HIPAA Alert: Guidance on Authorization for Research

Prior to using patients’ protected health information for research, individual authorizations must be obtained from patients in writing.

So what does that look like?

HHS Office for Civil Rights (OCR) explains that individual authorizations must:

• Be written in plain language to ensure they can be easily understood;
• Include, in a specific and meaningful fashion, a description of the information that will be used and disclosed;
• Include the names of the persons authorized to disclose and receive the information;
• A description of the purpose of the requested use or disclosure, and;
• An expiration date or expiration event after which the authorization will be invalid.

In addition, the individual authorization must make clear the following rights of the individual:

• The right to revoke authorization in writing and any exceptions to that right;
• Details of how that right can be exercised;
• The ability or inability to condition treatment, payment, enrollment, or eligibility for benefits on the authorization, and;
• The potential for information disclosed in accordance with the authorization to be re-disclosed by the recipient and no longer be protected by the HIPAA Privacy Rule.

For more information from the OCR, click here.

If you have any questions about HIPAA, please immediately call HIPAA Privacy Officer Zorana Vojnovic at (402) 354-6863 or @email.