Requirements for Institutional Review Board (IRB) Review and HIPAA Waiver Documentation for RIF DUA Request Submissions

Purpose

CMS must ensure that all research requests for identifiable (RIF) data have IRB documentation to satisfy the requirements of the Common Rule and the Health Insurance Portability and Accountability Act (HIPAA). This article describes the requirements and presents examples of acceptable IRB documentation. The IRB documentation must indicate that there was a review that satisfies the following two requirements:
Current Version Date:
02/28/2018
Save as PDF (print)
1. Informed consent for human subjects participation in research or waiver of informed consent

CMS requires IRB review of each research study that proposes to use RIF data, regardless of whether the participants are actively involved (e.g. a survey or clinical trial) or if you are only using existing data (e.g. CMS data) about the subjects.

The IRB may approve your study, or it may exempt it from review. Either outcome is acceptable for the RIF DUA request.

The IRB will review the study with regard to the requirements of the Common Rule:

  • The Common Rule is a federal policy that covers the protection of human subjects in research.
  • The Common Rule requires that researchers obtain informed consent from each human subject for their participation in the research, OR
  • If certain conditions are met, the IRB may waive the Common Rule requirement to obtain informed consent. The waiver is also implied if the IRB exempts the study from review (or exempts the study from the Common Rule).
2. Individual authorization for release of health data or waiver of authorization (HIPAA waiver)

The IRB will also review the study with regard to the requirements of the HIPAA Privacy Rule:

  • The Privacy Rule is a part of HIPAA (Health Information Portability and Accountability Act), the federal policy that covers the protection of health information.
  • The HIPAA Privacy Rule allows CMS to release protected health information for research either with individual authorization, or

If a researcher has not obtained individual authorization, a researcher must provide documentation that an IRB has approved a waiver of the research subjects' authorization for disclosure of information about them for research purposes.

CMS requires documentation of the IRB review results and waivers.
  • There isn’t one specific form or format, but there are some basic IRB documentation requirements.

A. Name of the IRB and contact information (preferably via letterhead)
B. Date of review or approval and expiration date (some exemptions may not expire)
C. Study title: Must be the exact same study title as on your documents
D. Principal Investigator (PI) name: Must be the same as the PI name on your documents
E. Determination of IRB approval or exemption, and brief explanation
F. Name/signature of the authorized IRB representative

  • There isn’t one specific wording required, but it must include language about the waivers.

G. Waiver of informed consent, or the IRB may exempt the study from review
H. Language indicating that a HIPAA waiver is included (may indicate waiver of the Privacy Rule requirements, waiver of release of information authorization, or reference the specific statute)

  • If you are obtaining informed consent and/or individual authorization, then the IRB documentation should state that.
Example 1
Example 2

Still have questions? Please the IRB FAQs.

Save as PDF (print)

Article Information

Author:
Jennifer Koper
Level:
Introduction
Topic:
Policy, Request Process
Program:
Medicare, Medicaid
Disclaimer:
The process and materials mentioned as part of this KnowledgeBase article are current, as of the publication date on the article, to the best of our knowledge. The examples provided are correct in the aggregate but may not apply to every subgroup or circumstance that a researcher may wish to study. It is up to the researcher to conduct analysis and confirm that the patterns described in this KnowledgeBase article apply to his/her particular study. If your research findings appear to contradict the advice provided, please contact ResDAC at resdac@umn.edu.