- Last updated:
Health Insurance Portability and Accountability Act
- Guidance Contact:
IU Human Research Protection Program (HRPP)
IU Human Research Protection Program (HRPP)
Research subject to the Health Insurance Portability and Accountability Act (HIPAA) must comply with the IU HRPP Policy on Use of PHI in Research. Research is subject to HIPAA when research personnel:
Covered entities include IU HIPAA-affected areas (learn more at IU HIPAA Privacy and Security Compliance), IU Health, Eskenazi, and Roudebush VAMC.
As the Privacy Board, the IU IRBs may consider requests to alter the required elements of HIPAA authorization. Most often, researchers use this mechanism to obtain authorization without obtaining a physical signature or date, especially when subjects are enrolled via phone or web.
In order to approve the alteration, the Privacy Board must find that the following criteria are met. These are the same criteria required for a full waiver of authorization; however, the study team’s response should indicate the scope of the waiver (e.g., requesting a waiver of the signature and date requirements only).
If the alteration is approved, all other required elements of HIPAA authorization must be presented to the subject verbally, and the subject should agree to the authorization verbally, but a physical signature and date will not be required.
If research personnel plan to enroll individuals who cannot read and/or speak English, the study team should have the HIPAA authorization (or if using a combined Informed Consent Statement and HIPAA authorization) translated into the appropriate languages. Spanish versions of IU HIPAA authorization templates are available at Forms & Templates.
If research personnel unexpectedly encounter a potential participant who cannot read and/or speak English, a translator may help obtain HIPAA authorization. The translator should verbally translate the authorization to the potential participant, then the participant should sign the English version of the form and be provided a copy. Use of a translator to obtain HIPAA authorization should be documented in the research record. If using a combined Informed Consent Statement and HIPAA authorization, refer to the IU HRPP Policy on Informed Consent to ensure proper consent and documentation processes.
PHI must be appropriately protected during all research activities, including:
For example, for a clinical study, you might collect and store data in OnCore, collect and store data via data collection forms and a patient registry in REDCap, compute data using statistical software on a HIPAA Compute Enclave to perform analysis, transmit intermediate results with colleagues using a Microsoft or Google at IU Secure Storage, compute by making data analysis charts with Tableau, and archive the input data and results on the Scholarly Data Archive (SDA) to ensure research reproducibility.
The IU IRB must ensure protocols include adequate mechanisms for ensuring confidentiality of research data. IU and its affiliates have agreed that the following systems provide adequate provisions to protect confidentiality of research data. If research personnel will use only these systems to collect, transmit, store, compute, and archive research data, the IRB may find that adequate provisions exist to maintain confidentiality of data without additional information.
|OnCore||Record, manage, and report on operational data for clinical research||OCR|
|REDCap||Build online workflows to capture research data||RT|
|Microsoft or Google at IU Secure Storage||Store and share data with “unlimited” capacity||CAITS|
|SCP/SFTP (e.g. WinSCP)||Securely transport data to systems||UITS|
|SlashTMP Critical||Send ePHI to someone in a secure way||UITS|
|Other methods||Systems like OnCore, REDCap, and Box Health Data Account that have built in mechanisms for importing and exporting data||--|
|HIPAA Compute Enclave (Linux)||High security, Linux-based desktop environment with software and tools for data analysis, including temporary and long term data storage||RT|
|High Performance Clusters, Storage (Linux)||Cluster computing environments with desktop or command-line access for high volume or computationally expensive analysis. Includes space for temporary and longer-term storage of data, and MySQL databases.||RT|
|Tableau||Create and publish visual analytics and research dashboards with many connectors for importing data.||UITS|
|Scholarly Data Archive (SDA)||Tape-based storage of research data after the study concludes, or even during the study for certain research data workflows. Supports large volumes and long retention.||RT|
For more information about these services, contact:
If PHI is lost, stolen, or misdirected, institutional reporting requirements may apply. IU research personnel should review the IU Policy on Information and Information System Incident Reporting, Management, and Breach Notification. All other research personnel should refer to their own institutional policies or consult with their institutional privacy officer.
Accessing identifiable PHI/biospecimens (accessed in EMR directly or via request to Regenstrief or IU Health Clinical Research Systems)
Accessing a limited data set (provided by Regenstrief or IU Health Clinical Research Systems)
Receipt of data by IU-affiliated personnel is covered by a master agreement with Regenstrief or IU Health Clinical Research Systems.
Accessing deidentified data (provided by Regenstrief or IU Health Clinical Research Systems)
For purposes of this infographic, PHI, data, and biospecimens follow the same process.
Research purposes include: accessing PHI for the investigator’s own research; accessing PHI in order to provide data to an external party for research purposes; and accessing previously-collected research data for a new research purpose.
The following activities are NOT research and do not require this process: quality improvement for IU Health’s own internal operation monitoring and program improvement; activities preparatory to research; research utilizing only decedent PHI.
Engaged in research includes: interacting/intervening with human subjects or using their identifiable data for research purposes. Investigators who simply access and release data to another institution and are not themselves conducting the research are likely not engaged in research. For more information, contact the HRPP at firstname.lastname@example.org or see OHRP guidance on Engagement of Institutions in Human Subjects Research.