GUIDELINES FOR HUMAN SUBJECT RESEARCH COLLABORATIONS
JACKSON LABORATORY AND UCONN HEALTH
BACKGROUND
There is an expectation that UConn Health and The Jackson Laboratory personnel will collaborate often on human
subject research projects. As such an IRB Reliance agreement has been established whereby Jackson may rely upon the
IRB of UConn Health.
UConn Health is a covered entity under HIPAA whereas Jackson on the UConn Health campus is considered a hybrid
entity under HIPAA. Within Jackson, the clinical genomics service is a revenue-generating operation and a covered
entity under HIPAA. Jackson will be developing Business Associate Agreements (BAAs) with various hospitals in the area
to address HIPAA as related to the clinical genomics service. The research portion of Jackson is not a covered entity
under HIPAA. Jackson will establish a firewall between the clinical portion of the company (the covered entity portion)
and the research portion of the company (the non-covered entity).
UConn Health and Jackson have worked together to establish the following guidelines for addressing HIPAA and other
issues related to human subject research studies that are done in collaboration.
GUIDELINES
In all cases in which Jackson is involved in any capacity with a human subject research study (e.g. providing funding
and/or services), Jackson Labs is to be noted in the Key Study Personnel section of the IRB Application in the area
designated for Administrative Oversight. This designation allows for Jackson administrators to maintain a listing of all
studies with which Jackson and UConn Health are collaborating.
A: Sharing Identifiable Health Information with Jackson Laboratory
HIPAA DOCUMENT: Authorization
WHEN TO USE: Identifiable* health information will be shared with Jackson investigators and it is possible to obtain
a signed authorization from subjects (e.g. clinical patients on UConn Health campus)
HOW TO IMPLEMEMT:
 Jackson listed on the Authorization as an entity to which information will be disclosed
 Jackson investigators are named in the IRB application as co-investigators
 Jackson is noted in the IRB application as a collaborating site
o Note: if Jackson is providing any funding it is also noted in the application as a sponsor with the
role of funding selected
 Jackson is noted in the Key Study Personnel section of the IRB Application in the area designated for
Administrative Oversight. This allows for Jackson administrators to maintain a listing of all studies with
which Jackson is involved.
CONSIDERATION: Through receipt of the identifiable information, Jackson is engaged in the research so the names
of the Jackson investigators are required and UConn Health would be the IRB for Jackson. Jackson investigators
would still be obligated to follow confidentiality procedures as described in the protocol.
Document1
Page 1 of 3
9/9/2014
OUTCOME: Because the protected health information (PHI) was disclosed by UConn Health to Jackson for research
with an individual's written permission in the form of an Authorization, that PHI is no longer covered under HIPAA.
This is acceptable for Jackson. Use of the authorization allows for full sharing of study information.
HIPAA DOCUMENT: Waiver
WHEN TO USE: Identifiable* protected health information being shared with Jackson investigators and it is NOT
possible to obtain an authorization from subjects (e.g. retrospective review of clinical records)
HOW TO IMPLEMENT:
 Jackson investigators are named in the IRB application as co-investigators
 Jackson is noted in the IRB application as a collaborating site
o Note: if Jackson is providing any funding it is also noted in the application as a sponsor with the
role of funding selected
 Jackson is noted in the Key Study Personnel section of the IRB Application in the area designated for
Administrative Oversight. This allows for the Jackson IRB office to maintain a listing of all studies with
which Jackson is involved.
 UConn Health investigator must maintain an accounting of disclosures to Jackson
CONSIDERATION: Through receipt of the identifiable information, Jackson is engaged in the research so the names
of the Jackson investigators are required and UConn Health would be the IRB for Jackson. Jackson investigators
would be obligated to follow confidentiality procedures as described in the protocol.
OUTCOME: Because the information was shared under a waiver of authorization the information is no longer
considered “protected” health information so this is acceptable for Jackson. Use of the authorization allows for full
sharing of study information.
Note: Limited data sets and data use agreements are not to be used because receipt of information by Jackson under
such agreements imposes HIPAA restrictions upon Jackson.+
B: Sharing De-Identified Health Information with Jackson Laboratory
WHEN APPLICABLE: When the health information that will be shared with Jackson investigators who are
collaborating on the project does not contain any identifiable* data. The information may be coded providing the
code is not derived from other identifiers and that Jackson personnel do not have the key to decipher the code. If
the UConn Health investigators are using protected health information, HIPAA is addressed per routine practice at
UConn Health.
HOW TO IMPLEMENT:
 Jackson investigators are NOT named individually in the IRB application as co-investigators as they will not
be engaged in human subject research
 Jackson is noted in the IRB application as a collaborating site and the role of Jackson is clearly described as
using only de-identified information for a specified purpose (e.g. genetic analysis on de-identified samples)
o Note: if Jackson is providing any funding it is also noted in the application as a sponsor with the
role of funding selected
 Jackson is noted in the Key Study Personnel section of the IRB Application in the area designated for
Administrative Oversight. This allows for the Jackson IRB office to maintain a listing of all studies with
which Jackson is involved.
Page 2 of 3
Document1
9/9/2014
CONSIDERATION: Because there is no release of identifiable information, Jackson investigators are not engaged in
human subject research. If Jackson is funding the research, then Jackson is engaged in the research. In order to
track all human subject research projects that Jackson “touches” (i.e. whether directly engaged in the project or
providing other services such as analysis of de-identified samples), Jackson Labs is always to be listed in the Key
Study Personnel section of the IRB Application in the area designated for Administrative Oversight.
UConn Health investigators cannot share any identifiable information with Jackson investigators when
reviewing/discussing the research.
OUTCOME: Because the information is de-identified prior to receipt by Jackson, HIPAA is not applicable to Jackson
and Jackson (unless providing the funding) is not engaged in the human subject research aspect of the work.
*identifiable means the health information being shared contains one or more of the HIPAA defined identifiers listed below. Deidentified therefore means none of the HIPAA identifiers are included in the data. For a code to be an identifier it must be comprised
of other identifiers, and/or the recipient of the data must have the key to link the coded data back to the individual from whom it
came.
IDENTIFIERS PER HIPAA
Names
Phone #s
Fax #s
Social Security #s
Account #s
Certificate/License #s
Device Identifiers and Serial #s
IP Addresses
Photographic Images
Geographic Subdivision Smaller Than a State
All Elements of Date Except Year
E-mail Addresses
Medical Record #s
Health Plan Beneficiary #s
Vehicle Identifiers and Serial #s
Web URLs
Biometric Identifiers
Any other unique identifying number, characteristic or code
+obligations re receipt of a limited data set under a data use agreement:
 Data Recipient agrees to not use or disclose the Limited Data Set other than as permitted or required by the Data Use
Agreement (DUA) or as Required By Law.
 Data Recipient agrees to use appropriate safeguards to prevent use or disclosure of the Limited Data Set other than as
provided for by the DUA.
 Data Recipient agrees to report to Covered Entity any use or disclosure of the Limited Data Set not provided for by the DUA
of which it becomes aware.
 Data Recipient agrees to ensure that any agent, including a subcontractor, to whom it provides the Limited Data Set
received from Covered Entity agrees to the same restrictions and conditions that apply through the DUA to Data Recipient
with respect to such information.
 Data Recipient agrees not to identify the information or contact the individuals
 Data Recipient, and any of his/her agents, including a subcontractor, to whom they provide Limited Data Set information
received from Covered Entity, must agree to the restrictions and conditions that apply through the DUA with respect to
such information.
 Except as otherwise limited in a DUA, Data Recipient may use or disclose Limited Data Set to perform research functions,
activities, or services provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity.
Document1
Page 3 of 3
9/9/2014