> **OFFICE OF RESEARCH OVERSIGHT**
>
> **Research Privacy Assessment Checklist\***
>
> **July 20, 2007**

+----------------------------+---+---+---+-----------------+--------------+
| **A. INSTITUTIONAL REVIEW  | * | * | * | > **Regulations | **Notes**    |
| BOARD (IRB)**              | * | * | * | > & Policies**  |              |
|                            | Y | N | N |                 |              |
|                            | e | o | / |                 |              |
|                            | s | * | A |                 |              |
|                            | * | * | * |                 |              |
|                            | * |   | * |                 |              |
+============================+===+===+===+=================+==============+
| 1\. Researchers are        |   |   |   | Memo from       |              |
| familiar with and abide by |   |   |   | DUSHOM & CRADO  |              |
| existing policies,         |   |   |   | on 06/12/06     |              |
| procedures, and directives |   |   |   | *"Research      |              |
| regarding the protection   |   |   |   | R               |              |
| of human subjects in       |   |   |   | esponsibilities |              |
| research and the use and   |   |   |   | for Protecting  |              |
| disclosure of              |   |   |   | Sensitive       |              |
| individually-identifiable  |   |   |   | Information"*   |              |
| information as outlined in |   |   |   |                 |              |
| VHA Handbook 1200.5, VA IT |   |   |   |                 |              |
| Directive 06-2, VHA        |   |   |   |                 |              |
| Handbook 1605.1, and VA    |   |   |   |                 |              |
| Directive 6504 (also see D |   |   |   |                 |              |
| & E).                      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 2\. Adequate provisions    |   |   |   | VHA Handbook    |              |
| are in place to protect    |   |   |   | 1200.5, 7.a.(7) |              |
| the privacy of subjects    |   |   |   |                 |              |
| and to maintain the        |   |   |   |                 |              |
| confidentiality of         |   |   |   |                 |              |
| individually-identifiable  |   |   |   |                 |              |
| data.                      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 3\. Institutional Review   |   |   |   | VHA Handbook    |              |
| Board (IRB) has            |   |   |   | 1200.5,         |              |
| established written        |   |   |   | 7.d.(12)        |              |
| procedures that accurately |   |   |   |                 |              |
| reflect the requirements   |   |   |   | VHA Handbook    |              |
| for reporting to the       |   |   |   | 1605.1, 13.     |              |
| Privacy Officer (PO) any   |   |   |   |                 |              |
| unauthorized use, loss, or |   |   |   | VA Directive    |              |
| disclosure of              |   |   |   | 6504, 2.s.      |              |
| individually-identifiable  |   |   |   |                 |              |
| patient information.       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 4\. IRB has established    |   |   |   | VHA Handbook    |              |
| written procedures that    |   |   |   | 1200.5,         |              |
| accurately reflect the     |   |   |   | 7.d.(13)        |              |
| requirements for reporting |   |   |   |                 |              |
| violations of VA           |   |   |   |                 |              |
| information security       |   |   |   |                 |              |
| requirements to the        |   |   |   |                 |              |
| appropriate VHA            |   |   |   |                 |              |
| Information Security       |   |   |   |                 |              |
| Officer (ISO).             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 5\. Obtaining and using    |   |   |   | VHA Handbook    |              |
| medical, technical, and    |   |   |   | 1200.5, 13.b.   |              |
| administrative records     |   |   |   |                 |              |
| from other VA facilities   |   |   |   | VHA Handbook    |              |
| or VA databases (national, |   |   |   | 1605.1          |              |
| regional, or subject       |   |   |   |                 |              |
| specific) for R&D purposes |   |   |   |                 |              |
| are in compliance with all |   |   |   |                 |              |
| VA and other Federal       |   |   |   |                 |              |
| regulations including the  |   |   |   |                 |              |
| Standards for Privacy of   |   |   |   |                 |              |
| Individually-Identifiable  |   |   |   |                 |              |
| Health Information (45 CFR |   |   |   |                 |              |
| Parts 160 and 164).        |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \**See also ORO Research   |   |   |   |                 |              |
| Data Security Assessment   |   |   |   |                 |              |
| Checklist (2/23/07).*      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 6\. Obtaining and          |   |   |   | VHA Handbook    |              |
| disclosing                 |   |   |   | 1200.5, 7.a.(7) |              |
| individually-identifiable  |   |   |   | and 13.b.       |              |
| patient records are in     |   |   |   |                 |              |
| compliance with all        |   |   |   |                 |              |
| applicable confidentiality |   |   |   |                 |              |
| statues and regulations    |   |   |   |                 |              |
| including those discussed  |   |   |   |                 |              |
| in subparagraph 7.a.(7)    |   |   |   |                 |              |
| and 13.b. of VHA Handbook  |   |   |   |                 |              |
| 1200.5.                    |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 7\. Persons not employed   |   |   |   | VHA Handbook    |              |
| by VA are given access to  |   |   |   | 1200.5, 13.c.   |              |
| medical and other VA       |   |   |   |                 |              |
| records for R&D purposes   |   |   |   | VHA Handbook    |              |
| [only]{.underline} within  |   |   |   | 1605.1, 13.b.   |              |
| the legal restrictions     |   |   |   |                 |              |
| imposed by such laws as    |   |   |   |                 |              |
| the Privacy Act of 1974;   |   |   |   |                 |              |
| 38 USC §5701, §5705,       |   |   |   |                 |              |
| §7332; and VHA Handbook    |   |   |   |                 |              |
| 1605.1, 13.b.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 8\. Access to medical and  |   |   |   | VHA Handbook    |              |
| other VA records for R&D   |   |   |   | 1200.5, 13.c.   |              |
| purposes by persons not    |   |   |   |                 |              |
| employed by VA is approved |   |   |   |                 |              |
| by CRADO (also see C3).    |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 9\. The IRB expedited      |   |   |   | VHA Handbook    |              |
| review process is not used |   |   |   | 1200.5,         |              |
