Does the HIPAA Privacy Rule require documentation of Institutional Review Board (IRB) or Privacy Board approval of an alteration or waiver of individual authorization before a covered entity may use or disclose protected health information for any of the following provisions: (1) for preparatory research at 45 CFR 164.512(i)(1)(ii), (2)for research on the protected health information of decedents at 45 CFR 164.512(i)(1)(iii), or (3) a limited data set with a data use agreement as stipulated at 45 CFR 164.51Answer:No. Documentation of IRB or Privacy Board approval of an alteration or waiver of individual authorization is only needed before a covered entity may use or disclose protected health information under 45 CFR 164.512(i)(1)(i) (PDF - 61KB). See the fact sheet and frequently asked questions about the research provisions on this web site for more information about Institutional Review and Privacy Boards.
Date Created: 12/20/2002
Last Updated: 11/21/2006
| 
Print 
Download Reader 
HHS Home|About HHS|Contact Us
