Action When a Required HIPAA Authorization in Human Subjects Research is not Obtained

The University needs to have a method for handling Protected Health Information (PHI) used or disclosed for University research purposes when a valid HIPAA authorization has not been obtained from the research subject(s) as required by 45 C.F.R. § 164.508.

When it is discovered that a required HIPAA authorization is either missing, incomplete, or invalid the researcher shall promptly submit a deviation to the Institutional Review Board/Privacy Board (Board). The researcher shall promptly notify the Covered Entity from which the PHI was obtained. 

Incomplete authorizations are those missing any of the following:  (i) a description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion; (ii) the name or other specific identification of the person(s) authorized to make the requested use or disclosure; (iii) the name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure; (iv) a description of each purpose of the requested use or disclosure; (v) an expiration date or an expiration event. The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure for research, including for the creation and maintenance of a research database or research repository; (vi) signature of the individual and date. If the authorization is signed by a personal representative of the individual, or the guardian of a minor, a description of such representative's authority to act for the individual must also be provided; (vii) a statement that the individual has a right to revoke the authorization and a description of how the individual may revoke the authorization; (viii) a statement notifying the individual of the consequences of a refusal to sign the authorization; and (ix) the potential for the information disclosed to be subject to redisclosure by the recipient and no longer be protected. 

An authorization is invalid if it has been revoked by the individual or his/her authorized representative or if any material information in the authorization is known by the covered entity to be false. 

The deviation submission shall include a Corrective Action Plan that includes steps to be taken to prevent future occurrences and sanctions against the individual responsible. The submission shall describe either the plan to obtain a valid authorization from the subject (s) or to sequester the data.

The Board, or a Representative from the Human Subjects Protection Program Office (HSPPO), will inform the Privacy Office of all deviations which involve a missing, incomplete, or invalid HIPAA authorization.  The Privacy Office is responsible for investigating all deviations that involve a missing, incomplete, or invalid HIPAA authorization and determining whether research data should be sequestered or destroyed.  The Privacy Office is also responsible for determining whether a breach of PHI has occurred, and, if so, the actions required as a result of the breach.  No further PHI for the subject(s) shall be obtained or used by the researcher until the Privacy Officer has advised the Board that data collection can resume or continue, unless ceasing the use of a subject’s PHI would create a health risk to the subject. 

If it is determined that the data cannot be maintained for the study, the researcher will not be allowed to use or disclose any PHI from or about the study subject(s). All such PHI shall be eliminated from the active research files and sequestered, as appropriate, and an attestation that the required actions have been completed shall be sent to the Board and the Privacy Office.

• Deviation submission:
  https://research.louisville.edu/research-compliance/human-research-irb/submitting-to-irb/report-study-event 
   
• University Health Care Component:
  https://louisville.edu/about/departments/privacy-office/privacy-office-services/hybrid-covered-entity-designation 

Covered Entity means:

1. A health plan.
2. A health care clearinghouse.
3. A health care provider who transmits any health information in electronic form in connection with a transaction covered by HIPAA.

Individually Identifiable Health Information -Information that is a subset of health information, including demographic information collected from an individual, and:

1. Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
2. Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
   1. That identifies the individual; or
   2. With respect to which there is a reasonable basis to believe that the information can be used to identify the individual.

Protected Health Information - Individually identifiable health information from or about an individual that is:

1. Held by a covered entity, or
2. Received by a UofL researcher who is part of the University’s health care component, regardless of source.

Upon receiving a deviation, the Board or representative of HSPPO will inform the Privacy Office of all deviations which involve a missing, incomplete, or invalid HIPAA authorization.  The Privacy Office is responsible for investigating all deviations that involve a missing, incomplete, or invalid HIPAA authorization and determining whether research data should be maintained, sequestered or destroyed.  The Privacy Office is also responsible for determining whether a breach of PHI has occurred, and, if so, the actions required as a result of the breach.  No further PHI for the subject(s) shall be obtained or used by the researcher until the Privacy Office has advised the Board that data collection can resume or continue , unless ceasing the use of a subject’s PHI would create a health risk to the subject.

The Privacy Office will inform the Board as to whether the authorization was missing, incomplete, or invalid.  The Privacy Office will advise the steps to either resolve the missing authorization or whether the research data must be sequestered or destroyed. 

Upon a determination that research data must be sequestered, the researcher must contact all third parties with whom he/she shared PHI. The researcher must use his/her best efforts to have the third party either return the PHI to the researcher for appropriate disposition or to obtain an assurance from the third party that the information has been destroyed, and send a copy of the current authorization, waiver, or sequestration plan.

Once completed, the researcher must send to the Board and the Privacy Office an attestation that all required actions have been completed. The researcher must maintain in the research records all communication with the Board, Privacy Office, and third parties regarding this issue, as well as any other relevant documentation.

The Privacy Officer will contact the Covered Entity from which the PHI originated to ensure that the Covered Entity is aware of the incident.