Appendix G: HIPAA's transition provisions exempting research where informed consent was obtained are not helpful

Inconsistency between the Common Rule and the Privacy Rule is also evident in the context of research that was ongoing at the time of HIPAA's compliance date, April 14, 2003, and that continued after the compliance date (e.g., research that "straddled" HIPAA's compliance date). HIPAA's transition Rules, which apply to research that straddled HIPAA's compliance date, "grandfather" certain research, exempting it from HIPAA's requirement for obtaining authorization from the subjects enrolled. Specifically, the transition Rules grandfather research for which an individual gave informed consent or other written permission to use his or her health information, or research that received IRB waiver of the Common Rule's informed consent requirements. One complication resulting from HIPAA's transition provisions relates to ongoing research that was previously determined to be exempt from the requirements of the Common Rule. Because researchers conducting exempt research would not have been required to seek informed consent from subjects or receive IRB waiver of the informed consent requirement, there is no basis for the research to qualify for grandfathering under HIPAA's transition provisions.

This additional discontinuity in HIPAA requirements has left most research institutions in the precarious position of needing to identify any exempt research that straddled HIPAA's compliance date and ensure that the investigators either obtain authorization from the enrolled subjects or obtain a waiver from the IRB or privacy board. This has been a daunting task, because many institutions do not routinely track exempt research, even if they have a process by which the IRB Chair confirms that the research meets the criteria for exemption.