IRB Tip #2: HIPAA

Old school medical researchers (and social-behavioral, for that matter) find HIPAA the bane of their collective existences. Codified into federal law in 1996, HIPAA established national standards for health care insurance portability and patient privacy rights. From the researcher point of view, she could no longer simply open a medical record and review it for research purposes without written permission from the patient-subject or a waiver by a privacy board / IRB.

Patient advocates rejoiced. And despite being on the research side at the time, I celebrated too. How dare I, you ask? What self-respecting researcher likes HIPAA?

Frankly, I'm a big believer of individual rights. And this is a clear-as-day issue of individual rights.

Unfortunately, then states' rights ruled the day when it came to patient privacy. These rights were not consistent from state to state and depending on where you lived, someone could take a peak in your medical record without your permission. HIPAA ensures patient-subject rights to some degree. IRBs are often the entities which review requests to open medical records in a research setting.

Regardless of your feelings about HIPAA, I bet we'll agree on something HIPAA related: our HIPAA Research Application (HRA) is terrible. It is perhaps the worst form we have next to the Internal Adverse Event report form. More on that another time. Back to the HRA.

First the 4 page application is backwards. The first determination investigators must make is, "When will I look at the medical record?" If the answer is to enroll subjects, without first obtaining their permission, you will want to ask for a waiver of HIPAA and informed consent for research purposes. Respond to Section B (on Page 2 of the application), Section II.B (on page 1), Section I.A, I.B, I.C (also on page 1). Asking for a waiver of HIPAA will also lead you to complete section B.1-B.4 as appropriate.

If you will be reviewing the medical record only after obtaining signed informed consent, complete Section I.A, I.B, I.C (on page 1) and Section A (on page 2) by writing, "I assure the Board I will use the UCLA HIPAA authorization form and IRB approved informed consent form."

If at any time you add research information to the medical record, more often than not you must get HIPAA authorization and obtained signed informed consent to do so. This means complete Section I.A, I.B, I.C (on page 1) and Section A (on page 2) by writing, "I assure the Board I will use the UCLA HIPAA authorization form and IRB approved informed consent form."