☰ ATSU Navigation
If a researcher is using Protected Health Information from a non-ATSU site, please know he/she has the following options to address the Privacy Rule (HIPAA) in research. https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html (Note: Some sites have policies that require a data use agreement, regardless of identifiability of the human data.)
EXAMPLES:
1. Design options for the site not to be "engaged" in the research, i.e. the site personnel is not a member of the research team and may not need their IRB approval (this is always up to the site's IRB to determine, since they can mandate more than regulations require).
For example:
"Method: De-identified data from charts from XXX Company will be query data for the following criteria: __________________. The site will give the de-identified data to the student for research purposes in order to conduct the analyses."
2. IRBs: The site gets their IRB's Exempt or Non-Exempt study approval for the authorization to share and use the data for research as long as they meet the criteria. Then, the student gets ATSU IRB concurring IRB approval. This ensures the regulating body of the data holder reviewed the HIPAA parameters for collaborative research outside their institution. This requires the non-ATSU researcher to disclose ATSU's role on the research team and use of that institution's data in their IRB application.
3. DSAs: The site ensures all patients provided prospective HIPAA authorization for use of their data in future research. Then the site writes up a short data-sharing agreement with the student researcher (example: https://ura.uchicago.edu/page/data-sharing-agreements), which the student sends with the ATSU IRB submission. In this case, ATSU IRB would not likely need further regulatory documentation to prove HIPAA compliance for research data sharing.