The IRB for Health Sciences Research (IRB-HSR) serves as both the HIPAA Privacy Board and the IRB at UVA.
It is critical to keep in mind that even though some activities might be allowed without a HIPAA Privacy Board approval, they may not be allowed without an IRB approval under DHHS regulations.
Researchers will NOT View or Record HIPAA Identifiers
If the researcher wishes to review data/ health information to design a research study or to assess the feasibility of conducting a study, IRB approval is NOT required if no HIPAA identifiers will be viewed. This is most commonly done by asking personnel through iTHRIV to supply the researcher with de-identified data.
Researchers will View or Record HIPAA Identifiers
If you need to access information to design a research study or to assess the feasibility of conducting a study and you will also need to view or record HIPAA identifiers, IRB approval IS required. Submit a new protocol application to the IRB using the IRB-HSR program called Protocol Builder. The IRB will provide you with an Approval/Assurance Form which may be submitted to Health Information Services to obtain the charts you need.
IMPORTANT
- Under HIPAA regulations the researcher is allowed to collect such things as the name and contact information of the potential subjects.
- HOWEVER, under DHHS regulations, this activity meets the definition of human subject research.
- THEREFORE, the researcher must obtain IRB approval if they wish to view any data with HIPAA identifiers and/or contact the subjects.
For additional information see DHHS Guidance Document: Clinical Research and the HIPAA Privacy Rule