California State University, Sacramento
HIPAA Privacy Rule Questionnaire
Project Title:
Instructions: If your study includes access to identifiable medical information, you must complete this
questionnaire. The information requested will be used to determine whether your study requires a HIPAA
Authorization Form or other legal agreements.
1
In the conduct of this study, will you have access to subjects’ protected health information (PHI)? PHI is
individual-level health information plus any information that could be used to link the identity of an
individual with his/her health information
Yes
No →You do not need to answer questions 2-19 of this questionnaire
2
Who will use the PHI in the context of this research?
Principal Investigator
Co-investigator(s)
Research assistant(s)
Pharmacist(s)
Programmer(s)/IT
Others(specify):
3
Will anyone who is neither CSUS faculty, staff or student have access to PHI in the conduct of this study?
Yes
No
Does the data being used or created for this study qualify as a Limited Data Set (LDS)? A LDS is health
information that can include dates and geographic descriptors but must exclude other identifiers.
Yes →Skip to question 16
No
What PHI will be used in the conduct of this study?
Medical record (paper or electronic), including laboratory, pharmacy, radiology, etc.
Disease registry or any database maintained within Pacific
Research record (shadow file)
Research or non-routine laboratory, radiology or other reports (specify:
)
Sensitive patient data, e.g., STD or HIV tests, genetic marker tests, etc. (specify:
)
Other (list all:
)
Do you anticipate that your study will have a HIPAA Authorization for participants to sign?
Yes
No → Skip to question 8
When will the participants’ authorization to use or disclose PHI expire?
At the end of the study →Skip to question 17
At a specified date after the IRB has accepted the final report (specify the date and give justification
for extending the authorization beyond the end of the study:
4
5
6
7
and skip to question 17
The authorization will never expire. Provide justification:
and skip to question 17
8
9
Does the use or disclosure of PHI for this study present no more than a minimal risk to the privacy of the
individuals whose PHI will be accessed?
Yes
No
Describe your plan to protect any identifiable information from use or disclosure not approved by the
IRB.
10
Describe your plan to destroy any identifiers at the earliest opportunity or provide a rationale for
retaining the identifiers
11
Describe why the research could not be done if you were required to obtain authorization from each
individual whose PHI you intend to use
12
Describe why the research could not be done without access to the PHI
13
Is the PHI that you are requesting to use or disclose the minimum necessary to conduct this study?
Yes
No
14
How many individuals’ PHI will be disclosed?
No PHI will be disclosed. →Skip to question 19
Fewer than 50 individuals →Skip to question 16
50 or more individuals
What type of PHI will be disclosed?
Clinical/Diagnostic
Health Care
Demographic
Will you disclose PHI only as a Limited Data Set (LDS)?
Yes →Complete 16A – 16H
No →Skip to question 17
15
16
16A. Name of the recipient (individual or entity) received the LDS, including contact name and telephone
number:
16B. What service will the recipient provide?
16C. Name of individuals or class of individuals (e.g., data analysts, etc.) permitted to use the LDS:
16D. What information will be included in the LDS?
16E. How will the recipient use the LDS (e.g., analyze data, produce report)?
16F. Will the recipient be permitted to re-disclose the information to a third party and if so, to whom
(names of the individuals or entities?
16G. Will the recipient use subcontractors with access to the LDS (specify names)?
17
16H. In addition to disclosing PHI as an LDS, will you also be disclosing PHI which does not meet the
criteria of an LDS?
Yes →Skip to question 17
No →Skip to question 18
To whom will you disclose PHI?
PHI will not be disclosed
Sponsor or pass through entity (specify):
Sponsor’s agent(s), e.g., a central laboratory, etc. (specify):
Collaborating investigator (specify):
Data coordinating center (specify):
Service vendors contracting with CSUS to support this research, such as mailing, survey, data storage,
laboratory services, etc. →Answer questions 17A – 17F for each vendor
Other (specify)______________________________
If service vendors will receive or create PHI, provide the following information for each vendor (attach a
separate page if necessary)
17A. Name, contact name and telephone number of the vendor
17B
What service will the vendor provide?
17C
What is the permitted use of the PHI by the vendor (e.g., only for this study)?
17D Will the vendor be permitted to disclose the information to a third party and if so, what is/are the
name(s) of the individuals or entities?
18
19
17E
Will the service vendor use subcontractors (specify names)?
17F
Should CSUS impose additional restrictions on the use of this data?
If the study is a clinical trial, will participants be required to waive their right to access their PHI collected
during their participation in the clinical trial?
The study is not a clinical trial
Yes, participants will be required to waive their right to access their study records during the clinical
trial.
No
Do you assure that you will only use and disclose PHI as described in this Questionnaire, except as
required by law? (Note that all changes in use and disclosure must be approved by the IRB prior to
implementation)
Yes
No
SAMPLE HIPAA Authorization
for Use and Disclosure of Health Information in Connection with a Research Study
HIPAA Authorization
(TITLE OF STUDY)
Why is this authorization required?
The US Government has issued a rule called the Privacy Rule. It became effective April 14, 2003. This
rule requires all researchers with Sacramento State to safeguard your Protected Health Information.
What is Protected Health Information?
Protected Health Information includes information about you that could be used to link your identity
to your health information. It also includes the information in your medical record. The purpose of
this form is to explain to you how we propose to use your health information for the purpose of this
study. None of your health information will be used without your written permission.
Must I agree to this authorization to participate in the research?
To participate in this research study, you must agree to authorize the use of your health information
as we describe below. If you do not approve of this use, you cannot participate in the study.
Why will my health information be used for this study?
The researchers will use your health information to conduct the study, monitor your health status,
measure effects of procedures, determine research results, and develop new procedures. Your health
information will not be disclosed outside of Sacramento State.
Who will use my information, and what is the purpose of this use?
If you sign this authorization, Sacramento State researchers and their research team may use your
health information. They will use your study research record and information from your medical
record. This includes tests, interviews and both clinical and research observations made during your
participation in the study. Sacramento State researchers will not allow your health information to be
seen by or sent to anyone outside Sacramento State. Your medical record may also be reviewed by
authorized staff within Sacramento State to monitor this study, or others as otherwise required by
law.
When will this authorization expire?
This authorization will expire at the end of the research study.
Can I withdraw this authorization?
Yes. At anytime during this study, you may decide that you no longer want to have your information
used or disclosed as part of this study. If so, you must write a letter stating that you withdraw your
authorization and send it to:
Researcher’s name
Researcher’s email address
And if student, the advisor’s name and university address.
If you withdraw your authorization, you may be required to end your participation in the study.
Sacramento State researchers may continue to use your health information that was obtained before
you withdrew your authorization. Even if you withdraw your authorization, the researchers are
required by federal law to record and report anything that relates to your safety and the safety of
others.
Will I get a copy of this authorization?
The researcher who is obtaining this authorization from you must give you a copy of this form after
you sign it.
Authorization signature
My signature below indicates that this authorization has been explained to me, all of my questions
have been answered, and I agree to allow the use and disclosure of my health information for the
research as described above.
_______________________________
Signature of Participant
___________________________________
Signature of Personal Representative, if participant
cannot give authorization
_______________________________
Date
____________________________________
Date
Personal Representative’s Authority(e.g., Power of
Attorney, Spouse, etc.):
_______________________________