Because it may be necessary for a researcher to obtain access to and review PHI in order to prepare a research study, HIPAA rules allow such a review upon compliance with specified criteria. An application for review of PHI preparatory to research must be submitted to the IRB for review and approval.

An application for the use of PHI from decedents must be submitted to the IRB prior to engaging in the research. In order to gain access to the PHI, the principal investigator needs to demonstrate that the use or disclosure being sought is solely for research on the PHI of decedents, adequate documentation of the death of such individuals, and that the PHI for which use or disclosure is sought is necessary for the purposes of the proposed research. The IRB should be notified in CATS IRB.

A HIPAA Waiver of Authorization can be obtained from the IRB if access to patient data is needed for recruitment purposes. Describe the need in the “HIPAA Research Authorization and/or Waiver or Alteration of Authorization” section of the protocol template or the protocol site addendum. This section is reviewed by the IRB. If a full or partial waiver is granted, access to identifiable patient data to determine if a patient may be a potential research subject will be authorized. IRB approval is confirmed by issuance of the IRB approval memo for the study.

In general, before any patient information can be used for a research purpose, the patient must sign and date a study-specific consent form that includes the HIPAA authorization elements or a separate HIPAA authorization form which recites the patient’s privacy rights. This is true whether or not the patient is seen by the researcher/physician for medical care. Patient information cannot be used for research-related purposes without a signed patient authorization.

If a patient’s record is reviewed for a treatment purpose (e.g., to view lab results or consult with a referring provider) the research-related rules do not apply. However, once a patient’s medical information is viewed for a research-related activity (e.g., to screen for eligibility or review, to review a unique case for possible study, or to collect data) the research-related HIPAA rules apply. For example, if a provider is reviewing a patient’s lab report for regular care, this access would be for treatment purposes and the research-related rules would not apply.

When an established patient is being considered for participation in a research study by a clinician involved in the patient’s care, the HIPAA rules can be confusing. HIPAA applies when a provider is reviewing a patient’s medical record for both treatment and research purposes. In general, under the HIPAA privacy rules, a patient’s medical information may be accessed for a treatment, payment or operational purpose without obtaining prior written consent. Access to a patient’s medical record for any other purposes may require additional steps to be in compliance with privacy laws and rules.

Penn State has one approved FWA with the Department of Health & Human Services, which covers the University, including the College of Medicine and Penn State Health.

  • The Pennsylvania State University: FWA00004251

The expiration date for this assurance changes frequently. If you need the expiration date, please visit the national Office for Human Research Protections website, enter the FWA Number above, and click “Search.”

IRBs for all Campuses:

The Code of Federal Regulations is a compendium of the general and permanent rules and regulations published in the Federal Register by the federal executive departments and agencies. The CFR is divided into 50 titles that represent broad areas subject to Federal regulations. Title 45 CFR encompasses regulation of Public Welfare. Title 21 CFR is administered by the FDA and covers regulations of Food and Drugs. Title 45 CFR 46 (The Common Rule) is a core set of regulations defining protection of Human Subjects in clinical research.