Guidance for  Industry 
IRB  Review of Stand-Alone 
HIPAA  Authorizations 
Under FDA Regulations 
FINAL  GUIDANCE 
This guidance is being distributed  for immediate implementation. 
FDA is issuingt his guidancefo  r immediateim  plementationin  accordancwe ith 21 CFR 
10.115(g)(3w) ithout seekingp rior commenbt ecauseth e agencyh asd  eterminedth at 
prior public participationw  ould not be feasibleo r appropriate.F DA madet his 
determinationb ecausew, ithout this guidances, omeI RBs might halt enrollmenti n 
ongoingc linical investigationsto  reviews tand-aloneH IPAA authorizationss o ast o 
complyw  ith their written procedures.F DA invitesc  ommentso n this document.P  lease 
submitc ommentsto  DocketsM  anagemenBt ranch( HFA-305),F ooda  ndD  rug 
Administration,5 630F  ishersL ane,r m. 1061,R  ockville,M  D 20852. You should 
identify all commentsw ith the docketn umberl istedi n the noticeo  f availabilityt hat 
publishedi n the Federal Register. FDA will reviewa  ny commentsw e receivea ndr evise 
the guidanced ocumentw hena  ppropriate. 
U.S. Department  of Health  and  Human  Services 
Food  and  Drug  Administration 
Office  of the  Commissioner 
October  21,2003  Guidance for  Industry 
IRB  Review of Stand-Alone 
HIPAA  Authorizations 
Under FDA Regulations 
Additional copies of this guidance are available from the Internet at http://www.fda.gov/, 
or  by  writing  to  Dockets  Management  Branch  (HFA-305),  Food  and  Drug 
Administration,  5630 Fishers Lane, rm. 1061, Rockville, MD  20852.  Requests should 
be  identified  with  the  docket number found  in  the Notice  of  Availability  for  this 
document published in the Federal Register. For questions,c ontact the Office of Policy, 
Office of the Commissioner at (301) 827-3360. 
U.S. Department  of Health  and  Human  Services 
Food  and  Drug  Administration 
Office  of the  Commissioner 
August  16,2003  Guidance for  Industry 
IRB Review of Stand-Alone  HIPAA Authorizations  Under 
FDA Regulations 
This guidanced ocumenrte presenttsh e agencysc urrentt hinkingo  n this topic. It doesn ot create 
or confera nyr ightsf or or on anyp  ersona ndd oesn ot operateto  bind FDA or the public. You 
canu  sea n alternativea pproachif  the approachs atisfiesth e requirementosf  the applicable 
statutesa ndr egulations. 
I.  INTRODUCTION 
This guidance provides the current  recommendations  of the Food and 
Drug Administration  (FDA) concerning Institutional  Review Boards  (IRB) review 
and approval under  2 1 C.F.R. Part 56 of stand-alone  authorizations  that  are 
created by covered entities  (or by third  parties), pursuant  to the Health 
Insurance  Portability  and Accountability  Act of 1996 (HIPAA) Privacy Rule, and 
that  are provided to research subjects prior  to enrolling  in clinical  investigations 
after April  14, 2003, to obtain  their  permission  to use and/or  disclose their 
health  information  for research.  A stand-alone  HIPAA authorization  (for 
research) is a document  that  is used to obtain permission  from an individual  for 
a covered entity  to use and/or  disclose the individuals  identifiable  health 
information  for a research study,  and that  is not combined with  an informed 
consent document  to participate  in the research study itself.  The Privacy Rule 
refers to a HIPAA authorization  that  has been combined with  an informed 
consent document  as a compound  authorization.  IRBs would  be required  to 
review the HIPAA authorization  in a compound  authorization  because IRBs 
3  are required,  with  certain  exceptions, to review and approve informed  consent 
documents.  See 21 C.F.R. Part 56. 
Because issues addressed in this  Level 1 guidance require  immediate 
resolution,  it is not feasible or appropriate  for FDA to seek comments  before 
implementing  it.  See 2 1 C.F.R. @j 10.115(g)(2) and  10.115(g)(3).  This guidance 
is intended  to encourage IRBs to permit  the enrollment  of subjects in clinical 
investigations  without  prior  IRB review and/or  approval  of stand-alone  HIPAA 
authorizations,  since such review and/or  approval is not required  by the HIPAA 
Privacy Rule. 
II.  BACKGROUND 
To improve  the efficiency and effectiveness of the health  care system, 
Congress passed the Health  Insurance  Portability  and Accountability  Act of 
1996 (HIPAA), Public Law 104- 19 1, which  included  Administrative 
Simplification  provisions  that  required,  among other things,  the Department  of 
Health  and Human  Services (HHS) to adopt national  standards  for certain 
electronic  health  care transactions.  At the same time,  Congress recognized that 
advances in electronic  technology could erode the privacy  of health  information. 
Consequently,  Congress incorporated,  into  HIPS,  provisions  that  mandated 
the adoption  of Federal privacy protections  for certain  individually  identifiable 
health  information. 
