Regulations
The University of South Alabama IRB follows numerous regulations set by federal agencies to ensure the protection of participants in human subjects research. These include:
The Office for Human Research Protections (OHRP) provides leadership in the protection of the rights, welfare, and wellbeing
of human subjects involved in research conducted or supported by the U.S. Department
of Health and Human Services (HHS). OHRP is part of the Office of the Assistant Secretary
for Health in the Office of the Secretary of HHS.
OHRP provides clarification and guidance, develops educational programs and materials,
maintains regulatory oversight, and provides advice on ethical and regulatory issues
in biomedical and behavioral research. OHRP also supports the Secretary’s Advisory
Committee on Human Research Protections (SACHRP), which advises the HHS Secretary
on issues related to protecting human subjects in research.
Title 45 CFR 46: Protection of Human Subjects
Coded Information or Specimen Use in Research
Inclusion of Children - Policy Implementation (NIH)
Certificates of Confidentiality
OHRP Frequently Asked Questions
Informed Consent (FDA guidance)
21 CFR Part 50 - Protection of Human Subjects
21 CFR Part 56 - Institutional Review Boards
21 CFR Part 312 - Investigational New Drug Applications (INDs)
21 CFR Part 812 - Investigational Device Exemptions (IDEs)
Significant Risk and Nonsignificant Risk Medical Device Studies
FDA Guidance FAQs on Form 1572
IRB Frequently Asked Questions
Clinical Trials and Human Subject Protections - Guidance, resources, good clinical practices (GCPs)
Good Clinical Practice (GCP) - International Conference on Harmonisation (ICH)
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its regulations, including the Privacy Rule and the Security Rule, as well as the Health Information Technology for Economic and Clinical Health (HITECH) Act, govern the way certain health information is collected, maintained, used, and disclosed. HIPAA is designed to protect individual’s privacy and inform them how their health information is used and disclosed.
The Privacy Rule established a set of safeguards for a type of health information known as protected health information (PHI). See list of 18 PHI identifiers. HIPAA covered entities may only use or disclose PHI in certain circumstances and under certain conditions.
Databases containing protected health information (PHI) used for research purposes are impacted by the HIPAA Privacy Rule. The Privacy Rule regulations cover the use of databases containing PHI just as they apply to any other research using PHI.
Covered Entities
Any research taking place at a covered entity within the University or USA Health Systems and involving PHI must comply with the Privacy Rule. The University of South Alabama is a “hybrid entity” that performs both covered and non-covered functions under HIPAA. The healthcare components and components acting as business associates within USA are required to comply with HIPAA. For purposes of compliance with HIPAA, USA has been designated as an Organized Health Care Arrangement (OHCA), which includes USA Health (Hospitals, Physicians Group, Mitchell Cancer Institute and University of South Alabama Health Care Authority (HCA)), USA Allied Health Speech and Hearing Center, USA Allied Health Physical Therapy, USA Radiological Sciences, USA Psychology Clinic, USA College of Nursing, and USA College of Medicine. These entities participate in a clinically and operationally integrated care setting in which it is necessary to share PHI for joint management and operations.
Research HIPAA Privacy & Security Compliance at USA
HIPAA requires a Privacy Board to make determinations about the use of PHI in research. At the University of South Alabama, the USA Institutional Review Board (IRB) serves as the Research HIPAA Privacy Board. This dual role allows the Board to conduct an ethical and privacy compliance review. When the IRB cedes IRB review of a study to an outside IRB, the USA IRB Office still serves in the Privacy Board role, unless otherwise indicated in the Reliance Agreement.
The full USA HIPAA Privacy & Security Compliance for Research plan includes policies, procedures, and implementation for conducting HIPAA compliant research.
USA HIPAA Privacy & Security Compliance for Research Plan
Training
Faculty, fellows, staff, and students conducting human subjects research involving Protected Health Information (PHI) are required to complete the USA HIPAA Research tutorial. Training must be completed before participating in human subjects research involving PHI.
HIPAA Certifications
There are four ways to perform HIPAA compliant research. They are:
- Use of de-identified information - Information accessed includes no PHI, therefore does not fall under HIPAA regulations. Additionally, this is not considered human subjects research and does not require review by the IRB
- Obtain participant Authorization through consent forms
- Obtain a waiver of authorization from the IRB
- Use of limited data set
Consent - Authorization for Use and/or Disclosure
HIPAA requires participants to consent for the collection, use, and/or disclosure of PHI for research. The HIPAA language template below includes University specific language which must be included in the Confidentiality Section of the Informed Consent form in order to comply with HIPAA requirements.
HIPAA language template (To be inserted into consent forms)
Waiver of Authorization
Reviews Preparatory to Research
Certain activities involving the use/disclosure of PHI are permitted without Authorization. The “preparatory to research” provision allows researchers to use PHI for limited purposes, such as a feasibility assessment (e.g., whether a sufficient population exists to conduct research). However, the Privacy Rule does not permit the researcher to remove PHI. To comply with HIPAA Privacy Rule and human subjects regulations, researchers are permitted to review PHI, but identifiers may not be recorded. To conduct a review preparatory to research, a researcher must certify all of the following representations:
- The use or disclosure is requested solely to review PHI as necessary to develop a research protocol or for similar purposes preparatory to research
- PHI will not be removed in the course of review
- The PHI for which use or access is requested is necessary for the research
INVESTIGATOR’S ACCESS PREPARATORY TO RESEARCH
Research Involving Deceased Individuals
The Privacy Rule provides protections to living and deceased individuals. To use decedents’ PHI for research purposes, a researcher must certify all of the following:
- Representation that the use or disclosure is solely for research involving the PHI of decedents (e.g., and not also the living relatives of decedents)
- Representation that the PHI is necessary for the research
- Documentation (at the request of the covered entity holding the PHI) of the death of the individuals whose PHI is sought.
Note: If the participant population contains both living and deceased individuals, the requirements for Authorization (or waiver or alteration) apply.
RESEARCH INVOLVING DECEASED INDIVIDUALS
Releasing data outside of the USA HIPAA Covered Entities
Intentional releases of research data outside USA must be made clear in the research study documents submitted for IRB approval. Such releases should be described within the authorization portion of the informed consent. Upon IRB approval, then such releases are permitted. Disclosures for studies involving de-identified information of a limited data set are also permitted.
For additional information, please contact the Office of Research Compliance and Integrity at (251) 460-6625 or email dlayton@southalabama.edu
External Resources and Guidance
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.
The Protection of Pupil Rights Amendment (PPRA) is a federal law that sets forth additional requirements in elementary and/or secondary public schools when certain activities are conducted (e.g., survey, analysis, physical examinations) or if funded by the Department of Education (e.g., survey, analysis, or evaluation).
International Compilation of Human Research Protections (OHRP) - listing laws, regulations, and guidelines on human subjects research in over 100 countries and standards from international and regional organizations.