FORM J
1.
2.
IRB Tracking #
(OIRB use only)
UT Health Science Center San Antonio Institutional Review Boards
HIPAA Waiver/Alteration for Research Use of PHI
Using this form – To check the checkboxes, click once on the box. To enter text in the text boxes, click once on the
gray box and then type your response. If you are a Mac user and are having trouble using this form, try this alternate
version of the form.
Use this form to request access to identifiable health information without prior written permission from the subject.
Identifiable health information = Protected Health Information (PHI)
Application for: (choose one)
☐
Waiver of
Authorization
Authorization will not be sought for some or all subjects. The researchers plan to use/access
identifiable health information (PHI) in order to obtain and record data without ever receiving
subjects’ written permission (e.g., chart reviews or verbal consent)
☐
Partial Waiver of
Authorization
Used to identify eligible subjects for recruitment in this research. Continued access to PHI
will be limited to those who later volunteer for the study and provide written authorization.
☐
Alteration of
Authorization
Some or all of the elements of authorization are changed or omitted. [Click once to specify
excluded element(s)]
1. Explain why it is not practicable to carry out the research without this waiver. Select all that apply.
☐
Identify/recruit – access to records is needed to identify eligible subjects (e.g., chart reviews, partial waiver for
recruitment, etc.)
☐
Limited Means/Resources– resources needed to identify and contact eligible subjects for recruitment are limited
☐
Large number of subjects projected – potential subject population includes a large number of records to review
and it is not feasible to attempt contact with all subjects
☐
Outdated records – This is a retrospective study involving subjects who may have moved or expired and
researchers cannot feasibly attempt to contact required sample
☐
Risk of breach of confidentiality – The only record linking the subject and the research would be the signed
authorization and a breach of confidentiality is the principal risk in this study (e.g., verbal consent)
☐
Other:
[Click once to type here]
2. Which institutions (or covered entities) maintain the records/ health information you will be accessing? Select all that apply.
☐
UTHSCSA - insert clinic/department below:
Click once to specify location(s)
☐
South Texas Veteran’s Healthcare System (STVHS) - insert clinic/department below:
Click once to specify location(s)
☐
University Health System (UHS) - insert clinic/department below:
Click once to specify location(s)
☐
Christus Santa Rosa Health Care (CSRHC) - insert clinic/department below:
Click once to specify location(s)
☐
Baptist Health System (BHS) - insert clinic/department below:
Click once to specify location(s)
☐
Other- insert Other Institution/clinic below:
Click once to specify location(s)
vMay31-2016
1
FORM J
1.
2.
IRB Tracking #
(OIRB use only)
3. Provide details of the information to be accessed, collected or disclosed without written authorization.
3a. Institution / Covered Entity
(List the institution(s) which maintains materials for
this activity)
3b. Type of materials being used
(List the type(s) of materials to be used, such as electronic
medical records (CPRS, Sunrise, etc.), paper records, etc.)
[Type the Institution name here]
[Click once to type]
3c. Nature of the Health Information
Provide a summary of the actual health information you will be accessing and/or collecting under this waiver/alteration)
[Click once to type summary - (for example "current medications, treatment and medical history relating to hypertension")]
3d. Will you assign study codes to allow the research team to link subjects to the health information listed above or collect
other information allowing you to re-identify subjects? (Not allowed for Exempt Chart Reviews)
☐
No ( delete 3e. and skip to 4)
☐
Yes (complete 3e, then answer 4)
3e. Identifiers Collected with Health Information
Using the 18 HIPAA identifiers below, select those collected that can also be linked to the health information in 3c.
(delete those you will not be collecting)
 Any unique identifying number, characteristic, or
code (e.g., assigned study code)
 Names
 Address
 Dates (except year)
 Ages over 89 (except those grouped as age 90 or
older)
 Phone numbers
 E-mail addresses
 Social security numbers
 Medical record numbers
vMay31-2016










