The Purpose of an Institutional Review Board
An Institutional Review Board, or IRB, is a formally designated committee responsible for reviewing and monitoring research involving human subjects to ensure their rights and welfare are protected. RHIA candidates should understand how IRB oversight interacts with HIPAA privacy protections when research involves protected health information.
The Common Rule and HIPAA Together
Research involving human subjects is governed by the Federal Policy for the Protection of Human Subjects, commonly called the Common Rule, as well as HIPAA when PHI is involved. These two frameworks operate together but serve different purposes: the Common Rule protects human subjects broadly, while HIPAA specifically protects the privacy of health information used or disclosed in research.
Authorization for Research
Generally, PHI may only be used or disclosed for research with the individual's written HIPAA authorization. However, HIPAA permits certain alternatives when an IRB or privacy board grants a waiver or alteration of the authorization requirement, typically because the research could not practicably be conducted without the waiver and involves minimal risk to privacy.
Preparatory to Research and Limited Data Sets
- Researchers may review PHI preparatory to research, such as to assess feasibility, without authorization if certain representations are made and no PHI is removed from the covered entity
- A limited data set, which excludes direct identifiers but may still include dates and geographic information, can be used for research under a data use agreement without full authorization
- Deidentified data, meeting the Safe Harbor or Expert Determination standard, falls outside HIPAA entirely and can be freely used for research
HIM's Role in Research Compliance
HIM departments often manage the release of records for research purposes, verify that appropriate IRB approval or waiver documentation exists before disclosure, and maintain accounting of disclosure logs for research releases that do not qualify for an exception. HIM professionals must be able to distinguish which pathway, authorization, waiver, limited data set, or deidentification, applies to a given research request.
Accounting of Disclosures for Research
When PHI is disclosed for research involving 50 or more individuals without authorization, HIPAA permits a simplified accounting process that lists all protocols rather than requiring entity-specific tracking of each disclosure.
Exam Strategy
- Learn to distinguish authorization, waiver, limited data set, and deidentification pathways
- Understand the IRB's role in approving waivers of authorization
- Recognize how accounting of disclosure obligations differ for research disclosures
Key Takeaway
Research compliance sits at the intersection of human subjects protection and health information privacy, and RHIA candidates must understand both frameworks to correctly analyze research-related disclosure scenarios.