| when identification of the |   |   |   | Appendix B,     |              |
| subjects and/or their      |   |   |   | 1.b.            |              |
| responses would reasonably |   |   |   |                 |              |
| place them at risk of      |   |   |   |                 |              |
| criminal or civil          |   |   |   |                 |              |
| liability; or be damaging  |   |   |   |                 |              |
| to the subject's financial |   |   |   |                 |              |
| standing, employability,   |   |   |   |                 |              |
| insurability, and/or       |   |   |   |                 |              |
| reputation; or be          |   |   |   |                 |              |
| stigmatizing, unless       |   |   |   |                 |              |
| reasonable and appropriate |   |   |   |                 |              |
| protections are            |   |   |   |                 |              |
| implemented so that risks  |   |   |   |                 |              |
| related to invasion of     |   |   |   |                 |              |
| privacy and breach of      |   |   |   |                 |              |
| confidentiality are        |   |   |   |                 |              |
| minimal.                   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 10\. When a facility       |   |   |   | 38 CFR 16,      |              |
| policy allows use of 38    |   |   |   | 101.(b)(2) &    |              |
| CFR 16 exemptions, those   |   |   |   | (3)             |              |
| in 38 CFR 16.101(b)(2) and |   |   |   |                 |              |
| (3) are used               |   |   |   | VHA Handbook    |              |
| appropriately.             |   |   |   | 1200.5, 4.b.    |              |
|                            |   |   |   | and             |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | Appendix C,     |              |
|                            |   |   |   | 2.c. and 2.d.   |              |
+----------------------------+---+---+---+-----------------+--------------+
| 11\. IRB records document  |   |   |   | 38 CFR          |              |
| specific determinations    |   |   |   | 16.116(d)(1)    |              |
| regarding waiver of        |   |   |   |                 |              |
| informed consent or        |   |   |   | VHA Handbook    |              |
| alteration of the elements |   |   |   | 1200.5,         |              |
| of informed consent,       |   |   |   | Appendix C,     |              |
| including:                 |   |   |   | 2.d.(2)(a)      |              |
|                            |   |   |   |                 |              |
| \(a\) Study specific       |   |   |   |                 |              |
| information to show that   |   |   |   |                 |              |
| the research involves no   |   |   |   |                 |              |
| more than minimal risk.    |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(b\) Study specific       |   |   |   | 38 CFR          |              |
| information to show that   |   |   |   | 16.116(d)(2)    |              |
| the waiver or alteration   |   |   |   |                 |              |
| will not adversely affect  |   |   |   | VHA Handbook    |              |
| the rights and welfare of  |   |   |   | 1200.5,         |              |
| the subjects.              |   |   |   | Appendix C,     |              |
|                            |   |   |   | 2.d.(2)(b)      |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(c\) Study specific       |   |   |   | 38 CFR          |              |
| information to show that   |   |   |   | 16.116(d)(3)    |              |
| the research could not     |   |   |   |                 |              |
| practicably be carried out |   |   |   | VHA Handbook    |              |
| without the waiver.        |   |   |   | 1200.5,         |              |
|                            |   |   |   | Appendix C,     |              |
|                            |   |   |   | 2.d.(2)(c)      |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(d\) Study specific       |   |   |   | 38 CFR          |              |
| information to show that,  |   |   |   | 16.116(d)(4)    |              |
| whenever appropriate, the  |   |   |   |                 |              |
| subjects will be provided  |   |   |   | VHA Handbook    |              |
| with additional pertinent  |   |   |   | 1200.5,         |              |
| information after          |   |   |   | Appendix C,     |              |
| participation.             |   |   |   | 2.d.(2)(d)      |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 12\. When identifiable   |   |   |   | 38 CFR          |              |
| > information must be      |   |   |   | 16.116(d)       |              |
| > reviewed and recorded    |   |   |   |                 |              |
| > prior to informed        |   |   |   | VHA Handbook    |              |
| > consent, the IRB has     |   |   |   | 1200.5,         |              |
| > granted a waiver of      |   |   |   | Appendix C,     |              |
| > informed consent.        |   |   |   | 2.c.(2)         |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 13\. IRB records         |   |   |   | 38 CFR          |              |
| > document specific        |   |   |   | 16.117(c)(1)    |              |
| > determinations regarding |   |   |   |                 |              |
| > waiver of DOCUMENTATION  |   |   |   | VHA Handbook    |              |
| > OF INFORMED CONSENT,     |   |   |   | 1200.5,         |              |
| > including:               |   |   |   | Appendix C,     |              |
| >                          |   |   |   | 2.f.(1)(a)      |              |
| > \(a\) Study specific     |   |   |   |                 |              |
| > information to show that |   |   |   |                 |              |
| > the only record linking  |   |   |   |                 |              |
| > the subject and the      |   |   |   |                 |              |
| > research would be the    |   |   |   |                 |              |
| > consent document and the |   |   |   |                 |              |
| > principal risk would be  |   |   |   |                 |              |
| > potential harm from a    |   |   |   |                 |              |
| > breach of                |   |   |   |                 |              |
| > confidentiality; OR      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| > \(b\) Study specific     |   |   |   | 38 CFR          |              |
| > information to show that |   |   |   | 16.117(c)(1)    |              |
| > the research presents no |   |   |   |                 |              |
| > more than minimal risk   |   |   |   | VHA Handbook    |              |
| > of harm to subjects and  |   |   |   | 1200.5,         |              |
| > involves no procedures   |   |   |   | Appendix C,     |              |
| > for which written        |   |   |   | 2.f.(1)(b)      |              |
| > consent is normally      |   |   |   |                 |              |
| > required outside of the  |   |   |   |                 |              |
| > research context.        |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 14\. IRB records         |   |   |   | 45 CFR          |              |
| > document specific        |   |   |   | 164.512(i)(2)   |              |
| > determinations regarding |   |   |   |                 |              |
| > waiver or alteration of  |   |   |   | VHA Handbook    |              |
