A HIPAA Waiver of Authorization can be obtained from the IRB if access to patient data is needed for recruitment purposes. Describe the need in the “HIPAA Research Authorization and/or Waiver or Alteration of Authorization” section of the protocol template or the protocol site addendum. This section is reviewed by the IRB. If a full or partial waiver is granted, access to identifiable patient data to determine if a patient may be a potential research subject will be authorized. IRB approval is confirmed by issuance of the IRB approval memo for the study. The requirement to obtain authorization may be waived or altered if certain criteria are met. Refer to “CHECKLIST: HIPAA Waiver of Authorization (HRP-441)” in the CATS IRB "Library" for a list of the criteria. Authorization may be waived for all, or only some uses of protected health information (PHI) for a particular study. A partial waiver permits the use of PHI for recruitment purposes only, to allow identification and, as appropriate, contact of potential participants to determine their interest in study participation. The requirement to obtain authorization for use of PHI may also be altered for a specific study. An alteration allows a change in certain authorization requirements, while still requiring authorization for the use of PHI. Examples include making an exception to the required language in an authorization or to the requirement to obtain a signed authorization. An alteration must meet the same criteria as a waiver or partial waiver. To request a waiver or alteration of authorization, you must complete the “HIPAA Research Authorization and/or Waiver or Alteration of Authorization” section in the protocol or protocol site addendum for the study.
Appendix A-11 of the IRB Investigator Manual includes a list of informational elements that are considered to be identifiers according to the HIPAA regulations. For additional information see Penn State policy RP07 HIPAA and Research at Penn State University.