HIPAA

Waiver of Authorization

As a starting point, HIPAA requires a potential research subject to sign a HIPAA authorization in order to use their protected health information in a research study.  In circumstances where obtaining individual authorization is not practicable, researchers may seek a full or partial waiver of the authorization requirement from an IRB.  Circumstances where seeking such a waiver is appropriate include:

HIPAA permits a research to request an 'alteration or waiver, in full or in part' of the authorization requirement.  UB has developed two forms to request such a waiver under specific conditions.  These forms should be used when requesting an alteration or waiver from the UB IRB:

IMPORTANT: The listing of information to be received in section (1) of this form needs to be exhaustive and thorough.  A covered entity must be able to rely on this form and associated IRB waiver as stand alone documents identifying what information the covered entity will be providing to the investigator.  Generalizations such as 'data required for this study' are not sufficient.  Even if the waiver is approved, the covered entity will look at this section, concluded it is not specific enough, and not provide you with any information.  A covered entity must be able to show that the information listed on the waiver was consistent with what it released in a court of law.

Special types of Health Information

New York State Law sets additional requirements on the disclosure of certain types of information by health care workers, including but not limited to: Cancer Information, Communicable Diseases within New York City , HIV/AIDS, Tuberculosis, Sexual Abuse, Drug Abuse, Births and Deaths, Early Intervention Services, Genetic Information, Alcohol and Substance Abuse, and Mental Health.  In situations where research involves such information, State Law requirements, in addition to HIPAA requirements need to be considered.  A HIPAA compliant waiver of authorization does not remove the need to understand and comply with any additional requirements governing disclosures associated with these types of information.

Request for Waiver of Individual Authorization (full waiver)

Request for Limited Waiver of the Authorization for Use of Individually Identifiable Health Information for Study Recruitment (limited waiver)

This material is designed for internal University at Buffalo use only and is copyrighted.  Information and documents available on this site may be freely copied and used with appropriate attribution to the University at Buffalo.  None of the information on these pages should be construed as legal advice or expert opinion with respect to how any particular function or entity engages in work to come into compliance with HIPAA.
Last updated: July 28, 2009.  Privacy Policy