| > HIPAA AUTHORIZATION,     |   |   |   | 1200.5,         |              |
| > including:               |   |   |   |                 |              |
| >                          |   |   |   | Appendix E, 2.  |              |
| > \(a\) The findings on    |   |   |   |                 |              |
| > which the IRB's decision |   |   |   |                 |              |
| > is based.                |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(b\) Identification of    |   |   |   | SAME AS ABOVE:  |              |
| the IRB.                   |   |   |   |                 |              |
|                            |   |   |   | 45 CFR 164.512  |              |
|                            |   |   |   | (i)(2)          |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1200.5,         |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | Appendix E, 2.  |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(c\) Date of IRB approval |   |   |   |                 |              |
| of waiver of               |   |   |   |                 |              |
| authorization.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(d\) Statement that the   |   |   |   |                 |              |
| alteration or waiver of    |   |   |   |                 |              |
| authorization satisfies    |   |   |   |                 |              |
| the following criteria:    |   |   |   |                 |              |
|                            |   |   |   |                 |              |
| > \(i\) The use or         |   |   |   |                 |              |
| > disclosure involves no   |   |   |   |                 |              |
| > more than a minimal risk |   |   |   |                 |              |
| > to individuals' privacy  |   |   |   |                 |              |
| > based, at least, on an   |   |   |   |                 |              |
| > adequate:                |   |   |   |                 |              |
|                            |   |   |   |                 |              |
| Plan to protect            |   |   |   |                 |              |
| identifiers from improper  |   |   |   |                 |              |
| use or disclosure.         |   |   |   |                 |              |
|                            |   |   |   |                 |              |
| Plan to destroy the        |   |   |   |                 |              |
| identifiers at the         |   |   |   |                 |              |
| earliest opportunity       |   |   |   |                 |              |
| consistent with the        |   |   |   |                 |              |
| research, unless there is  |   |   |   |                 |              |
| a health or research       |   |   |   |                 |              |
| justification for          |   |   |   |                 |              |
| retaining the identifiers, |   |   |   |                 |              |
| or for other research for  |   |   |   |                 |              |
| which the use or           |   |   |   |                 |              |
| disclosure of the          |   |   |   |                 |              |
| requested information      |   |   |   |                 |              |
| would be permitted by the  |   |   |   |                 |              |
| Privacy Rule.              |   |   |   |                 |              |
|                            |   |   |   |                 |              |
| Written assurance that the |   |   |   |                 |              |
| requested information will |   |   |   |                 |              |
| not be reused or disclosed |   |   |   |                 |              |
| to any other person or     |   |   |   |                 |              |
| entity, except as required |   |   |   |                 |              |
| by law, for authorized     |   |   |   |                 |              |
| oversight of the research  |   |   |   |                 |              |
| study, or for other        |   |   |   |                 |              |
| research for which the use |   |   |   |                 |              |
| or disclosure of the       |   |   |   |                 |              |
| information would be       |   |   |   |                 |              |
| permitted by the Privacy   |   |   |   |                 |              |
| Rule.                      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(ii\) The research could  |   |   |   |                 |              |
| not practicably be         |   |   |   |                 |              |
| conducted without the      |   |   |   |                 |              |
| waiver or alteration.      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(iii\) The research could |   |   |   |                 |              |
| not practicably be         |   |   |   |                 |              |
| conducted without access   |   |   |   |                 |              |
| to and use of the          |   |   |   |                 |              |
| requested information.     |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(e\) A brief description  |   |   |   |                 |              |
| of the Protected Health    |   |   |   |                 |              |
| Information (PHI) for      |   |   |   |                 |              |
| which the IRB has          |   |   |   |                 |              |
| determined use or          |   |   |   |                 |              |
| disclosure to be           |   |   |   |                 |              |
| necessary.                 |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(f\) Identification of    |   |   |   |                 |              |
| the review procedure used  |   |   |   |                 |              |
| to approve the waiver of   |   |   |   |                 |              |
| authorization (full        |   |   |   |                 |              |
| committee or expedited).   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(g\) Signatures of the    |   |   |   | SAME AS ABOVE:  |              |
| Chair of the IRB, or       |   |   |   |                 |              |
| member designated by the   |   |   |   | 45 CFR 164.512  |              |
| Chair, to approve the      |   |   |   | (i)(2)          |              |
| waiver of authorization    |   |   |   |                 |              |
|                            |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1200.5,         |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | Appendix E, 2.  |              |
+----------------------------+---+---+---+-----------------+--------------+
| 15\. Human biological      |   |   |   | VHA Directive   |              |
| specimens, as well as the  |   |   |   | 2000-043:       |              |
| linked clinical data       |   |   |   | Banking of      |              |
| collected as part of       |   |   |   | Human Research  |              |
| research projects          |   |   |   | Subjects'       |              |
| conducted by VA            |   |   |   | Specimens       |              |
| investigators in VA        |   |   |   | (11/6/00)       |              |
| facilities or approved     |   |   |   |                 |              |
| off-site locations are     |   |   |   |                 |              |
| maintained at VA-approved  |   |   |   |                 |              |
| tissue banks.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+

