Frequently Asked Questions: Waiver of Authorizations and Altered Authorizations

FOR STUDIES APPROVED PRIOR TO APRIL 14, 2003

FOR STUDIES APPROVED AFTER APRIL 14, 2003

What is the difference between an authorization and informed consent?

Authorizations and informed consent differ in three primary ways:

  1. Authorizations are solely used to obtain permission from subjects to use or disclose their PHI for a particular research study. They describe the type of PHI that will be used, how it will be used, and the length of time it will be used. In contrast, the consent form is a comprehensive document that describes, among other factors, the purpose, procedures, duration, risks, and benefits of participating in a particular research study.

  2. The regulations governing the content of authorization forms are not the same as the regulations governing informed consent. Authorization forms must contain elements required by the Privacy Rule while the elements of informed consent documents are detailed in the Common Rule (45 CFR 46) and the FDA regulations.

  3. The required elements of an authorization form differ from the required elements of consent.

If I request a waiver of authorization do I also need to request a waiver of informed consent?

Although IRBs generally may grant waivers of authorization for protocols where they also waive informed consent requirements, requests for each type of waiver need to be made separately because different regulations apply to each waiver. The waiver of informed consent can be requested in an initial review application to the IRB. However, the request for a waiver of authorization requires the submission of the Application for Waiver of Authorization or Altered Authorization.

What is the difference between a waiver of authorization and an altered authorization?

A waiver of authorization refers to an IRB allowing the investigator to forgo obtaining permission from subjects to use their PHI for research purposes. In contrast, an altered authorization means that subjects have been asked to allow use of their PHI for research, but one or more of the core elements of the authorization have been altered (e.g., signature).

What is the difference between a full authorization and an altered authorization?

If a full authorization is required, the researcher must obtain from subjects a signed and dated form that contains all of the core elements required by the Privacy Rule to be present in an authorization. In the case of an altered authorization, the IRB has allowed the investigator to use an authorization form or process that is missing one or more of the required elements.

Can an IRB ask for changes to my application for waiver of authorization or altered authorization?

Yes. If an IRB finds the information regarding the waiver or alteration inadequate, it may ask for clarifications or modifications. Also, IRBs may not approve requests that do not meet the criteria for waiver or altered authorization. For example, applications that would not usually fulfill the waiver criteria are research that 1) involves the collection of sensitive PHI (unless adequate precautions are in place to protect the identifiers); 2) involves plans to re-contact the person whose PHI would be used for research purposes; or 3) involves the disclosure of PHI outside the University of Wisconsin Health Care Component (HCC) and outside the Affiliated Covered Entity (ACE).

FOR STUDIES APPROVED PRIOR TO APRIL 14, 2003

  • The IRB exempted my protocol because I use existing, unidentifiable data (or specimens), but I will continue to use the data (or collect specimens) after April 14, 2003. Do I need to request a waiver of authorization from the IRB to continue my research?

    Protocols that have been exempted by the IRB prior to April 14, 2003 will NOT be required to come back to the IRB to request a waiver of subject authorization.

  • The IRB granted a waiver of informed consent for my retrospective medical record review protocol but did not exempt my protocol. I will continue to use PHI from the medical records of research subjects after April 14, 2003. Do I need to request a waiver of authorization from the IRB to continue my research?

    No. These studies are grandfathered under the Privacy Rule.

  • I have IRB approval for my protocol and I am obtaining informed consent from subjects. I will continue to enroll subjects in my study after April 14, 2003. In addition, I am currently using PHI pursuant to an IRB-approved recruitment plan to determine which additional prospective subjects may be eligible for recruitment prior to obtaining informed consent. How should I proceed?

    Adapt the Research Authorization form template that has been developed for this campus to be specific to your research protocol(s) and begin obtaining subjects’ permission to use and disclose their PHI. In addition, submit a copy of the authorization form you use to the IRB at the time of continuing review. Use of PHI for determining eligibility for studies approved prior to 4/14/03 is permitted by the Preparatory to Research Certification, provided you have reviewed and signed that form and filed it with the UW Privacy Officer and with your department/center prior to the use of PHI for this purpose. For assistance in completing the Research Authorization form, please refer to the Instructions for Research Authorization.

  • I have IRB approval for my protocol and I am obtaining informed consent from subjects. I will continue to enroll subjects in my study after April 14, 2003. I am not currently using PHI for recruitment purposes prior to obtaining informed consent. How should I proceed?

    Adapt the Research Authorization form template that has been developed for this campus to be specific to your research protocol(s) and begin obtaining subjects’ permission to use and disclose their PHI. In addition, submit a copy of the authorization form you use to the IRB at the time of continuing review. For assistance in completing the Research Authorization form, please refer to the Instructions for Research Authorization.

FOR STUDIES APPROVED AFTER APRIL 14, 2003

  • I plan to submit an application for exemption under the Common Rule to the IRB and my research will involve the use of PHI; I think it will be impracticable to obtain a Privacy Rule authorization from subjects. If my protocol is exempt, does the HIPAA Privacy Rule still apply?

    If you are using or disclosing PHI for research purposes, even if the research is exempt under the Common Rule, the HIPAA Privacy Rule still applies. Submit the application for exemption under the Common Rule and an Application for Waiver of Authorization or Altered Authorization in order to meet Privacy Rule requirements.

  • The IRB will consider my protocol after April 14, 2003. I will need to use PHI to perform the protocol and wish to request a waiver of informed consent and a waiver of authorization. How should I proceed?

    Submit an initial review application to the IRB that contains your request and justification for a waiver of informed consent in the study description. In addition, include with the initial review application an Application for Waiver of Authorization or Altered Authorization.

  • The IRB will consider or exempt my protocol after April 14, 2003. I wish to use PHI from patients’ medical records to determine whether certain patients are eligible for my study. Do I need to request a waiver of authorization for this research activity?

    No. Determining a potential individual subject’s eligibility for a particular protocol is considered a preparatory to research activity. However, prior to such use of PHI, a Certification of Compliance with HIPAA Privacy Rule Requirements for Activities Preparatory to Research will need to be filed with the UW Privacy Officer and with your department/center for each person who will use PHI to determine potential subject eligibility.


Return to HIPAA Research Guide main page

Questions or comments? Contact us.
Last updated: August 29, 2003