To apply for a Waiver of HIPAA Authorization, the IRB requires:
Use or disclosure involves no more than minimal risk to the privacy of individuals because of the presence of at least the following elements:
- An adequate plan to protect health information identifiers from improper use or disclosure,
- An adequate plan to destroy identifiers at the earliest opportunity absent a health or research justification or legal requirement to retain them, and
- Adequate written assurances that the PHI will not be used or disclosed to a third party except as required by law, for authorized oversight of the research study, or for other research uses and disclosures permitted by the Privacy Rule;
- Research could not practicably be conducted without the waiver or alteration; and
- Research could not practicably be conducted without access to and use of PHI.