –if requested, will provide documentation of the death of the individual. Next

9. Prev Use and Disclosure of PHI in Research HCHC staff who are requested to provide access or disclose PHI for research purposes documented in records in their custody must assure that the following completed documentation has been provided to the MIM Department Research Section: –Form HD974 (Request for Access to Protected Health Information for Research Purposes); –SARF (Systems Access Request Form), if applicable, signed by the Principal Investigator listed on the IRB Approval Letter; –IRB approval letter AND Authorization signed by the patient (or copy of informed consent document signed before 4/14/03). A copy of the consent/authorization form must be sent to the Medical Information Management Department to be filed; OR IRB Waiver of Authorization/Informed Consent (or copy of IRB waiver of informed consent approved prior to 4/14/03). Next

10. Prev Options used for HIPAA Compliant Disclosures for Research Research eligibility prescreening and/or recruitment contact –the researcher must present IRB Waiver of Authorization or IRB Limited Waiver of Authorization and the HD974 appropriately completed. Review preparatory to research only –the researcher must present the HD974 appropriately completed. Access to WebCIS will not be granted for these reviews. Only decedents –the researcher must present a written statement included on the HD974 and will provide documentation of the death of the individuals if requested. Limited data sets –the researcher must present a Data Use Agreement. HD974 incorporates Data Use Agreement for UNC-CH researchers. De-identified information –the researcher must present the HD974 form and the completed Request for Record Review or Database Reports form. All 18 identifiers must be removed as outlined in the HCHC Release of PHI for Research Purposes policy. Next

11. Prev Requirements for Records or Information Custodians HCHC Staff who disclose PHI for research purposes, including both paper and electronic records must assure that all required documentation is submitted to the Medical Information Management (MIM) Research Section. The MIM Research Section will send the relevant documentation to the appropriate records custodian to notify the custodian that the required documentation has been received. Access must be limited to a period of time not to exceed the duration of the IRB approval for the research protocol, which is noted on the IRB approval letter. Next

12. Prev Accounting of Disclosures Requirements HCHC staff who disclose PHI for research purposes MUST maintain an accounting of disclosures under the following circumstances: –using an IRB Waiver of Authorization with fewer than 50 patients involved by entering each accounting of disclosures into the DisclosureTrac database, –reviews preparatory to research only, or –reviews of decedents’ information MIM will account for the disclosures for reviews of 50 or more patients. Next

13. Prev Accounting of Disclosures Requirements HCHC staff who disclose PHI for research purposes ARE NOT required to maintain an accounting of disclosures under the following circumstances: –Disclosures with written Authorization of the patient –Disclosures of Limited Data Sets –Disclosures of De-identified information Next

14. Prev Use and Disclosure of PHI in Research For additional information, web sites, detailed procedures, and forms refer to: –HCHC Release of PHI for Research Purposes Policy –HCHC Privacy Guidelines –HCHC Accounting of Disclosures Policy –HCHC HIPAA Research Policy Next

15. Prev You have now successfully completed the online HIPAA Research Use and Disclosure Module - Click to end show - Prev