If research subjects' consent was obtained before the compliance date, but the Institutional Review Board (IRB) subsequently modifies the informed consent document after the compliance date and requires that subjects be reconsented, is authorization now required from these previously enrolled research subjects under the HIPAA Privacy Rule?

Answer:

Yes. If informed consent or reconcent (ie., asked to sign a revised consent or another informed consent) is obtained from research subjects after the compliance date, the covered entity must obtain individual authorization as required at 45 CFR 164.508 for the use or disclosure of protected health information once the consent obtained before the compliance date is no longer valid for the research. The revised informed consent document may be combined with the authorization elements required by 45 CFR 164.508.

See Privacy Rule and Research and other frequently asked questions about research for more information about Institutional Review Boards and privacy.

Learn More:

• Can researchers continue to access existing databanks or repositories that are maintained by covered entities, even if those databases were created prior to the compliance date without patient permission or without a waiver of informed consent by an Institutional Review Board (IRB)?

• When is a researcher a covered health care provider under HIPAA?

• What does the HIPAA Privacy Rule say about a research participant's right of access to research records or results?

Date Created: 12/20/2002
Last Updated: 03/14/2006