+----------------------------+---+---+---+-----------------+--------------+
| **B. INFORMED CONSENT      | * | * | * | > **Regulation  | **Notes**    |
| INCLUDES:**                | * | * | * | > & Policies**  |              |
|                            | Y | N | N |                 |              |
|                            | e | o | / |                 |              |
|                            | s | * | A |                 |              |
|                            | * | * | * |                 |              |
|                            | * |   | * |                 |              |
+============================+===+===+===+=================+==============+
| > 1\. Use of VA Form       |   |   |   | VHA Handbook    |              |
| > 10-1086, VA Informed     |   |   |   | 1200.5,         |              |
| > Consent Document (either |   |   |   | 7.a.(4)(a) &    |              |
| > paper or electronic).    |   |   |   | Appendix C,     |              |
|                            |   |   |   | 1.d.            |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 2\. Description of       |   |   |   | 38 CFR 16.116   |              |
| > reasonably foreseeable   |   |   |   | (a)(2)          |              |
| > risks or discomforts to  |   |   |   |                 |              |
| > the subject including    |   |   |   | 21 CFR 50.25    |              |
| > for example, privacy     |   |   |   | (a)(2)          |              |
| > risks (legal, employment |   |   |   |                 |              |
| > and social).             |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1200.5,         |              |
|                            |   |   |   | Appendix C,     |              |
|                            |   |   |   | 2.a.(7)         |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 3\. A statement          |   |   |   | 38 CFR 16.116   |              |
| > describing the extent,   |   |   |   | (a)(5)          |              |
| > if any, to which         |   |   |   |                 |              |
| > confidentiality of       |   |   |   | 21 CFR 50.25    |              |
| > records identifying the  |   |   |   | (a)(5)          |              |
| > subject will be          |   |   |   |                 |              |
| > maintained.              |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1200.5,         |              |
|                            |   |   |   | Appendix C,     |              |
|                            |   |   |   | 2.a.(10)        |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 4\. For FDA-regulated    |   |   |   | 21 CFR 50.25    |              |
| > research, a statement    |   |   |   | (a)(5)          |              |
| > that the FDA may inspect |   |   |   |                 |              |
| > the records that include |   |   |   | VHA Handbook    |              |
| > a subject's individual   |   |   |   | 1200.5,         |              |
| > medical record.          |   |   |   | Appendix C,     |              |
|                            |   |   |   | 2.a.(10)        |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 5\. When applicable, a   |   |   |   | VHA Handbook    |              |
| > statement that other     |   |   |   | 1200.5,         |              |
| > entities, such as the    |   |   |   | Appendix C,     |              |
| > ORO, OHRP, or GAO may    |   |   |   | 2.a. (10)       |              |
| > inspect the records.     |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+

+----------------------------+---+---+---+-----------------+--------------+
| > **C. HIPAA PRIVACY RULE  | * | * | * | > **Regulation  | **Notes**    |
| > AND OTHER VA PRIVACY     | * | * | * | > & Policies**  |              |
| > REGULATIONS/POLICIES**   | Y | N | N |                 |              |
|                            | e | o | / |                 |              |
|                            | s | * | A |                 |              |
|                            | * | * | * |                 |              |
|                            | * |   | * |                 |              |
+============================+===+===+===+=================+==============+
| 1\. Activity "preparatory  |   |   |   | VHA Handbook    |              |
| to research": Information  |   |   |   | 1605.1,         |              |
| used for preparation of    |   |   |   | 13.a.(1)        |              |
| research proposals is      |   |   |   |                 |              |
| recorded without           |   |   |   |                 |              |
| identifiers and not used   |   |   |   |                 |              |
| to recruit subjects.       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 2\. VHA investigators      |   |   |   | VHA Handbook    |              |
| obtain written             |   |   |   | 1605.1,         |              |
| authorization or a waiver  |   |   |   | 13.a.(2)(b)     |              |
| of authorization           |   |   |   |                 |              |
| requirement from IRB for   |   |   |   |                 |              |
| using VHA                  |   |   |   |                 |              |
| individually-identifiable  |   |   |   |                 |              |
| health information         |   |   |   |                 |              |
| involving non-employee     |   |   |   |                 |              |
| research subjects for      |   |   |   |                 |              |
| research purposes. When    |   |   |   |                 |              |
| PHI must be reviewed or    |   |   |   |                 |              |
| recorded prior to          |   |   |   |                 |              |
| obtaining authorization    |   |   |   |                 |              |
| from the subject, the IRB  |   |   |   |                 |              |
| (Privacy Board) has        |   |   |   |                 |              |
| granted a waiver of        |   |   |   |                 |              |
| authorization.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 3\. Disclosure of          |   |   |   | VHA Handbook    |              |
| individually-identifiable  |   |   |   | 1605.1, 13.b.   |              |
| information to non-VHA     |   |   |   |                 |              |
| investigators for research |   |   |   |                 |              |
| purposes is approved by    |   |   |   |                 |              |
| CRADO.                     |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 4\. Written authorization  |   |   |   | VHA Handbook    |              |
| is obtained for disclosing |   |   |   | 1605.1,         |              |
| VHA                        |   |   |   | 13.b.(1)(a)     |              |
| individually-identifiable  |   |   |   |                 |              |
| health information         |   |   |   |                 |              |
| involving non-employee     |   |   |   |                 |              |
| research subjects by VHA   |   |   |   |                 |              |
| investigators to non-VHA   |   |   |   |                 |              |
| investigators for research |   |   |   |                 |              |
| purposes.                  |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 5\. Without prior written  |   |   |   | VHA Handbook    |              |
| authorization, disclosure  |   |   |   | 1605.1,         |              |
| of                         |   |   |   | 13.b.(1)(b)     |              |
| individually-identifiable  |   |   |   |                 |              |
| health information,        |   |   |   |                 |              |
| excluding 38 USC           |   |   |   |                 |              |
| §7332-protected            |   |   |   |                 |              |
| information, to Federal    |   |   |   |                 |              |
| investigators is made only |   |   |   |                 |              |
| when the Under Secretary   |   |   |   |                 |              |
| for Health or designee has |   |   |   |                 |              |
| approved the research and  |   |   |   |                 |              |
| an IRB or Privacy Board    |   |   |   |                 |              |
| has waived the             |   |   |   |                 |              |
| authorization requirement. |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 6\. Without prior written  |   |   |   | VHA Handbook    |              |
| authorization, disclosure  |   |   |   | 1605.1,         |              |
| of                         |   |   |   | 13.b.(1)(c)     |              |
| individually-identifiable  |   |   |   |                 |              |
| health information,        |   |   |   |                 |              |
| excluding 38 USC           |   |   |   |                 |              |
| §7332-protected            |   |   |   |                 |              |
| information and names and  |   |   |   |                 |              |
| addresses of the           |   |   |   |                 |              |
| individual subjects, to    |   |   |   |                 |              |
| non-Federal investigators  |   |   |   |                 |              |
| is made only when approval |   |   |   |                 |              |
| by the Under Secretary for |   |   |   |                 |              |
| Health or designee and     |   |   |   |                 |              |
| waiver of authorization    |   |   |   |                 |              |
| requirement by IRB or      |   |   |   |                 |              |
| Privacy Board are          |   |   |   |                 |              |
| obtained.                  |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 7\. Title 38 USC           |   |   |   | VHA Handbook    |              |
| §7332-protected            |   |   |   | 1605.1,         |              |
| information is disclosed   |   |   |   | 13.b.(1)(d)     |              |
| without written            |   |   |   |                 |              |
| authorization only when    |   |   |   |                 |              |
| conditions listed in VHA   |   |   |   |                 |              |
| Handbook 1605.1,           |   |   |   |                 |              |
| 13.b.(1)(d) are met.       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 8\. The                    |   |   |   | VHA Handbook    |              |
| individually-identifiable  |   |   |   | 1605.1,         |              |
| information of research    |   |   |   | 13.b.(2)(a)     |              |
| subjects in their capacity |   |   |   |                 |              |
| as VHA employees,          |   |   |   |                 |              |
| excluding health           |   |   |   |                 |              |
| information, is disclosed  |   |   |   |                 |              |
| to non-VHA Investigators   |   |   |   |                 |              |
| for research purposes      |   |   |   |                 |              |
| without written            |   |   |   |                 |              |
| authorization only in      |   |   |   |                 |              |
| accordance with the        |   |   |   |                 |              |
| Privacy Act and applicable |   |   |   |                 |              |
| VA privacy policy.         |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 9\. VHA investigators use  |   |   |   | VHA Handbook    |              |
| the requested data only in |   |   |   | 1605.1,         |              |
| a manner consistent with   |   |   |   | 13.a.(2)(d)     |              |
| the approved research      |   |   |   |                 |              |
| protocol for which the     |   |   |   |                 |              |
| information was requested. |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+

+----------------------------+---+---+---+-----------------+--------------+
| **D. HIPAA PRIVACY RULE    | * | * | * | > **Regulation  | **Notes**    |
| AUTHORIZATION IS WRITTEN   | * | * | * | > & Policies**  |              |
| IN PLAIN LANGUAGE &        | Y | N | N |                 |              |
| INCLUDES:**                | e | o | / |                 |              |
|                            | s | * | A |                 |              |
|                            | * | * | * |                 |              |
|                            | * |   | * |                 |              |
+============================+===+===+===+=================+==============+
| 1\. The identity of the    |   |   |   | 45 CFR Part     |              |
| individual to whom the     |   |   |   | 164.508(c)      |              |
| information pertains       |   |   |   |                 |              |
| (i.e., name and social     |   |   |   | VHA Handbook    |              |
| security number).          |   |   |   | 1200.5,         |              |
|                            |   |   |   | 7.a.(4)(b)      |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1605.1, 14.b.   |              |
+----------------------------+---+---+---+-----------------+--------------+
| 2\. A description of the   |   |   |   | SAME AS ABOVE:  |              |
| information to be used or  |   |   |   |                 |              |
| disclosed that identifies  |   |   |   | 45 CFR Part     |              |
| the information in a       |   |   |   | 164.508(c)      |              |
| specific and meaningful    |   |   |   |                 |              |
| fashion. If HIV, sickle    |   |   |   | VHA Handbook    |              |
| cell anemia, drug and/or   |   |   |   | 1200.5,         |              |
| alcohol abuse treatment    |   |   |   | 7.a.(4)(b)      |              |
| information is to be       |   |   |   |                 |              |
| disclosed this information |   |   |   | VHA Handbook    |              |
| must be specifically       |   |   |   | 1605.1, 14.b.   |              |
| identified in the          |   |   |   |                 |              |
| description.               |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 3\. The name or other      |   |   |   |                 |              |
| specific identification of |   |   |   |                 |              |
| the person(s), class of    |   |   |   |                 |              |
| persons, or office         |   |   |   |                 |              |
| designation(s) authorized  |   |   |   |                 |              |
| to make the requested use  |   |   |   |                 |              |
| or disclosure.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 4\. The name or other      |   |   |   |                 |              |
| specific identification of |   |   |   |                 |              |
| the person(s), class of    |   |   |   |                 |              |
| persons, or office         |   |   |   |                 |              |
| designation(s) to whom the |   |   |   |                 |              |
| agency may make the        |   |   |   |                 |              |
| requested use or           |   |   |   |                 |              |
| disclosure.                |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 5\. A description of each  |   |   |   |                 |              |
| purpose of the requested   |   |   |   |                 |              |
| use or disclosure. The     |   |   |   |                 |              |
| statement "at the request  |   |   |   |                 |              |
| of the individual" is      |   |   |   |                 |              |
| sufficient when an         |   |   |   |                 |              |
| individual initiates the   |   |   |   |                 |              |
| authorization and does     |   |   |   |                 |              |
| not, or elects not to,     |   |   |   |                 |              |
| provide a statement of the |   |   |   |                 |              |
| purpose.                   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 6\. An expiration date or  |   |   |   |                 |              |
| event that relates to the  |   |   |   |                 |              |
| individual or the purpose  |   |   |   |                 |              |
| of the use or disclosure.  |   |   |   |                 |              |
| Examples of appropriate    |   |   |   |                 |              |
| expiration date language   |   |   |   |                 |              |
| are as follows:            |   |   |   |                 |              |
|                            |   |   |   |                 |              |
| \(a\) The statement "end   |   |   |   |                 |              |
| of the research study" or  |   |   |   |                 |              |
| similar language is        |   |   |   |                 |              |
| sufficient if the          |   |   |   |                 |              |
| authorization is for use   |   |   |   |                 |              |
| or disclosure of           |   |   |   |                 |              |
| individually-identifiable  |   |   |   |                 |              |
| health information for     |   |   |   |                 |              |
| research.                  |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| \(b\) The statement "none" |   |   |   |                 |              |
| or similar language is     |   |   |   |                 |              |
| sufficient if the          |   |   |   |                 |              |
| authorization is for the   |   |   |   |                 |              |
| agency to use or disclose  |   |   |   |                 |              |
| individually-identifiable  |   |   |   |                 |              |
| health information,        |   |   |   |                 |              |
| including for the creation |   |   |   |                 |              |
| and maintenance of a       |   |   |   |                 |              |
| research database or       |   |   |   |                 |              |
| research repository.       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 7\. The signature of the   |   |   |   | SAME AS ABOVE:  |              |
| individual, or someone     |   |   |   |                 |              |
| with the authority to act  |   |   |   | 45 CFR Part     |              |
| on behalf of the           |   |   |   | 164.508(c)      |              |
| individual, and date       |   |   |   |                 |              |
| signed.                    |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1200.5,         |              |
|                            |   |   |   | 7.a.(4)(b)      |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1605.1, 14.b.   |              |
+----------------------------+---+---+---+-----------------+--------------+
| 8\. A statement that the   |   |   |   |                 |              |
| individual has the right   |   |   |   |                 |              |
| to revoke the              |   |   |   |                 |              |
| authorization in writing   |   |   |   |                 |              |
| except to the extent that  |   |   |   |                 |              |
| VHA has already acted in   |   |   |   |                 |              |
| reliance on it, and a      |   |   |   |                 |              |
| description of how the     |   |   |   |                 |              |
| individual may revoke the  |   |   |   |                 |              |
| authorization (e.g., to    |   |   |   |                 |              |
| whom the revocation is     |   |   |   |                 |              |
| provided). For a use or    |   |   |   |                 |              |
| disclosure of individually |   |   |   |                 |              |
| identifiable health        |   |   |   |                 |              |
| information related to     |   |   |   |                 |              |
| research the statement     |   |   |   |                 |              |
| "end of the research       |   |   |   |                 |              |
| study," "none," or similar |   |   |   |                 |              |
| language is sufficient.    |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 9\. A statement that VHA   |   |   |   |                 |              |
| may not condition          |   |   |   |                 |              |
| treatment, payment,        |   |   |   |                 |              |
| enrollment, or eligibility |   |   |   |                 |              |
| for benefits based on the  |   |   |   |                 |              |
| individual completing an   |   |   |   |                 |              |
| authorization.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 10\. A statement that      |   |   |   |                 |              |
| individually identifiable  |   |   |   |                 |              |
| health information         |   |   |   |                 |              |
| disclosed pursuant to the  |   |   |   |                 |              |
| authorization may no       |   |   |   |                 |              |
| longer be protected by     |   |   |   |                 |              |
| Federal laws or            |   |   |   |                 |              |
| regulations and may be     |   |   |   |                 |              |
| subject to re-disclosure   |   |   |   |                 |              |
| by the recipient.          |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+

