UTMB HANDBOOK OF OPERATING PROCEDURES

Section 3 Compliance Policies Subject 6.2 Privacy Related Policy 6.2.30 Use & Disclosure of PHI for Research

04/11/03- Originated 10/08/07 - Reviewed w changes - Reviewed w/o changes Compliance Office - Author

Use and Disclosure of PHI for Research

Definitions

Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form or medium, including oral, written, and electronic communications. Individually identifiable health information relates to an individual’s health status or condition, furnishing health services to an individual or paying or administering health care benefits to an individual. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual Use: The sharing, employment, application, utilization, examination, or analysis of such information within the UTMB system. Disclosure: The release, transfer, provision of access to, or divulging in any other manner of information outside of the UTMB system. Institutional Review Board (IRB): A committee group comprised of UTMB personnel and community representatives with varying backgrounds and professional experience that review and approve the research protocol involving human subjects. De-identification: Health information that does not identify an individual in any manner with no reasonable basis to believe that the information can be used to identify the individual. See IHOP Policy 6.2.29, De-identification of PHI. Limited Data Set: A limited amount of Protected Health Information (PHI) that may be used and disclosed for research, public health or health care operations. This limited amount of PHI may be shared with another entity only after both parties have executed a data use agreement. See IHOP Policy 6.2.13, Use and Disclosure of PHI for Limited Data Set.

Definitions (cont’d)	Research: A systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities that meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program that is considered research for other purposes. For example, some demonstration and service programs may include research activities.
Policy	UTMB, in an effort to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), maintains that patient information must be kept private and confidential. UTMB protects the confidentiality and integrity of PHI as required by law, professional ethics, and accreditation requirements. The use and disclosure of PHI in research must have the appropriate authorizations and safeguards in place. The UTMB IRB review process shall make all determinations regarding the applicable federal and state privacy standards as applied to the use and disclosure of PHI for research. As a result, all personnel must strictly observe the following standards relating to the use and disclosure of PHI for research and abide by the Institutional Review Board Policies and Procedures Manual. Violation of this policy may result in disciplinary action up to and including termination for employees; a termination of employment relationship in the case of contractors or consultants; or suspension or expulsion in the case of a student. Additionally, individuals may be subject to loss of access privileges and civil and/or criminal prosecution.
IRB Approval of Research	In order to provide for the adequate discharge of institutional responsibility, no research activity involving human subjects may be undertaken by any faculty, staff, employee or student at UTMB or affiliated entities (e.g. Shriners Burns Hospital), unless a UTMB IRB has reviewed and approved the research prior to commencing the research activity. See the Institutional Review Board Policies and Procedures Manual for a more detailed explanation of the process and requirements related to the IRB.

Use of De-Identified Information and Limited Data Sets

Whenever possible, de-identified PHI should be used. De-identified PHI is rendered anonymous when identifying characteristics are completely removed. De-identified PHI may only be used and disclosed in accordance with IHOP Policy 6.2.29 De-Identification of PHI. If PHI can not be de-identified the next step should be to use a limited data set in accordance with IHOP Policy 6.2.13, Use and Disclosure of PHI for Limited Data Sets. Only when both de-identified PHI and a limited data set are inadequate can PHI be used for research.

References

45 C.F.R. §164.512(e) 45 C.F.R. §164.512(i) Texas Health & Safety Code §181.102