The HIPAA Privacy Rule sets forth provisions related to the waiver or alteration of authorization in relation to clinical research studies for circumstances in which it would be impractical or impossible to obtain authorization from a potential participant in the study. In many cases, a waiver or alteration of HIPAA authorization is sought for secondary use research using medical records, where authorization is impossible to obtain because the data being reviewed relates to patients who would be difficult or impracticable to contact.

Under the HIPAA Privacy Rule, an institutional review board (IRB) or privacy board must approve a waiver or alteration of authorization. Specifically, the following must be documented:

• Identification of the IRB or privacy board and the date of approval of the alteration or waiver of authorization;

• A determination by the IRB or privacy board that the alteration or waiver of authorization, in whole or in part, satisfies the three criteria in the rule (outlined below);

  • A brief description of the protected health information (PHI) which the IRB or privacy board has approved use or access to through the waiver or alteration;

  • “A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures”; and

  • The signature of the chair or another member designated by the chair of the IRB or the privacy board.^[1]

As noted, three criteria must be fulfilled for the IRB or privacy board to approve the waiver or alteration of authorization:

1. The use or disclosure of PHI must involve no more than minimal risk to the privacy of individuals based on:

   • “An adequate plan to protect the identifiers from improper use and disclosure;

   • “An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and

   • “Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;

2. “The research could not practicably be conducted without the waiver or alteration; and

3. “The research could not practicably be conducted without access to and use of the protected health information.”^[2]

Documentation must reflect that all three criteria are fulfilled for a waiver or alteration of authorization to meet the regulatory requirements.