+----------------------------+---+---+---+-----------------+--------------+
| **E. OTHER**               | * | * | * | > **Regulation  | **Notes**    |
|                            | * | * | * | > & Policies**  |              |
|                            | Y | N | N |                 |              |
|                            | e | o | / |                 |              |
|                            | s | * | A |                 |              |
|                            | * | * | * |                 |              |
|                            | * |   | * |                 |              |
+============================+===+===+===+=================+==============+
| > 1\. Training: All VHA    |   |   |   | VHA Handbook    |              |
| > research personnel       |   |   |   | 1200.5, 35.(1)  |              |
| > including employees,     |   |   |   |                 |              |
| > volunteers, and students |   |   |   | ORD website, VA |              |
| > are trained at least     |   |   |   | Research Data   |              |
| > annually, on privacy     |   |   |   | Security        |              |
| > policies to include the  |   |   |   |                 |              |
| > requirements of Federal  |   |   |   |                 |              |
| > privacy and information  |   |   |   |                 |              |
| > laws, regulations, and   |   |   |   |                 |              |
| > VHA policies. New        |   |   |   |                 |              |
| > personnel are trained    |   |   |   |                 |              |
| > within 30 days of        |   |   |   |                 |              |
| > employment. At a         |   |   |   |                 |              |
| > minimum, instruction     |   |   |   |                 |              |
| > must be provided within  |   |   |   |                 |              |
| > 6 months of a            |   |   |   |                 |              |
| > significant change in    |   |   |   |                 |              |
| > Federal laws,            |   |   |   |                 |              |
| > regulations, VHA privacy |   |   |   |                 |              |
| > policy, and facility or  |   |   |   |                 |              |
| > office procedures. All   |   |   |   |                 |              |
| > training is documented.  |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 2\. IRB decides whether  |   |   |   | VHA Handbook    |              |
| > or not to flag CPRS.     |   |   |   | 1200.5,         |              |
|                            |   |   |   | Appendix C,     |              |
|                            |   |   |   | 3.c.            |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 3\. Surrogate consent is |   |   |   | VHA Handbook    |              |
| > obtained from the        |   |   |   | 1200.5, 11.     |              |
| > appropriate legally      |   |   |   |                 |              |
| > authorized               |   |   |   |                 |              |
| > representative.          |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 4\. All media are        |   |   |   | VA Directive    |              |
| > appropriately destroyed  |   |   |   | 6504            |              |
| > after information is no  |   |   |   |                 |              |
| > longer to be retained.   |   |   |   | VA Handbook     |              |
|                            |   |   |   | 6500,           |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | 6.b.(4)(b)[16.  |              |
|                            |   |   |   | b.]{.underline} |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1931.1, 4.a.(5) |              |
+----------------------------+---+---+---+-----------------+--------------+
| > 5\. Employees,           |   |   |   | VHA Handbook    |              |
| > contractors, volunteers, |   |   |   | 6500,           |              |
| > students, and others     |   |   |   |                 |              |
| > protect information      |   |   |   | 6.b.(4)(b)[14.f |              |
| > contained on printouts   |   |   |   | .]{.underline}, |              |
| > and other media by       |   |   |   |                 |              |
| > keeping VA sensitive     |   |   |   | 6.b.(4)(b)[14.k |              |
| > information in locked    |   |   |   | .]{.underline}, |              |
| > files or cabinets when   |   |   |   |                 |              |
| > not in use, and dispose  |   |   |   | and             |              |
| > of VA sensitive          |   |   |   | 6.b.(4)(b)[16.  |              |
| > information through      |   |   |   | b.]{.underline} |              |
| > shredding or other       |   |   |   |                 |              |
| > approved disposal        |   |   |   |                 |              |
| > methods.                 |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+

