IRB Review of Stand-Alone HIPAA Authorizations Under FDA Regulations Guidance for Industry August 2003

GUIDANCE DOCUMENT

• Docket Number: FDA-2003-D-0037
• Issued by: Office of the Commissioner

This guidance provides the current recommendations of the Food and Drug Administration (FDA) concerning Institutional Review Boards’  (IRB) review and approval under 21 C.F.R. Part 56 of stand-alone authorizations that are created by covered entities (or by third parties), pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, and that are provided to research subjects prior to enrolling in clinical investigations after April 14, 2003, to obtain their permission to use and/or disclose their health information for research. A stand-alone HIPAA authorization (for research) is a document that is used to obtain permission from an individual for a covered entity to use and/or disclose the individual’s identifiable health information for a research study, and that is not combined with an informed consent document to participate in the research study itself. The Privacy Rule refers to a HIPAA authorization that has been combined with an informed consent document as a “compound authorization.”  IRBs would be required to review the HIPAA authorization in a “compound authorization”  because IRBs are required, with certain exceptions, to review and approve informed consent documents. See 21 C.F.R. Part 56.

---

Submit Comments

Submit Comments Online

You can submit online or written comments on any guidance at any time (see 21 CFR 10.115(g)(5))

If unable to submit comments online, please mail written comments to:

Dockets Management
Food and Drug Administration
5630 Fishers Lane, Rm 1061
Rockville, MD 20852

All written comments should be identified with this document's docket number: FDA-2003-D-0037.