Partial Waiver of HIPAA Authorization

A waiver of HIPAA authorization is a regulatory determination that is made by the board. Under 45 CFR 164.512(i)(1)(i), an IRB of a covered entity can waive in full or in part the individual authorization required by HIPAA for use and disclosure of protected health information for research purposes.

In order for a research study to qualify for a waiver, the board must document that the use and disclosure of protected health information involves no more than minimal risk to the privacy of individuals based on evidence that the study has:

• An adequate plan to protect identifiers from improper use and disclosure
• An adequate plan to destroy the identifiers at the earliest opportunity
• Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity

In order to grant a waiver, the board must also determine and document that:

• the research could not practicably be conducted without a waiver
• the research could not practicably be conducted without access to protected health information

The board or IRB Chair can determine that a study qualifies for a partial waiver or a full waiver. The IRB can grant a partial waiver to allow for limited information to be collected from the medical record. For example, a partial waiver must be granted in order to collect eligibility information about potential subjects from the medical record such as whether a person or persons have a specific disease. One situation in which the IRB might grant a full waiver is for a medical record review study that has a waiver of consent.