In response to the HIPS  mandate,  HHS published  a final  regulation, 
Standards  for Privacy of Individually  Identifiable  Health Information,  generally 
known  as the Privacy Rule, in December 2000.  HHS subsequently  amended 
the Privacy Rule on August  14, 2002.  See 45 C.F.R. Part  160 and Part  164, 
4  Subparts  A and E.  This Privacy Rule sets minimum  national  standards  for the 
protection  of certain  individually  identifiable  health  information.  The Privacy 
Rule, however, applies only to three types of entities,  known  as covered entities: 
health  plans,  health  care clearinghouses,  and health  care providers  who 
transmit  health  information  in electronic  form in connection  with  a transaction 
for which  HHS has adopted a standard.  As of April  14, 2003  (April  14, 2004, 
for small  health  plans), covered entities  have been required  to comply with  the 
standards  to protect  and guard against the misuse and improper  disclosure  of 
individually  identifiable  health  information.  Failure  to comply with  these 
standards  may, under  certain  circumstances,  trigger the imposition  of civil  or 
criminal  penalties.  For a more complete description  of the Privacy Rule, see 
www.hhs.gov/ocr/hipaa. 
Health  care providers  who transmit  health  information  electronically  in 
connection  with  a transaction  for which  HHS has adopted a standard,  such as 
most hospitals,  are covered entities.  In addition,  clinical  investigators  who are 
health  care providers  but  do not transmit  health  information  in electronic  form 
in connection  with  a transaction  for which  HHS has adopted a standard,  but 
who are nonetheless  part  of the covered entities  workforce,  must  comply with 
the Privacy Rule in their  work  at or for the covered entity  - unless  they are 
workforce  members  of hybrid  entities,  and they are not part  of the designated 
health  care component.  See 45 C.F.R. 164.105.  Lastly,  clinical  investigators  or 
other researchers  who are not in either of the above categories are not covered 
by the Privacy Rule, but  they should  be aware of the Rule and its restrictions  on 
the use and disclosure  of protected health  information. 
5  Most IRBs are not  covered entities  under  the Privacy Rule because they 
do not meet the Privacy Rules definitions  of health  plan,  health  care 
clearinghouse,  or health  care provider who transmits  any health  information  in 
electronic  form in connection  with  a transaction  for which  HHS has adopted a 
standard.  See 45 C.F.R. 160.103.  However, Irks  interact  with  clinical 
investigators  who might  be, or who are employed by or are otherwise  part  of the 
workforce  of covered entities  under  the Privacy Rule.  In addition,  IRBs may 
review research in which  individually  identifiable  health  information  will  be 
obtained  from  covered entities,  and therefore, they need to understand  how the 
Privacy Rule interacts  with  Federal informed  consent requirements,  including 
FDA human  subjects  protection  regulations  and regulations  on institutional 
review  boards  (see 21 C.F.R. Parts 50 and 56). 
The Privacy Rule provides that,  unless the use or disclosure  is otherwise 
permitted  or required  by the rule,  the use or disclosure  of the protected  health 
information  of an individual,  such as a research subject,  is permitted  only if the 
individual  signs an authorization  for the use or disclosure.  See 45 C.F.R. 
164.508.  For example, in the context of a clinical  investigation  conducted  by a 
covered entity,  a valid  and properly  executed HIPAA authorization  is a 
permission  from the subject  for the covered entity  to use and/or  disclose the 
subjects  protected  health  information  for the clinical  investigation.  A HIPAA 
authorization  is different  than  a subjects  informed  consent.  A HIPAA 
authorization,  when executed, is the subjects permission  for his/her 
identifiable  health  information  to be used and/or  disclosed for a research 
purpose.  An informed  consent document,  on the other hand,  apprises potential 
research  subjects  of the possible risks  and benefits associated with 
6  participating  in the clinical  investigation  and, when executed, indicates  their 
willingness  to participate.  The Privacy Rule permits,  but  does not require, 
clinical  investigators  to combine a HIPAA authorization  with  informed  consent 
documents;  this  combined form is known  as a compound  authorization  under 
the Privacy Rule.  See 45 C.F.R. 164.508(b)(3). 
III.  DISCUSSION 
Prior to the April  14th, 2003 Privacy Rule compliance  date, FDA and the 
Office for Civil Rights  (OCR), which  are both  components  of HHS, received 
requests  for clarification  of IRBs  responsibilities  with  respect to reviewing  and 
approving  stand-alone  HIPAA authorizations  under  the Privacy Rule, Federal 
regulations  governing human  subjects protection  and IRBs, including  21 C.F.R 
Parts 50 and 56, and international  guidelines  (see, for example, International 
Conference on Harmonisation  (ICH) Good Clinical  Practice: Consolidated 
Guidance  (E6).  These requests expressed concern that,  after the Privacy Rules 
compliance  date, clinical  investigations  might  be impeded because IRBs could 
be backlogged with  requests to review thousands  of stand-alone  HIPAA 
authorizations.  The requests further  stated that  some IRBs would  halt  clinical 
investigation  enrollment  pending  their  review of these stand-alone  HIPAA 
authorizations. 
