As the Privacy Board, the IU IRBs may consider requests to alter the required elements of HIPAA authorization. Most often, researchers use this mechanism to obtain authorization without obtaining a physical signature or date, especially when subjects are enrolled via phone or web. 

In order to approve the alteration, the Privacy Board must find that the following criteria are met. These are the same criteria required for a full waiver of authorization; however, the study team’s response should indicate the scope of the waiver (e.g., requesting a waiver of the signature and date requirements only).

1. The use or disclosure of the PHI involves no more than minimal risk to the privacy of individuals based on, at least, the presence of the following elements:
   1. An adequate plan to protect health information identifiers from improper use and disclosure.
   2. An adequate plan to destroy identifiers at the earliest opportunity consistent with conduct of the research (absent a health or research justification for retaining them or a legal requirement to do so).
   3. Adequate written assurances that the PHI will not be reused or disclosed to (shared with) any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of the PHI would be permitted under the Privacy Rule.
2. The research could not practicably be conducted without the waiver or alteration.
3. The research could not practicably be conducted without access to and use of the PHI.

If the alteration is approved, all other required elements of HIPAA authorization must be presented to the subject verbally, and the subject should agree to the authorization verbally, but a physical signature and date will not be required.

PHI must be appropriately protected during all research activities, including:

• Collection - Acquire data from clinical or field data collection processes, or from existing research data sources such as health record databases.
• Transmission - Move data from one place to another.
• Storage - Keep data on a system for a shorter (90 days) or longer period of time for analysis.
• Computation - Perform analysis on data with various software packages
• Archival - Store data and results after the study ends for policy compliance and research reproducibility.

For example, for a clinical study, you might collect and store data in OnCore, collect and store data via data collection forms and a patient registry in REDCap, compute data using statistical software on a HIPAA Compute Enclave to perform analysis, transmit intermediate results with colleagues using a Microsoft or Google at IU Secure Storage, compute by making data analysis charts with Tableau, and archive the input data and results on the Scholarly Data Archive (SDA) to ensure research reproducibility. 

The IU IRB must ensure protocols include adequate mechanisms for ensuring confidentiality of research data. IU and its affiliates have agreed that the following systems provide adequate provisions to protect confidentiality of research data. If research personnel will use only these systems to collect, transmit, store, compute, and archive research data, the IRB may find that adequate provisions exist to maintain confidentiality of data without additional information. 

For more information about these services, contact:

• OCR: IU Office of Clinical Research oncore@iupui.edu
• CAITS: Clinical Affairs IT Services caits@iu.edu
• RT: UITS Research Technologies rt4iusm@iu.edu
• UITS: University Information Technology Services ithelpu@iu.edu
• SecureMyResearch: a single place you can go for help with cybersecurity and/or compliance issues securemyresearch@iu.edu

If PHI is lost, stolen, or misdirected, institutional reporting requirements may apply. IU research personnel should review the IU Policy on Information and Information System Incident Reporting, Management, and Breach Notification. All other research personnel should refer to their own institutional policies or consult with their institutional privacy officer.

All researchers (Researcher) that conduct research involving protected health information (PHI) of Indiana University Health Affiliated Covered Entities (IU Health) pursuant to a signed patient Authorization or a Waiver of Authorization approved by a Privacy Board or Institutional Review Board acting as a Privacy Board must comply with the privacy and security requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and agree to the following terms of use:

• Researcher will use the PHI solely for the purpose of research associated with the study in accordance with the Waiver of Authorization and/or signed Authorization and for no other purposes.
• Researcher shall comply with HIPAA and all applicable laws governing the privacy and security of PHI, including Indiana University and IU Health applicable policies and procedures (posted on IU website). Researcher shall use appropriate safeguards to prevent unauthorized access, use, or disclosure of the PHI; including, but not limited to, encrypting the PHI when in storage, in transit, and at rest in accordance with HIPAA; ensure the PHI is stored behind a firewall and commensurate network security protection, including intrusion detection and prevention systems; and ensure the PHI is not downloaded to or stored on laptops, tablets, cell phones, desktops, or other end user devices. The preferred storage location of PHI used for research purposes is in the Indiana University REDCap database.
• Unless specifically permitted by the Waiver of Authorization and/or signed Authorization, Researcher shall not contact the individuals whose information is contained within the PHI (except for the provision of routine patient care if the individual is their patient).
• In any publication about the research study, IU Health will be acknowledged for its participation. Other than acknowledgment, IU Health will not be specifically mentioned in the publication without the written permission of IU Health. IU Health will not be compared in any identifiable way to other participating health care providers or institutions. IU Health agrees that de-identified data (PHI de-identified in accordance with HIPAA, 45 C.F.R. §164.514, along with removal of any characteristic that could be used to identify the patient) may be used by Researcher in publications regarding the study; otherwise, Researcher shall obtain the patient’s signed consent for publication.
• In addition to notifying the IRB in accordance with HRPP Policy, Researcher shall promptly notify Indiana University (it-incident@iu.edu) and IU Health (hipaa@iuhealth.org) within two (2) business days of any use, disclosure, or unauthorized access of any PHI not provided for by this Terms of Use of which Researcher becomes aware, including the presence of PHI not associated with the research study in the data provided.
• Researcher shall ensure that authorized persons to whom Researcher provides the PHI in furtherance of research study purposes (e.g. principal investigator, research team, data managers, biostatisticians and/or other individuals who will assist in analyzing the data) agree to the same restrictions, terms, and conditions contained herein.
• At the end of research study record retention requirements, Researcher agrees: (i) to return all PHI provided to IU Health in a secure and encrypted manner, or (ii) to destroy all PHI provided in accordance with HIPAA. If requested, Researcher shall certify its satisfaction of the forgoing.
• Without a signed Authorization or Waiver of Authorization, Researcher shall not directly access IU Health’s electronic medical record and shall use the services of Regenstrief or IU Health Clinical Research (ClinicalResearchSystems@iuhealth.org) to obtain PHI for research purposes, which will be subject to the terms of a separate Data Use Agreement involving a limited data set or data provided in a de-identified manner in accordance with HIPAA; provided, however, PHI may be accessed on-site at IU Health by an IU Health employee/workforce member if preparatory to research (e.g., to aid in study recruitment and identification of prospective research participants to seek their Authorization to use PHI) without a signed Authorization or a Waiver of Authorization but the PHI may not be removed from IU Health. For purposes of HIPAA, an individual dually employed by Indiana University and IU Health is considered a member of the IU Health workforce, as are IU employees working under direct control of dually employed individuals.