Contact Information

Organization

THE COMMITTEE ON HUMAN RESEARCH

HIPAA CONSENT FORM GUIDANCE (Revised June 2004)

• HIPAA Requirements for CHR Submission
• Methods of Compliance
  • Separate Forms for Consent and Authorization
  • Combined Form with Authorization Embedded in Consent
  • Use of Non-UCSF Authorization
• Required Elements of an Authorization
• Revising an Authorization

HIPAA REQUIREMENTS FOR CHR SUBMISSION:

The CHR is required to review all research studies to make sure they meet the federal Health Information Portability and Accountability Act (HIPAA) and the state privacy law requirements

Current versions of the CHR applications for expedited and full committee now incorporate sections for information required to evaluate HIPAA and privacy requirements. However, the HIPAA Supplement may still be required for studies as described below:

•	For new studies: As the study will use the current versions of the CHR Expedited and the Full Committee applications, do not submit the HIPAA Supplement.
•	For renewal of continuing studies:
	•	If the study was approved with the older (pre-2004) version of the CHR application, continue to submit the HIPAA Supplement at each renewal period.
	•	If the study was approved with the 2004 or newer version of the CHR application, do not submit a HIPAA Supplement at each renewal period.
	For modifications:
	•	If the study was approved with the older (pre-2004) version of the CHR application, only submit the HIPAA Supplement with the modification if the modification necessitates changes to the form. Please highlight the changes on the revised HIPPA Supplement form. An updated UC Permission to Use Protected Health Information for Research form should be also submitted if changes have been made.
		If the study was approved with the 2004 or newer version of the CHR application and the modification will affect the approval to use PHI, submit a separate HIPAA Supplement form with the revised privacy information with the request for modification. An updated UC Permission to Use Protected Health Information for Research form should be also submitted if changes have been made.
	•	If the study was approved with the 2004 version of the CHR application and the modification will not affect the approval to use PHI, do not submit any additional HIPAA forms with the request for modification.
		Top of page

METHODS OF COMPLIANCE

Separate forms for consent and authorization
			REQUIRED for studies involving treatment or intervention
			RECOMMENDED for all other studies
	The consent form should be written according to current CHR standards, as follows:
	•	The Procedures section should say that the medical records willbe reviewed, for example, “Your medical records will be reviewed as part of this study.”
	•	Confidentiality will be addressed as per standard CHR guidance. That is, you must describe how you protect the participant’s confidentiality..
	•	The Consent section should say that subjects will be asked to sign a separate form to authorize access to their health information

In addition, researchers should prepare a customized version of the subject’s authorization, the UC Permission to Use Protected Health Information for Research, adding study-specific information in all appropriate blanks. This form cannot be changed except to fill in the blanks. Be sure to fill in UCSF or name of the health care provider as the entity who release the medical records (Section B).

Both the consent form and the individual subject’s authorization form must be submitted for CHR review.

Combined Form with Authorization Embedded in Consent:

REQUIRED ELEMENTS OF AN AUTHORIZATION:

To comply with HIPAA requirements, researchers combining HIPAA authorization and research consent into a single document must be sure the following elements are included; these elements are already covered when the standard subject’s authorization, UC Permission to Use Protected Health Information for Research, is filled out correctly:

	1.	A specific and meaningful description of the PHI to be used or disclosed.
	2.	The names or class of persons (e.g. “the research team”) who will use or disclose the PHI.
	3.	The names or other specific identification of anyone else to whom the PHI may be disclosed.
	4.	A description of the purposes of the use or disclosure.
	5.	A statement that there is a potential risk that PHI will be re-disclosed by one of the parties to which it is initially disclosed. This may be a general statement that although normal standards for protecting confidentiality will still apply, HIPAA may no longer protect health information after the initial disclosure for research purposes.
	6.	A statement of when the authorization will expire. This may be a specific date; “end of the study” is also acceptable.
	7.	A statement of the subject’s right to revoke the authorization, a description of how to do so, and a description of any exceptions to the right to revoke authorization.
	8.	A statement of the consequences of not signing the authorization, including whether or not a patient’s treatment (including research-related treatment), enrollment in a study, or eligibility for benefits will be affected by not signing the authorization.
	9.	A signature and date line for the subject separate from the consent signature. The signature line for authorization must be separate from and in addition to the signature for research consent. If a legally authorized representative signs the authorization, a description of the representative’s authority must be included. (Note: CHR must specifically approve the use of surrogates for consent and authorization. See Surrogate Consent.)

REVISING AN AUTHORIZATION FORM

The (UC Permission to Use Protected Health Information for Research): has received extensive review by the UC campus IRB offices, UC legal counsel, the UC Office of the President, and several major research sponsors to make sure it is in compliance with Federal and State regulations governing the privacy of medical information. Therefore: