Information about must i sign a consent for use and disclosure of health informaion
ÐÏࡱá>þÿ RTþÿÿÿQÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿì¥Á%` ð¿3AbjbjÙÙ -P÷³÷³%9 ÿÿÿÿÿÿ¤ttttttt8Ä Ð,û)2iT½¬iXz)))))))$-+h-Ú )t¤!G"i¤!¤! )tt?µ)B#B#B#¤!Rttz)B#¤!z)B#B#:þ(,tt>)ü PÄ=½á£Èö!ú) f)Ë)0û)4) o.ð"o.>)o.t>)(Á(éB#s<¯õÁÁÁ ) )ð"RÁÁÁû)¤!¤!¤!¤!ttttttÿÿÿÿ UR Guidance for HIPAA Authorization for Research Use and Disclosure Background The federal Health Insurance Portability and Accountability Act (HIPAA) Privacy regulations (as amended on 8/14/2002) require certain determinations, authorizations and notices. Some of these pertain to research. The Department of Health and Human Services will enforce the regulations on April 14, 2003. Applicability Research that uses protected health information (PHI), as defined in the HIPAA Privacy regulations (see below), must either have an authorization or meet one of the other permissible ways to access data (see also waiver guidance and URMC/SH HIPAA Research Policy 0P25). To help determine if your study is required to have an authorization, the following questions may be helpful. First, are you part of the Covered Entity? If the answer is no, you are probably not governed by HIPAA (an exception includes having a member of the research team who is an employee of the covered entity). If you are in the Covered Entity; 1) is consent of subjects required? (i.e., not waived or exempt); 2) is health-related information (physical and/or mental health) being collected (e.g., clinical trial), or accessed (e.g., medical records review and database search), or generated (e.g., health surveys/interviews and blood draws)? (see definitions below); 3) is the data identified or linked to identifiable persons? If the answer to all three questions is yes, then HIPAA applies and an authorization is required. In some cases, if the answer to #1 is no, but the other two are yes, then HIPAA may still apply. Please check with the RSRB Office if you have questions on HIPAA applicability. Definitions (45CFR160.103) Health information means any information, whether oral or recorded in any form or medium, that: (1) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and: (1) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) that identifies the individual; or (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. Protected health information means individually identifiable health information transmitted or maintained in any form or medium. Record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity. Regulatory Citations 45CFR164.508 Uses and Disclosures for which an authorization is required. 508(b)(4)(i) A covered health care provider may condition the provision of research-related treatment on provision of an authorization for the use or disclosure of protected health information for such research under this section 508(b)(5) Revocation of authorizations. An individual may revoke an authorization provided under this section at any time, provided that the revocation is in writing, except to the extent that: (i) The covered entity has taken action in reliance thereon. 508(c) Implementation specifications: Core elements and requirements. (1) Core elements. A valid authorization under this section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement end of the research study, none, or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representatives authority to act for the individual must also be provided. (2) Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individuals right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by § 164.520, a reference to the covered entitys notice. (ii) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating (B) The consequences to the individual of a refusal to sign the authorization when, in accordance with paragraph (b)(4) of this section, the covered entity can condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization. (iii) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart. (3) Plain language requirement. The authorization must be written in plain language. (4) Copy to the individual. If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the covered entity must provide the individual with a copy of the signed authorization. Per URMC/SH HIPAA Policy 0P25, the Covered Entity includes: The University of Rochesters healthcare components: Strong Memorial Hospital Eastman Dental Center School of Medicine and Dentistry School of Nursing University of Rochester Medical Faculty Group University Health Service Highland Hospital of Rochester The Meadows at Westfall, Inc. (Highlands at Brighton) Highlands Living Center, Inc. (including Meadowbrook) Highland Community Development Corporations healthcare component: Laurelwood at Highland Medical Administrative Associates, Inc. (Highland Apothecary) Visiting Nurse Service of Rochester and Monroe County, Inc. Community Care of Rochester Mount Hope Family Center Authorization Guidance In order to be in compliance by April 14, consent forms for some studies will need to be revised, per 45CFR164.508(c). This will be accomplished as they are presented for approval/re-approval, as amendments are submitted or as an amendment itself. For ongoing studies, until the next continuing review, an addendum to the consent will be acceptable as an alternative method to ensure compliance. Such an addendum will need to contain all the necessary information as below and be approved by the IRB. The template wording below has been developed for consent forms for research using protected health information (PHI), as defined in the HIPAA Privacy regulations. Note that bolded sections in the wording may be modified to fit study-specific criteria or removed if not applicable. The new HIPAA wording is intended to replace the section and wording now included in consent forms as Confidentiality of Records. Unless a study sponsor or study group has supplied a separate HIPAA Authorization form/format for the IRB to review, this new section must be in all consent forms that are used on or after April 14, 2003 for research using protected health information (PHI). Note that not all UR studies use PHI. Therefore, some studies will be able to use the current Confidentiality wording, but most URMC, SMH, HH, EDC, SMD and SON consent forms will require the combined wording below. (See covered entity list below.) The template wording is intended to ensure that all the requirements of the HIPAA Authorization regulations are met (see core elements above). Please note, however, that each study must contain wording specific to that study. There are places in the standard wording where study specific information must be put in the wording (see bolded comments). These include what you will use, how you will use it and who else may see it. It is particularly important that all persons and organizations that will/may receive information/data be listed because under the regulations if they are not included, that person or organization may not receive, create or use protected health information for research purposes. In addition to possibly not being able to use/share information, the regulations carry civil and criminal penalties for violations. Per HIPAA regulations, the signature block of the person obtaining consent will need to state that a copy of the signed consent form was provided to the subject (this is also required by the International Conference on Harmonization (ICH) guidelines for drug studies). Also, HIPAA requires that if the consent/authorization is signed by a representative of the subject, a description of that persons authority must be provided/verified (45CFR164.508(c)(1)(vi)). Thus, for those studies that are approved for representative signature, a line must be added to the consent form to document the relationship to the subject. For studies that are required to obtain an authorization under the HIPAA regulations, the following section would replace the current Confidentiality section in the consent form. For studies that do not require HIPAA authorization, the current Confidentiality section should continue to be used. Confidentiality of Records and HIPAA Authorization While we will make every effort to keep information we learn about you private, this cannot be guaranteed. Other people may need to see the information. While they normally protect the privacy of the information, they may not be required to do so by law. Results of the research may be presented at meetings or in publications, but your name will not be used. The federal Health Insurance Portability and Accountability Act (HIPAA) requires us to get your permission to use health information about you that we either create or use as part of the research. This permission is called an Authorization. We will use Note to Investigators: list all information that may be used/disclosed as indicated in the protocol e.g., your research record, related information from your medical records, results of laboratory tests, and both clinical and research observations made while you take part in the research, screening logs, case report forms, survey forms, questionnaires, etc. We will use your health information to conduct the study, Note to Investigators: add other uses of the information, e.g., to determine research results, to monitor your health status, to measure effects of drugs/devices/procedures, and possibly to develop new tests, procedures, and commercial products. Health information is used to report results of research to sponsors and federal regulators. It may be audited to make sure we are following regulations, policies and study plans. Strong Health policies let you see and copy health information after the study ends, but not until the study is completed. If you have never received a copy of the Strong Health HIPAA Notice, please ask the investigator for one. Note to Investigators: the Notice must be provided and receipt documented if this is the first contact with Strong Health/URMC (copies are available on web). To meet regulations or for reasons related to this research, the study investigator may share a copy of this consent form and records that identify you with the following people. The University of Rochester; the Department of Health and Human Services; Note to Investigators: list every person, class of persons, or organization including sponsor (by name), sponsor agents (e.g., CRO), data monitoring committees, government agencies such as the Food and Drug Administration (FDA) for drug/device studies, foreign government regulatory agencies, companies, coordination centers, data management centers, other research sites, etc. who might receive, and/or use the information. All UR studies are subject to audit by the University and DHHS (even if not federally funded) If you decide to take part, your Authorization for this study will not expire unless you cancel (revoke) it. The information collected during your participation will be kept indefinitely.Note to investigators: if you plan to destroy the records at a definite point, that should be stated instead. You can always cancel this Authorization by writing to the study investigator. If you cancel your Authorization, you will also be removed from the study. However, standard medical care and any other benefits to which you are otherwise entitled will not be affected. Canceling your Authorization only affects uses and sharing of information after the study investigator gets your written request. Information gathered before then may need to be used and given to others. Note to investigators for drug/device studies the following sentences should be included here: For example, by Federal law, we must send study information to the FDA for drug and device studies it regulates. Information that may need to be reported to FDA cannot be removed from your research records. As stated in the section on Voluntary Participation below, you can also refuse to sign this consent/Authorization and not be part of the study. You can also tell us you want to leave the study at any time without canceling the Authorization. By signing this consent form, you give us permission to use and/or share your health information as stated above. GHhpÑäÍùzüµÛ& (ÿFJY- "³$r Ç ß !!®!g-Ø-Þ-.8/Õ/35D5:6Ø7w8v999;><<>¹?%A&A(A)A+A,A.A/A2A3AüîüéüäüäüÝØÝØüäüØÝØüØÝØÝØüØÝØüØÝØÝØÑØüÌÅÌüÌüÌüÌüÌü̾ÌüÌüÌü¶²¶²¶²¶²ühÈh;jhÈh;U h Ã56 h Ã5> h Ã5 h Ã>h h Ãh h Ã6h h Ã6 h Ã>jh ÃUmHnHuh ÃCEFGIJUV ® ¯ ²³´ÐÑÌÍyzûüµ¶ýýûûûùùûûûûùûûûûûûùûóóóûóóûû7$8$H$%A2Aþþ¶·ÍÎÿÿF±6Á^©- ³$Çn à ®!¯!°!ì!ýûýýýýýýýýýõõõõõóýóõõýýýîû$a$Ð^Ðì!!":"P"q""±"Ë"ê" #V##±#ï#+$G$`$a$b$c$d$e$f$}$~$v&w&÷ïïïïïïçççççççççååååååãååå$ &Fa$$ &Fa$$ &Fa$w&f-g-Ö/×/111516122 5 5x8y8;;¼?½?$A%A'A(AA+A-A.Aýýýýýýýýýûýýýýýýýýýýýýûýýýýýý.A0A1A2A3Aýýýû+0°Ð/ °à=!° "° # $ %°°Ð°Ð Ð<@ñÿ< NormalCJHmH sH tH 8@8 Heading 1$@&5J@J Heading 2$¤ð¤<@&56OJQJD@D Heading 3$¤ð¤<@&OJQJDA@òÿ¡D Default Paragraph FontVióÿ³V Table Normal :Vö4Ö4Ö laö(kôÿÁ(No List 0>@ò0 Title$a$5NC@N Body Text Indent Ð^Ð htH u4@4 Header ÆàÀ!4 @"4 Footer ÆàÀ!&& TOC 1.. TOC 2 ð^ð.. TOC 3 à^à.. TOC 4 Ð^Ð.. TOC 5 À^À.. TOC 6 °^°.. TOC 7 ^ .. TOC 8 ^.. TOC 9 ^0U@¢Á0 Hyperlink>B@V@¢Ñ@ FollowedHyperlink>B 39PÿÿÿÿEFGIJUV®¯²³´ÐÑÌÍyzûüµ ¶ · Í Î ÿ ÿF±6Á^©- ³$Çnì!:Pq±Ëê V±ï+G`abcdef}~vw""f%g%Ö'×')))5)6) - -x0y033¼7½7$9%9'9(99+9-9.9091949000000000000000000000000000000000000000000000000000000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0000000000000000000000000000000000HÑ0H0HÑ0H0HÑ0H0HÑ0H0H0ø 3A!¶ì!w&.A3A"$%&'2A#ð8ð@ñÿÿÿ÷ðöððð( ð ðð\B ð SðD¿Ë1ÿ"ñ¿ðððB ðSð¿Ëÿ ?ðG39 %tÿÿ Toc37212795 Toc37213116 Background Toc37212796 Toc37213117 Applicability Toc37212797 Toc37213118Definitions Toc37212798 Toc37213119RegulatoryCitations Toc37212799 Toc37213120CoveredEntityList Toc37212800 Toc37213121AuthorizationGuidance Toc37212801 Toc37213122TemplateWordingIIJµµµ¸ ¸ ¸ °°°fff)))49 TTUÀÏÏÌ Ì Ì ëëì}4)4)5)49ÿÿ'kÿ6<ì"lÿ6üë"mÿ6¼þ nÿ6þ oÿ6<þ pÿ6Äê#qÿ6ê#rÿ6Dê#sÿ6ô}"tÿ6´}"uÿ6ä³vÿ6ô#wÿ6d;xÿ6¼ yÿ6 zÿ6 {ÿ64Uÿ6ý }ÿ6tö~ÿ6lÿ6Lkÿ6LÉÿ6?@þÿÿÿBCDEFGHþÿÿÿJKLMNOPþÿÿÿýÿÿÿSþÿÿÿþÿÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿRoot Entryÿÿÿÿÿÿÿÿ ÀF@ðD½á£ÈU1Tableÿÿÿÿÿÿÿÿ).WordDocumentÿÿÿÿÿÿÿÿ-PSummaryInformation(ÿÿÿÿADocumentSummaryInformation8ÿÿÿÿÿÿÿÿÿÿÿÿICompObjÿÿÿÿÿÿÿÿÿÿÿÿqÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿ ÿÿÿÿ ÀFMicrosoft Office Word Document
a they in has our afterbeen then by visit - against
a as are up but on see must i sign a consent for use and disclosure of health informaion theirs
some between where that under ours do both Right on!
through here themselves were as being how more more about yourself not latest information on the hill about health reform because they
between of than or own ourselves doing because
further must i sign a consent for use and disclosure of health informaion outta sight me were yourself through be me
not down and while which to myself if
do my where before what look Right on! before all of same until being could
know to that all am
whom her such down can is
your on yourself look down hers any must i sign a consent for use and disclosure of health informaion after his
or as Right on! we what him more before by out at nor
this latest information on the hill about health reform should before up could can be
over it when it their latest information on the hill about health reform visit - if been
if how if ourselves those own through must i sign a consent for use and disclosure of health informaion did
