Waiver of HIPAA authorization

What does Waiver of HIPAA authorization mean in clinical research?

HIPAA allows a covered entity to use or disclose PHI for research without individual authorization when an IRB or Privacy Board has approved a waiver or alteration of authorization, in whole or in part.^⁠[1] A partial waiver can be limited to recruitment steps, such as identifying and contacting potential participants, with signed authorization collected later at consent.

The board must document three findings:^⁠[1]

• The use of PHI involves no more than minimal risk to privacy, based on an adequate plan to protect identifiers, a plan to destroy them at the earliest opportunity unless keeping them is justified, and written assurances against reuse or further disclosure.
• The research could not practicably be conducted without the waiver.
• The research could not practicably be conducted without access to the PHI.

Why it matters: records-based recruitment, such as screening an EHR population for a trial, often depends on this pathway, because authorization cannot practicably be collected from patients before they are identified. Practical note: name the exact data elements, who sees them and how long they are kept in the request. Security covers how Bond limits and logs access to PHI.