UPMC Health System/University of Pittsburgh Institutional Review
Board
APPLICATION for the CERTIFICATION OF HONEST BROKER SYSTEMS/PROCESSES
NOTE: Honest broker systems are not needed when studies will access only electronic medical
record information. See UPMC Policy HS-RS005 (“Research Using UPMC Electronic PHI”).
1. School, Department, Division, or Center for which this Honest Broker System/Process is
being developed:
2. Provide a name for this Honest Broker System:
3. Identity of the individual (who must be part of the UPMC workforce) who will assume
responsibility for the appropriate management and oversight of this Honest Broker
System/Process:
a.
b.
c.
d.
e.
f.
Name:
Title:
Address:
Phone:
Email:
Fax:
NOTE: “UPMC workforce” includes the following: research personnel, employed by
the University of Pittsburgh, who are working under the supervision of a physician or
other health care professional who is a member of the UPMC hospital medical staff or
employed by UPMC.
4. Names of all other individuals who will perform honest broker services under this Honest
Broker System/Process. All persons must be part of the UPMC workforce, or UPMCapproved contractors.
5. Identify medical record systems that may be accessed by this Honest Broker
System/Process. Also indicate whether other types of materials (e.g., radiographic
images; biological specimens) will be accessed and how their de-identification will be
accomplished.
6. For paper-based medical record information, describe the processes and/or systems that
will be used to fully de-identify (i.e., HIPAA “Safe Harbor” compliant) the medical
record information to be provided to researchers. (See Attachment A for HIPAA deidentification requirements.)
7. For paper-based medical record information, describe the processes and/or systems that
will be used to provide researchers with Limited Data Sets of the medical record
information.
8. Describe policies, procedures and controls for ensuring that the Limited Data Sets will be
consistent with the data element list specified in the IRB-approved application and the
Data Use Agreement.
9. Describe policies, procedures and controls for assignment of linkage codes to the deidentified medical record information (if applicable). Also indicate how linkage codes
will be managed by the Honest Broker so as to prevent researcher access to information
linking these codes with corresponding patient-identifiers.
10. Documentation and Quality Assurance
a. Indicate how the Honest Broker system will ensure that IRB approval has been
granted for the use of de-identified medical recording information prior to providing
these data to researchers.
b. Describe policies and procedures for documenting each honest broker transaction
with each researcher (e.g., documentation of researcher identify, research study name,
nature of information to be provided, IRB approval number, etc.)
c. Describe how you will routinely monitor (audit) these de-identification processes and
ensure that investigators receive the information that has been specified in their IRB
application.
d. Describe how the Honest Broker system will maintain the security of all identifiable
medical record information in its possession during the performance of the deidentification process.
9. Business Associate Agreement:
Are all individuals serving as honest brokers members of the UPMC workforce?
Yes.
No.
A business associate agreement is not required
A signed business associate agreement is attached
For standard UPMC Business Associate Agreement go to:
http://www.irb.pitt.edu/hipaa/HonestBrokerBAAgrmnt.doc
NOTE: The University of Pittsburgh will NOT permit its staff to serve as Honest Brokers
for UPMC.
**********************************
CERTIFICATION OF HONEST BROKER RESPONSIBILITIES
By signing below I agree/certify that:
1. I am cognizant of, and will comply with, the Federal Policy (45 CFR 46) and HIPAA
regulations as well as with the IRB and UPMC policies governing research that involves the
use of identifiable medical record information.
2. I have reviewed this Honest Broker System/Process application in its entirety and I am fully
aware of, and in agreement, with all submitted statements.
3. I will ensure that the Honest Broker System/Processes will be implemented and followed in
strict accordance with this application.
4. I will request and obtain IRB and UPMC Privacy Officer approval for any proposed
modifications to this application prior to implementing such modifications.
5. I will ensure that all individuals involved in providing the Honest Broker System/Process
services are provided with a copy of this current version of this application.
6. I and/or my Honest Broker staff will not provide identifiable medical record information, deidentified medical record information, or Limited Data Sets of medical record information to
affiliate researchers until evidence of IRB approval of the corresponding research study is
provided.
7. I will respond promptly to all requests for information or materials solicited by the UPMCHS
Privacy Officer or the IRB.
8. I will maintain adequate documentation of all Honest Broker transactions with affiliated
researchers.
9. I will provide an annual report of all such transactions to the OSPARS office upon request of
the UPMC Privacy Officer.
10. I and/or my Honest Broker staff will, under no circumstances, provide the researchers with
information that would permit de-identified (HIPAA “Safe Harbor”) medical record
information or Limited Data Sets of medical record information to be linked to patient
identifiers.
11. I and/or my Honest Broker staff will not intervene or interact with patients in the conduct of
Honest Broker functions.
12. I and/or my Honest Broker staff will maintain complete confidentiality of identifiable
medical record information in our possession during the performance of Honest Broker
functions.
13. I am a member of the UPMC Workforce.
14. I will only de-identify paper-based medical records.
15. I will ensure that all members of the Honest Broker staff have completed all required training
modules.
______________________________________
Signature of Individual Responsible for Honest
Broker System/Processes
_________________
Date
*****************************************************************************
Honest Broker System/Process Application Approved:
______________________________________
UPMC HS Privacy Officer
_________________
Date
______________________________________
Authorized IRB Staff Member
_________________
Date
The following attachments are not included in this document:
Attachment A: HIPAA “Safe Harbor” De-Identification of Medical Record Information
Attachment B: Limited Data Sets