**Acronyms are found in Appendix A.**

**Notes:**

1.  The notice to the veteran about an incident involving personal
    information should include the following elements:

```{=html}
<!-- -->
```
(1) A brief description of what happened;

(2) To the extent possible, a description of the types of personal
    information that were involved in the incident (e.g., full name,
    SSN, date of birth, home address, account number, disability code,
    etc.);

(3) A brief description of what the agency is doing to investigate the
    breach, to mitigate losses, and to protect against any further
    breaches;

(4) Contact procedures for those wishing to ask questions or learn
    additional information, including a toll-free telephone number,
    website, and/or postal address; and

(5) Steps individuals should take to protect themselves from the risk of
    identity theft, including steps to take advantage of Equifax credit
    protection and contact information for the Federal Trade Commission
    (FTC) website and publications.

```{=html}
<!-- -->
```
2.  Employees must use only computers and electronic storage media
    configured to conform with all VA security and configuration
    policies to store, transport, transmit, use and access VAPI.

```{=html}
<!-- -->
```
(1) Required for both VAGFE and OE:

    a.  VA employees must use passwords that meet VA password
        requirements.

    b.  The "save password" feature must not be used for passwords that
        provide access to the operating system or VA network services

    c.  "Blank" and default user names and passwords must not be used

    d.  User credentials including passwords are considered VA sensitive
        information and must be protected appropriately

    e.  A shared file or drive containing VAPI must not be created on a
        device used for remote computing. File sharing of VAPI must only
        be accomplished through the use of authorized VA servers.

    f.  VAPI or VA-specific software must be segregated in dedicated
        directories that are protected

    g.  If VAPI such as Protected Health Information (PHI), privacy
        information, or information that could be used by unauthorized
        persons to gain access to VA systems is to be stored outside of
        the VA intranet or outside of the physical protection of VA
        facilities, it must be protected. (See the *Data Handling*
        section for details if needed)

(2) Required for VAGFE and for OE used to access or process PHI or other
    VAPI.

    a.  Password-protected screensavers must be configured to activate
        after five minutes of inactivity.

    b.  The screen saver must be activated manually when the workstation
        is unattended.

    c.  Anti-virus software must be installed and operational.

    d.  All devices must conform to operating system hardening
        guidelines as specified in VA Information Security guidance.

```{=html}
<!-- -->
```
3.  Title 38 U.S.C. 7332-protected information may be disclosed without
    written authorization. The research protocol must indicate:

```{=html}
<!-- -->
```
(1) The information must be maintained in accordance with the security
    requirements of 38 CFR Section 1.466, or more stringent
    requirements;

(2) The information will not be re-disclosed except back to VA; and

(3) The information will not identify any individual patient in any
    report of the research, or otherwise disclose patient identities.

**ACRONYMS**

  ------------- ---------------------------------------------------------
  AV            Antivirus

  CRADO         Chief Research and Development Officer

  CFR           Code of Federal Regulations

  CPRS          Computerized Patient Record System

  DUSHOM        Deputy Under Secretary for Health for Operations &
                Management

  FDA           Food and Drug Administration

  FTC           Federal Trade Commission

  GAO           Government Accountability Office

  HIPAA         Health Insurance Portability and Accountability Act of
                1996

  IRB           Institutional Review Board

  ISO           Information Security Officer

  IT            Information Technology

  HIV           Human Immunodeficiency Virus

  OE            Other Equipment

  OHRP          Office for Human Research Protections

  ORO           Office of Research Oversight

  PHI           Protected Health Information

  PO            Privacy Officer

  R&D           Research and Development

  SSN           Social Security Number

  USC           United States Code

  VAGFE         VA-owned Government Furnished Equipment

  VAPI          VA Protected Information

  VHA           Veterans Health Administration
  ------------- ---------------------------------------------------------