Guidance for Industry 

IRB Review of Stand-Alone 

HIPAA Authorizations 

Under FDA Regulations 

FINAL GUIDANCE 

This guidance is being distributed for immediate implementation. 

FDA is issuing this guidance for immediate implementation in accordance with 21 CFR 

10.115(g)(3) without seeking prior comment because the agency has determined that 

prior public participation would not be feasible or appropriate. FDA made this 

determination because, without this guidance, some IRBs might halt enrollment in 

ongoing clinical investigations to review stand-alone HIPAA authorizations so as to 

comply with their written procedures. FDA invites comments on this document. Please 

submit comments to Dockets Management Branch (HFA-305), Food and Drug 

Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852. You should 

identify all comments with the docket number listed in the notice of availability that 

published in the Federal Register. FDA will review any comments we receive and revise 

the guidance document when appropriate. 

U.S. Department of Health and Human Services 

Food and Drug Administration 

Office of the Commissioner 

October 21,2003 
Guidance for Industry 

IRB Review of Stand-Alone 

HIPAA Authorizations 

Under FDA Regulations 

Additional copies of this guidance are available from the Internet at http://www.fda.gov/, 

or by writing to Dockets Management Branch (HFA-305), Food and Drug 

Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852. Requests should 

be identified with the docket number found in the Notice of Availability for this 

document published in the Federal Register. For questions, contact the Office of Policy, 

Office of the Commissioner at (301) 827-3360. 

U.S. Department of Health and Human Services 

Food and Drug Administration 

Office of the Commissioner 

August 16,2003 
Guidance for Industry 

IRB Review of Stand-Alone HIPAA Authorizations Under 

FDA Regulations 

This guidance document represents the agency’s current thinking on this topic. It does not create 

or confer any rights for or on any person and does not operate to bind FDA or the public. You 

can use an alternative approach if the approach satisfies the requirements of the applicable 

statutes and regulations. 

I. INTRODUCTION 

This guidance provides the current recommendations of the Food and 

Drug Administration (FDA) concerning Institutional Review Boards’ (IRB) review 

and approval under 2 1 C.F.R. Part 56 of stand-alone authorizations that are 

created by covered entities (or by third parties), pursuant to the Health 

Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, and 

that are provided to research subjects prior to enrolling in clinical investigations 

after April 14, 2003, to obtain their permission to use and/or disclose their 

health information for research. A stand-alone HIPAA authorization (for 

research) is a document that is used to obtain permission from an individual for 

a covered entity to use and/or disclose the individual’s identifiable health 

information for a research study, and that is not combined with an informed 

consent document to participate in the research study itself. The Privacy Rule 

refers to a HIPAA authorization that has been combined with an informed 

consent document as a “compound authorization.” IRBs would be required to 

review the HIPAA authorization in a “compound authorization” because IRBs 

3 
are required, with certain exceptions, to review and approve informed consent 

documents. See 21 C.F.R. Part 56. 

Because issues addressed in this Level 1 guidance require immediate 

resolution, it is not feasible or appropriate for FDA to seek comments before 

implementing it. See 2 1 C.F.R. @j 10.115(g)(2) and 10.115(g)(3). This guidance 

is intended to encourage IRBs to permit the enrollment of subjects in clinical 

investigations without prior IRB review and/or approval of stand-alone HIPAA 

authorizations, since such review and/or approval is not required by the HIPAA 

Privacy Rule. 

II. BACKGROUND 

To improve the efficiency and effectiveness of the health care system, 

Congress passed the Health Insurance Portability and Accountability Act of 

1996 (HIPAA), Public Law 104- 19 1, which included “Administrative 

Simplification” provisions that required, among other things, the Department of 

Health and Human Services (HHS) to adopt national standards for certain 

electronic health care transactions. At the same time, Congress recognized that 

advances in electronic technology could erode the privacy of health information. 

Consequently, Congress incorporated, into HIPS, provisions that mandated 

the adoption of Federal privacy protections for certain individually identifiable 

health information. 

In response to the HIPS mandate, HHS published a final regulation, 

“Standards for Privacy of Individually Identifiable Health Information,” generally 

known as the Privacy Rule, in December 2000. HHS subsequently amended 

the Privacy Rule on August 14, 2002. See 45 C.F.R. Part 160 and Part 164, 

4 
Subparts A and E. This Privacy Rule sets minimum national standards for the 

protection of certain individually identifiable health information. The Privacy 

Rule, however, applies only to three types of entities, known as covered entities: 

health plans, health care clearinghouses, and health care providers who 

transmit health information in electronic form in connection with a transaction 

for which HHS has adopted a standard. As of April 14, 2003 (April 14, 2004, 

for small health plans), covered entities have been required to comply with the 

standards to protect and guard against the misuse and improper disclosure of 

individually identifiable health information. Failure to comply with these 

standards may, under certain circumstances, trigger the imposition of civil or 

criminal penalties. For a more complete description of the Privacy Rule, see 

www.hhs.gov/ocr/hipaa. 

