When May an Application for IRB Waiver of Authorization or Altered Authorization be Approved by an IRB under the HIPAA privacy rule?

Investigators must demonstrate in an application to an IRB that the use of the protected health information (PHI) for a research protocol qualifies for a waiver of authorization or an altered authorization. For a research protocol to qualify for any of these waivers, all of the following conditions must be met:

1. The risk to the subjects’ privacy is minimal. Minimal risk research for which an IRB can grant a waiver of informed consent under the Common Rule and research that is exempt under the Common Rule are two categories of research that commonly will qualify for a waiver of authorization. The criteria for finding minimal risk are as follows: (A) an adequate plan to protect the identifiers from improper use and disclosure; (B) an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and (C) adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by the Privacy Rule.

2. The research cannot practicably be conducted without use of the PHI. The HIPAA Privacy Rule requires researchers to use the minimum amount of PHI necessary to conduct the research and discourages “fishing expeditions” that involve use of a broad range of PHI without a specific hypothesis in mind. When making a request for a waiver of authorization or altered authorization, you must specify and provide justification for the PHI that will be used or disclosed and why that particular PHI is essential to the study. In situations where a waiver of authorization is requested, such as retrospective medical record research, you will need to give careful thought to what PHI is relevant to the hypothesis under study.

3. The research cannot be practicably conducted without the waiver or alteration. An IRB may consider the following criteria, usually in combination, in its determination of whether the research cannot be practicably conducted without the waiver or alteration:
   • Number of individuals whose PHI will be used or disclosed;
   • Difficulty in obtaining the authorization, including but not limited to cost and necessary resources;
   • Time involved in obtaining the authorization;
   • Time since last contact with the individuals whose PHI will be used or disclosed (i.e., if a long time has lapsed since last contact, the individual may be difficult to locate to request the authorization);
   • Whether a significant portion of the PHI would be obtained primarily from decedents;
   • Whether the research question requires the use of existing data (e.g., use of historical controls);
   • Whether obtaining an authorization for the use of PHI unnecessarily burdens or poses new risks to the individuals from whom the PHI was collected;
   • Whether informing practitioners or individuals from whom the PHI was collected could alter their behavior and thus bias the results of the study (Hawthorne effect).

The Application form for IRB Waiver of Authorization or Altered Authorization was constructed to address these requirements.