• E-mail
• Print
• RSS

Separate waivers for research companies

HIPAA Weekly Advisor, April 27, 2004

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: A few of our providers in a specialty clinic have created a clinical research company. Will they need their patients in the specialty clinic setting to sign a special form to provide separate consent to allow PHI to be shared between the two separate companies?

A: Under HIPAA, for any healthcare provider to use or disclose PHI  for research, one of the following is required:

• A waiver of authorization issued by an institutional review board (IRB) or compliant privacy board
• Specific (and HIPAA-compliant) patient authorization from each patient involved in the research

Both organizations must be covered by either a waiver or specific patient authorizations. If a waiver of authorization is being issued, then such waiver could be worded to include both the clinical research company and the private practice.
 
If patient authorizations are used, HIPAA allows the use of "compound authorizations." For instance, patients entering the research study could sign a carefully worded authorization that allows the clinical research company to use PHI for the research, and also authorizes the private practice to disclose specific information to the clinical research company for research purposes. A copy of this authorization must be on file in both organizations.
 
This question was answered by Marion Neal, HIPAASimple.com.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive