To ensure a research study participant’s right to privacy is secure, the Health Insurance Portability and Accountability Act (HIPAA) guidelines must be followed.
 

HIPAA

It's the policy of Community Medical Centers to obtain patient authorization, a Waiver of Authorization, prior to using or disclosing Protected Health Information (PHI) for research purposes.

This policy covers all PHI, which is or may be created, used or disclosed by, through or during Research activities. It applies to workforce members and to other individuals who participate in the Community Medical Centers Organization Healthcare Arrangement. Using and disclosing PHI for research purposes will require the prior review and approval of Community Medical Centers' IRB.

General Requirement

Community Medical Centers shall obtain or require the Researcher to provide a valid HIPAA authorization, a Waiver of Authorization prior to using or disclosing PHI for Research.

Except as otherwise noted in this policy, the Researcher shall obtain approval from an Institutional Review Board (IRB) for the Research study prior to using or disclosing PHI for Research.

Community Medical Centers shall obtain or require the Researcher to provide a separate authorization if the Research involves the use or disclosure of Psychotherapy Notes.

Community Medical Centers shall require that all use and disclosure of PHI for Research purposes, regardless of the method of authorization, meets the minimum necessary requirements

Community Medical Centers shall establish a procedure to identify the PHI related to the Research study and shall ensure that all information created during the Research study that is used to make decisions about the patient is properly documented in the patient's Designated Record Set, if one exists. In this way, Research records shall not be part of the Designated Record Set and therefore shall not be subject to the patient rights of Access or Amendment.

Research conducted using de-identified information is not subject to HIPAA or this policy, although using or disclosing PHI to create de-identified information is. Researchers shall clearly indicate in the proposed research study how the PHI will be de-identified and will obtain a certification from the IRB.

Community Medical Centers has designated the IRB as the responsible party for HIPAA research decisions. The IRB shall ensure that at least one member has privacy expertise.

Recruiting Research Subjects

Community Medical Centers may not disclose PHI for recruitment purposes to Researchers or recruiters who are not part of its workforce without the patient authorization or a Waiver of Authorization.

Community Medical Centers personnel who are known to the patient and who have some reason to believe the patient may be qualified as a Research participant may inform the patient of the Research study and provide the patient with the Researcher's or recruiter's contact information.

Community Medical Centers medical staff may contact their own patients for purposes of recruiting them to participate in a Research study without a patient authorization or a Waiver of Authorization.

Community Medical Centers may inform patients responding to an advertisement regarding participation in a Research study about the Research Study prior to obtaining a patient authorization.

Community Medical Centers shall establish procedures to ensure that a Researcher obtains patient authorization from a patient who has indicated interest in participating in a Research study prior to asking the patient any screening questions that involve PHI.

Community Medical Centers may permit Research or statistical workforce members to use PHI to identify potential Research subjects subject to a Research Attestation for Preparatory Research.