Designation of Institutional Review Boards (IRBs) as Privacy Boards

Layout for printing

Policy Number:

UW-113

Old Policy Number:

4.1

Responsible Office:

Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards. 

Definitions:

Institutional review board (IRB)

A committee established under the Common Rule (45 C.F.R. § 46) and applicable FDA regulations (21 C.F.R. § 56) to provide ethical and regulatory oversight of research that involves human subjects.

Privacy board

A review body that may be established to act upon requests for a waiver or an alteration of the authorization requirement under the Privacy Rule for uses and disclosures of protected health information (PHI) for a particular research study.

Protected health information (PHI)

Health information or health care payment information, including demographic information collected from an individual, which identifies the individual or can be used to identify the individual. Protected health information does not include student records held by educational institutions or employment records held by employers.

Reviewing IRB

The IRB that serves as the IRB of record for institutions or personnel not affiliated with an organization with an IRB. Also referred to as IRB of record.

UW–Madison health care component (UW HCC)

Those units of UW–Madison that have been designated by the university as part of its health care component under HIPAA. See UW-100 Designation of UW–Madison Health Care Component.

Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

Under the HIPAA Privacy Rule, a covered entity may establish a privacy board to review requests for waivers or alterations of authorizations for uses and disclosures of protected health information in research. This policy establishes the authority of a UW–Madison institutional review board (IRB) to act as a privacy board for certain human subjects research as described more fully below.

Policy Detail

1. The UW–Madison IRBs are responsible for developing and maintaining processes relevant to when they act as a privacy board, including requirements for submission and review of studies that require review and approval of waivers and/or alterations of authorization to use and/or disclose protected health information.
2. When acting as privacy boards, the IRBs consult with the UW–Madison privacy officer as needed to complete their reviews or ensure compliance with the HIPAA Privacy Rule.
3. The privacy boards may review and approve requests for waivers or alterations of authorization under expedited procedures, as defined and permitted under the HIPAA Privacy Rule, or at a convened board meeting.
   1. An expedited review procedure can be used by the privacy board if the research involves no more than minimal risk to the privacy of individuals who are the subject of the protected health information for which the use or disclosure is being sought.
   2. The review and approval may be carried out by the privacy board chair or by one or more privacy board members designated by the chair.
   3. A member with a conflict of interest may not participate in an expedited review.
4. Waivers or alterations may be granted for all components or some components of a research study in whole or in part.
   1. A waiver in whole occurs when a privacy board determines that no authorization will be required to use or disclose protected health information for a particular research project.
   2. A partial waiver of authorization occurs when a privacy board determines that authorization may be waived for some participants or some component(s) of the study.
   3. An alteration of authorization occurs when a privacy board permits the removal of some, but not all, required elements of authorization (e.g., signature).
5. To grant a waiver of authorization (in whole or partial) or altered authorization, a privacy board must find and document that the following criteria have been met:
   1. The use or disclosure of protected health information involves no more than minimal risk to the privacy of individuals based on at least the presence of:
      1. An adequate plan to protect identifiers from improper use and disclosure;
      2. An adequate plan to destroy those identifiers at the earliest opportunity, consistent with the research, absent a health or research justification for retaining the identifiers or if retention is otherwise required by law; and
      3. Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity except:
         1. As required by law;
         2. For authorized oversight of the research study; or
         3. For other research for which the use or disclosure of the protected health information is permitted by the Privacy Rule.
   2. The research could not practicably be conducted without the requested waiver or alteration.
   3. The research could not practicably be conducted without access to and use of the protected health information.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Related UW–Madison Documents, Web Pages, or Other Resources:

IRB Members’ Conflicts of Interest

External References:

21 C.F.R. § 56

45 C.F.R. § 164.512

45 C.F.R. § 46

 

Policy Administration

Approval Authority:

Vice Chancellor for Legal Affairs

Policy Manager:

HIPAA Privacy Officer

Contact:

HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077

Effective Date:

08-16-2018

Revised Dates:

08-06-2018: Effective date of the revised policy: 08-06-2018.
03-26-2020: Effective date of the revised policy: 03-26-2020.

 

Retrieved:

01-22-2025 21:32:20