IRB Documentation

Under the Privacy Rule (under CFR 45 164.512), CMS is permitted to disclose protected health information for research either with individual authorization, or without individual authorization. To use or disclose protected health information without individual authorization, CMS must obtain documentation that an IRB or a CMS Privacy Board has approved a waiver of research participants' authorization for use/disclosure of information about them for research purposes.

Documentation of Waiver Approval

(45 CFR § 164.512(i)(2))For a data use or disclosure to be permitted by CMS based on documentation of approval of an alteration or waiver, under the HIPAA privacy rule, the documentation provided to CMS must include:

Identification of the IRB and the date on which the alteration or waiver of authorization was approved;
A statement that the IRB has determined that the alteration or waiver of authorization, in whole or in part, satisfies the three criteria in the Rule;
A brief description of the protected health information for which use or access has been determined to be necessary by the IRB;
A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures; and
The signature of the chair or other member, as designated by the chair, of the IRB, as applicable.

This documentation can be a copy of your IRB waiver documentation if it contains all items listed above. If what you receive from your IRB does not include the above items, you will need to include additional documentation which includes the above requested items. This additional documentation can be a photocopy of information submitted to your IRB or a written summary clearly referencing the study, Principal Investigator, IRB the submission was directed to and date of the IRB submission.

Waiver Criteria

(45 CFR § 164.512(1)(i)2(ii)) Waiver criteria. A statement that the IRB or privacy board has determined that the alteration or waiver, in whole or in part, of authorization satisfies the following criteria:

(A) The use or disclosure of protected health information involves no more than a
minimal risk to the privacy of individuals, based on, at least, the presence of the
following elements;

An adequate plan to protect the identifiers from improper use and disclosure;
An adequate plan to destroy then identifiers at the earliest opportunityconsistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
Adequate written assurances that the protected health information will not be
reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or
disclosure of protected health information would be permitted by this subpart;

(B) The research could not practicably be conducted without the waiver or alteration; and

Visit the Office of Civil Rights (OCR) website for additional guidance on the Privacy Rule as it relates to research.

Last Modified March 17, 2009