**VHA POLICY IS MORE RESTRICTIVE THAN NIH GUIDANCE**

**REGARDING RECRUITMENT OF STUDY SUBJECTS**

**UNDER THE HIPAA PRIVACY RULE**

**Under VHA Policy, accessing patient records for recruitment into
research requires prior Institutional Review Board (IRB) approval, IRB
waiver of HIPAA Privacy Rule Authorization, IRB waiver of informed
consent, and Research and Development (R&D) Committee approval. These
steps are required even when records of one's own patients are accessed
for recruitment purposes.**

In the VA, identifying prospective subjects as part of recruitment into
a research protocol is not considered part of the activities
"preparatory to research" described in the HIPAA Privacy Rule. (NOTE:
Activities preparatory to research would include, for example, reviewing
records to determine whether there is a sufficient number or type of
record or a sufficiently large pool of prospective subjects to conduct
the research. This activity takes place during the course of preparation
of the research protocol.)

**The Office of Research Oversight (ORO) has clarified with the Privacy
Office and the Office of Research and Development (ORD) that this is the
case. See below.**

**Q: Is the guidance the National Institutes of Health (NIH) provided on
recruitment of subjects under the Health Information Portability and
Accountability Act of 1996 consistent with VA requirements?**

**A. No, not entirely.**

-   NIH Guidance at
    [http://privacyruleandresearch.nih.gov_research.asp](http://privacyruleandresearch.nih.gov_research.asp/)
    on *Contacting Research Participants* permits members of a covered
    entity's workforce (or a covered entity's business associates) to
    *contact potential study participants* for recruitment into
    research*.*

```{=html}
<!-- -->
```
-   **VA does not permit this practice unless** an IRB has
    specifically (i) waived the requirement for an authorization under
    the HIPAA Privacy Rule relative to use or disclosure of Protected
    Health Information (PHI) to recruit subjects for the proposed
    research **and** (ii) waived the informed consent requirement under
    the Common Rule to allow use of identifiable private information for
    recruitment into the research. The R&D Committee must also approve
    the research.

**Q. What is the practice that is expected in the VA? Can the
physician/PI use his/her patients' records to recruit research subjects
without a waiver of authorization? Can the physician/PI's research
coordinator or another person be given permission by the physician/PI to
use patient records for recruiting research subjects without a waiver of
authorization? Isn't this permitted as an "activity preparatory to
research"?**

**A. Again, VA policy is more restrictive than the NIH Guidance
regarding research recruitment activities and "activities preparatory to
research."**

Since recruitment is a part of a research protocol, recruitment cannot
occur until after the IRB has approved the protocol, VA does not
consider recruitment to be an "activity preparatory to research." If PHI
is needed for recruiting, then IRB and R&D Committee review and approval
must have been obtained, and the IRB must have also approved an
appropriate waiver of authorization and waiver of informed consent
before PHI may be obtained and used for recruitment. It does not matter
if the PI or his/her agent is obtaining information from his/her own
patients' records or not. VHA requirements are stricter in this regard
than NIH guidance. The following references are important:

***VHA Handbook 1605.1: Privacy and Release of Information:***

***13. Research***

> *a. **Release of Information (ROI) to VHA Investigators
> (Intramural**). ...*
>
> *(1) **Reviews Preparatory to Research** ...*
>
> *(b) Neither written authorization from the research subject nor an
> Institutional review board (IRB) or Privacy board waiver of
> authorization is required for a VHA Investigator to conduct a review
> of individually-identifiable information in preparation of a research
> protocol (See 45CFR164.512(i)(1)).*
>
> ***NOTE: The contacting of potential research subjects or conducting
> pilot studies are not activities Preparatory to research.*** \[Bolding
> supplied.\]
>
> *(2) VHA-Approved Research...*
>
> *(b) All VHA Investigators conducting VHA-approved research must
> obtain the authority to use individually-identifiable information as
> follows: ...*
>
> *[2.]{.underline} If there is no prior written authorization, VHA
> individually-identifiable health information involving non-employee
> research subjects may be used by a VHA Investigator for research
> purposes when there is an IRB or Privacy Board waiver of authorization
> in accordance with 45CFR164.512(i)**.***
>
> Updated 09.05.07