Waiver of HIPAA Authorization

To apply for a Waiver of HIPAA Authorization, the IRB requires:

  1. Use or disclosure involves no more than minimal risk to the privacy of individuals because of the presence of at least the following elements:
    1. An adequate plan to protect health information identifiers from improper use or disclosure,
    2. An adequate plan to destroy identifiers at the earliest opportunity absent a health or research justification or legal requirement to retain them, and
    3. Adequate written assurances that the PHI will not be used or disclosed to a third party except as required by law, for authorized oversight of the research study, or for other research uses and disclosures permitted by the Privacy Rule;
  2. Research could not practicably be conducted without the waiver or alteration; and
  3. Research could not practicably be conducted without access to and use of PHI.