Office of Research Compliance
USF Health · Office of Research

Privacy in Research


IMPORTANT NOTICE: April 14, 2003 was the start date of HIPAA Privacy Rule regulations that impact clinical research. Under the HIPAA Privacy Rule, any research that involves protected health information, regardless of the source of funding, requires authorization by the individuals whose health data will be accessed or used, or the researcher must obtain a Waiver of Authorization.

 

Impact of HIPAA on Clinical Research

  1. STUDIES THAT ARE COMPLETED, NO LONGER GATHERING DATA, AND HAVE DATA RETAINED IN STORAGE. Studies completed prior to April 14, 2003, are grandfathered and do not require any action. The data may continue to be used in the future but only as stated in the Informed Consent. If a different study is designed that intends to use the same data it cannot be done without a new submission to the IRB, and must comply with all HIPAA rules.
  2. STUDIES THAT ARE IRB APPROVED, SOME RESEARCH SUBJECTS HAVE BEEN STUDIED, AND NEW SUBJECTS CONTINUE TO BE ENROLLED. The Protocol, if approved prior to April 14, 2003, is grandfathered and those research subjects already consented need no action. However, all research subjects enrolled from 4/14/03 forward must be provided with HIPAA privacy information and must sign a Research Authorization form, unless a waiver of authorization is obtained by the researcher from a duly constituted IRB/Privacy Board. The research subjects’ Protected Health Information and research data are covered by the HIPAA rules. The signed Research Subject Authorization form or approved waiver should be retained with the signed Informed Consent Document. Combined informed consent and authorizations are available for use in the USF Medical Clinics and at Moffitt Cancer Center.
  3. STUDIES THAT ARE GRANDFATHERED BUT ARE ALTERED AND NEW CONSENT DOCUMENTS ARE REQUIRED. Consent processes and documents used after the deadline are all subject to the new HIPAA regulations.
  4. NEW STUDIES. The HIPAA rules state that after the deadline, all HIPAA regulations are in force. This means that all research subjects enrolled from 4/14/03 forward must be provided with HIPAA privacy information and must sign a Research Authorization form, unless a waiver of authorization is obtained from a duly constituted IRB/Privacy Board. The research subjects’ Protected Health Information and research data are covered by the HIPAA rules. The signed Research Subject Authorization form or approved waiver should be retained with the signed Informed Consent Document. Combined informed consent and authorizations are available for use in the USF Medical Clinics and at Moffitt Cancer Center.
  5. REVIEWS PREPARATORY TO RESEARCH. If a researcher intends to access medical records or any other identifiable health information for the purpose of evaluating the possibility of formulating a hypothesis; evaluating the patient base; screening for study eligibility; or for a reason similar to this, the researcher may need to complete the ‘Certification for Use of Protected Health Information Preparatory to Research’. For details, please contact the Research Privacy Officer, Division of Research Integrity & Compliance.

 

 

University Resources

 

Federal Regulation

The Health Insurance Portability and Accountability Act (HIPAA): Privacy Rule

 

Other Resources

 

Contact

Vinita Witanachchi, J.D.
Research Privacy Officer/HIPAA Program Coordinator
USF Office of Research
Division of Research Integrity and Compliance
(813) 974-5478
vwitanachchi@research.usf.edu