Fax numbers
Account numbers
Certificate/license numbers
Health plan beneficiary numbers
Vehicle identifiers and serial numbers, or license plate numbers
Device identifiers and serial numbers
Web Universal Resource Locators (URLs)
Internet Protocol (IP) address numbers
Biometric Identifiers, including finger and voice prints
Full face photographic images and any comparable images
2
FORM J
1.
2.
IRB Tracking #
(OIRB use only)
4. Describe the plan to protect the identifiable health information and indicate where it will be stored and who will have access to it.
Indicate all safeguards which will be used to protect identifiers to ensure minimal risk of improper use or disclosure of the subject's
identifiable information.
4a. DURING ACCESS TO SOURCE:
Describe the measures to protect health information during the time the researcher will be viewing health records:
Select all that apply:
☐
All HIPAA regulations as well as institutional privacy policies will be followed during the time the researchers have actual
access to the source data (health records)
☐
Information (paper and/or electronic) will be viewed in a private/secure area (i.e., medical records room, behind covered
entity firewall, etc.)
Only personnel authorized by the covered entity will access health record data. These individuals are also approved to
review PHI as part of this research study
☐
☐
Other:
[Click once to type here]
4b. RECORDED DATA:
Measures to protect the recorded data:
☐ N/A this study is EXEMPT (this section is not applicable)
The information obtained will be stored in the
following location:
[Click once to type]
Only personnel approved in this research study will
have access to the recorded identifiable data:
☐ Check to confirm your understanding
☐ Required by law
The identifiable data collected will not be disclosed
to persons outside of the covered entity unless:
The key to decipher the code/identifiers will be
permanently destroyed at the earliest opportunity
consistent with the conduct of the research which is
(select):
☐ Approved by the IRB as part of the protocol
☐ Other: [Explain here]
☐ VA Studies only: When the VHA Records Control Schedule for
destruction of research data allows us to do so. There is currently a
prohibition against destroying VA research data in effect
☐ Upon completion of the study (non-VA studies only)
☐ After publication acceptance (non-VA studies only)
☐ Other: [Explain here]
4c. DISCLOSURE OF DATA:
Protection measures while transmitting PHI (disclosing) from one covered entity to another location:
Will you disclose the recorded identifiable information outside the covered entity?
(i.e., UHS medical record data stored on UTHSCSA servers; identifiable health data sent to sponsor, etc.)
☐
No - this study is EXEMPT and not collecting identifiable health information
☐
No - this study is not disclosing PHI collected under this waiver/alteration
☐
Yes - Describe steps taken to securely
transmit identifiable health information (PHI)
outside the covered entity:
[Click once to type]
vMay31-2016
3
FORM J
1.
2.
IRB Tracking #
(OIRB use only)
5. The HIPAA regulation requires reasonable efforts to limit protected health information to the minimum necessary to
accomplish the intended purpose of the use, disclosure or request. Are you obtaining only the minimum information
necessary to complete the waived activities?
☐
Yes
☐
No (explain/justify why not): [Click once to explain]
6. How long do you need access to PHI (without subject authorization) under this waiver?
Note: this Waiver is effective beginning on the date it is approved. You will only be permitted to access PHI beginning on the
approval date and ending at the time you select below.
☐
Upon completion of recruitment
☐
Upon completion of data collection
☐
Upon completion of study analysis
☐
Upon study publication acceptance
☐
Other: [Click once to explain]
BY SUBMITTING THIS FORM TO THE IRB, PI IS MAKING THE FOLLOWING ASSURANCES:


The information listed in the waiver/alteration application is accurate.
All research staff (ALL study personnel including PI that are involved in the research) will comply with the HIPAA
regulations and the waiver/alteration criteria.
All research staff will complete HIPAA Research Training.
The PI assures that the information obtained as part of this waiver/alteration (including protected health information) will
not be reused or disclosed to any other person or entity except as permitted by this waiver/alteration, by law, for
authorized oversight of the research study, or for other research for which the use or disclosure of protected health
information has been permitted by the IRB. If at any time, the PI wants to reuse this information obtained under
waiver/alteration of authorization for other purposes or disclose the information to other individuals or entity the PI will
seek prior approval by the IRB.


For IRB Office Use Only:
Type of Review
☐
Expedited, on behalf of the UTHSCSA IRBs
☐
Full Board; indicate by which UTHSCSA IRB:
IRB-1 or
IRB-2 or
IRB-3 or
IRB-e
The following criteria as required by 45CFR164.512(i) were satisfied:
☐
The intended use and/or disclosure of PHI involves no more than a minimal risk to the privacy of individuals.
☐
☐
☐
There is an adequate plan to protect the identifiers from improper use and disclosure
There is an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of the research
unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law;
and
There are adequate written assurances that the protected health information will not be reused or disclosed to any other
person or entity, except as required by law for authorized oversight of the research study, or for other research for which
the use or disclosure of protected health information would be permitted by this subpart
☐
The research could not practicably be conducted without the waiver
☐
The research could not practicably be conducted without access to and use of the protected health information
Approved by:
vMay31-2016
4