On April  15, 2003, OCR issued guidance entitled,  Privacy Guidance 
about  Authorizations  for Research and Institutional  Review Boards  (OCR 
  The IHC Good Clinical  Practice: Consolidated Guideline (E6) states, for example, 
Before initiating  a trial,  the investigator/institution  should have written  and dated 
approval/favourable  opinion from the IRB/IEC  for the trial protocol, written  informed 
consent form, consent form updates, subject recruitment  procedures (e.g., 
advertisements), and  any  other  written information  to be provided  to subjects. 
7  Guidance,  available  at www.hhs.gov/ocr/hipaa/privguideresearch.pdf) 
addressing  these issues,  OCR clarified  that  IRBs are not required  to review and 
approve stand-alone  HIPAA authorizations  under  the Privacy Rule or the HHS 
Human  Subjects Protection  Regulations  at 45 C.F.R. Part 46.  Furthermore, 
pursuant  to FDAs permission,  OCR clarified  that  IRBs are not required  to 
review stand-alone  authorizations  under  the FDA regulations  at 2 1 C.F.R. Part 
56, so long as an IRBs written  procedures,  adopted pursuant  to 2 1 C.F.R. 
56.108(a), do not require  such review and approval. 
With  FDAs permission,  OCR also addressed, in further  detail,  IRBs 
responsibilities  under  the ICH guideline  entitled,  Good Clinical  Practice: 
Consolidated  Guideline  (1996), which  some IRBs have misunderstood  as 
requiring  them  to review all written  materials  provided to subjects,  including 
stand-alone  HIPAA authorizations.  The OCR guidance clarified  that  the ICH 
guidelines  are not legal requirements  subject to enforcement  by U.S. 
authorities.  Furthermore,  in adopting  and publishing  the ICH guideline,  FDAs 
Good Clinical  Practice: Consolidated  Guideline  states, as is true  of all 
guidance,  that  [i]t  does not create or confer any rights  for or on any person and 
does not operate to bind  FDA or the public.  An alternative  approach may be 
used if such approach  satisfies the requirements  of the applicable  statutes, 
regulations,  or both.  See 62 FR 25692, May 9, 1997.  FDA is issuing  this 
guidance  to clarify  that  use of a stand-alone  HIPAA authorization  that  an entity 
other than  an IRB, such as an investigator  or sponsor, has determined  meets 
the requirements  of FDAs Good Clinical  Practice: Consolidated  Guideline 
would  be an acceptable alternative,  so long as it is permitted  by the IRBs 
(Emphasis added.) (SeeI CH E6 4.4.1.). 
8  written  procedures.  Since the Privacy Rule does not require  IRB review or 
approval  of HIPAA stand-alone  authorizations,  the Privacy Rule would  not affect 
the acceptability  of this  alternative. 
FDA regulations  governing IRBs require,  in pertinent  part,  that  IRBs 
follow written  procedures  they have adopted for reviewing clinical  research.  See 
2 1 C.F.R. 56.108(a).  Pursuant  to this  provision,  IRBs that  have written 
procedures  requiring  them to review all written  materials  provided  to potential 
research  subjects  would  have to review and approve stand-alone  HIPAA 
authorizations,  even though  such review is not otherwise required  under  the 
Privacy Rule, FDA regulations  governing IRBs, or international  guidelines. 
Accordingly,  if IRBs are backlogged in their  review of stand-alone  HIPAA 
authorizations,  these IRBs might  believe they have to halt  enrollment  in clinical 
investigations  in order to complete their  review in accordance with  their  written 
procedures.2 
In order to ensure the continued  enrollment  of subjects  in clinical 
investigations,  and to encourage IRB flexibility  with  respect to handling  possible 
backlogs,  FDA is announcing  its intention  to exercise ongoing enforcement 
discretion  with  respect to the requirements  of 2 1 C.F.R. 56.108(a) to the extent 
that  IRBs  written  procedures  require  the review and/or  approval  of  stand- 
alone HIPAA authorizations  because those written  procedures  require  them  to 
review all written  materials  provided to potential  research subjects.  FDA 
believes that  enrollment  in well-designed  and well-conducted  clinical 
investigations  should  not be interrupted  for the purpose of IRB review and 
approval  of stand-alone  HIPAA authorizations.  In exercising its enforcement 
9  discretion,  FDA does not intend  to take enforcement  actions against IRBs that 
decide not to review stand-alone  HIPAA authorization  even where an IRBs 
written  procedures  would  otherwise require  this  review and/or  approval.  FDAs 
exercise of ongoing enforcement  discretion  with  respect to 2 1 C.F.R. 56.108(a), 
along with  OCRs clarification  that  IRBs are not required  to review and approve 
stand-alone  HIPAA authorizations  under  the Privacy Rule, HHS Human  Subject 
Protection  Regulations,  or international  guidelines,  should  allow important 
studies  to proceed in the best interest  of the public  health. 
  Alternatively,  IFWs could modify their written  procedures to exclude a requirement for 
review and/or  approval of stand-alone HIPAA authorizations. 
10