Privacy Rule
Frequently Asked Questions
1. I plan to submit samples to the NIGMS Human Genetic Cell Repository, and I am not part of a covered entity. Does the Privacy Rule apply to me?
If you are not a covered entity and not a workforce member of a covered entity, the Privacy Rule does not apply to you. Therefore, there are no requirements beyond those described in the Submission of Specimens to the Repository).
2. I plan to submit samples to the NIGMS Human Genetic Cell Repository, and I am part of a covered entity. What are some of the ways I can disclose donor's health information to the repository and still comply with the Privacy Rule?
There are several ways a covered entity can disclose a donor's health information for research and comply with the Privacy Rule.
- For example, you may obtain a signed Authorization from the donor of the sample that permits you (a covered entity) to use and disclose the subject's health information and associated clinical specimens for a specified research purpose. The creation and maintenance of a research repository qualifies as a specific research activity under the Privacy Rule. The Authorization may be included as part of the informed consent document or it may be a separate document. If the Authorization is a separate document you do not need to submit it to the Repository.
Alternatively, you may de-identify a sample by:
- Removing the 18 specific elements that can identify an individual (http://privacyruleandresearch.nih.gov/pdf/HIPAA_Booklet_4-14-2003.pdf), provided that you have no actual knowledge that the remaining information could be used alone or in combination with other information to identify the subject of the information; or
- Having a qualified statistician determine and document that the information is de-identified.
For a complete discussion of the various ways to use and disclose health information for research under the Privacy Rule, see: http://privacyruleandresearch.nih.gov/pr_02.asp.
3. If I choose to obtain an Authorization, what information needs to be in the Authorization?
Complete information on Authorizations for research uses or disclosures of protected health information and sample Authorization language can be found at http://privacyruleandresearch.nih.gov/authorization.asp.
4. What documentation does the Repository require?
http://privacyruleandresearch.nih.gov/authorization.asp
The Repository does not require you to submit documentation about compliance with the Privacy Rule. However, if the Authorization is part of the informed consent document, you must still submit an unsigned copy of the informed consent document, as described in Submission of Specimens to the Repository.
|
|