Health care providers who transmit health information electronically in 

connection with a transaction for which HHS has adopted a standard, such as 

most hospitals, are covered entities. In addition, clinical investigators who are 

health care providers but do not transmit health information in electronic form 

in connection with a transaction for which HHS has adopted a standard, but 

who are nonetheless part of the covered entities‘ workforce, must comply with 

the Privacy Rule in their work at or for the covered entity - unless they are 

workforce members of hybrid entities, and they are not part of the designated 

health care component. See 45 C.F.R. 164.105. Lastly, clinical investigators or 

other researchers who are not in either of the above categories are not covered 

by the Privacy Rule, but they should be aware of the Rule and its restrictions on 

the use and disclosure of protected health information. 

5 
Most IRBs are not covered entities under the Privacy Rule because they 

do not meet the Privacy Rule’s definitions of health plan, health care 

clearinghouse, or health care provider who transmits any health information in 

electronic form in connection with a transaction for which HHS has adopted a 

standard. See 45 C.F.R. 160.103. However, Irks interact with clinical 

investigators who might be, or who are employed by or are otherwise part of the 

workforce of covered entities under the Privacy Rule. In addition, IRBs may 

review research in which individually identifiable health information will be 

obtained from covered entities, and therefore, they need to understand how the 

Privacy Rule interacts with Federal informed consent requirements, including 

FDA human subjects protection regulations and regulations on institutional 

review boards (see 21 C.F.R. Parts 50 and 56). 

The Privacy Rule provides that, unless the use or disclosure is otherwise 

permitted or required by the rule, the use or disclosure of the protected health 

information of an individual, such as a research subject, is permitted only if the 

individual signs an authorization for the use or disclosure. See 45 C.F.R. 

164.508. For example, in the context of a clinical investigation conducted by a 

covered entity, a valid and properly executed HIPAA authorization is a 

permission from the subject for the covered entity to use and/or disclose the 

subject’s protected health information for the clinical investigation. A HIPAA 

authorization is different than a subject’s informed consent. A HIPAA 

authorization, when executed, is the subject’s permission for his/her 

identifiable health information to be used and/or disclosed for a research 

purpose. An informed consent document, on the other hand, apprises potential 

research subjects of the possible risks and benefits associated with 

6 
participating in the clinical investigation and, when executed, indicates their 

willingness to participate. The Privacy Rule permits, but does not require, 

clinical investigators to combine a HIPAA authorization with informed consent 

documents; this combined form is known as a compound authorization under 

the Privacy Rule. See 45 C.F.R. 164.508(b)(3). 

III. DISCUSSION 

Prior to the April 14th, 2003 Privacy Rule compliance date, FDA and the 

Office for Civil Rights (OCR), which are both components of HHS, received 

requests for clarification of IRBs’ responsibilities with respect to reviewing and 

approving stand-alone HIPAA authorizations under the Privacy Rule, Federal 

regulations governing human subjects protection and IRBs, including 21 C.F.R 

Parts 50 and 56, and international guidelines (see, for example, International 

Conference on Harmonisation (ICH) Good Clinical Practice: Consolidated 

Guidance (E6).’ These requests expressed concern that, after the Privacy Rule’s 

compliance date, clinical investigations might be impeded because IRBs could 

be backlogged with requests to review thousands of stand-alone HIPAA 

authorizations. The requests further stated that some IRBs would halt clinical 

investigation enrollment pending their review of these stand-alone HIPAA 

authorizations. 

On April 15, 2003, OCR issued guidance entitled, “Privacy Guidance 

about Authorizations for Research and Institutional Review Boards” (OCR 

’ The IHC Good Clinical Practice: Consolidated Guideline (E6) states, for example, 

“Before initiating a trial, the investigator/institution should have written and dated 

approval/favourable opinion from the IRB/IEC for the trial protocol, written informed 

consent form, consent form updates, subject recruitment procedures (e.g., 

advertisements), and any other written information to be provided to subjects.” 

7 
Guidance, available at www.hhs.gov/ocr/hipaa/privguideresearch.pdf) 

addressing these issues, OCR clarified that IRBs are not required to review and 

approve stand-alone HIPAA authorizations under the Privacy Rule or the HHS 

Human Subjects Protection Regulations at 45 C.F.R. Part 46. Furthermore, 

pursuant to FDA’s permission, OCR clarified that IRBs are not required to 

review stand-alone authorizations under the FDA regulations at 2 1 C.F.R. Part 

56, so long as an IRB’s written procedures, adopted pursuant to 2 1 C.F.R. 

56.108(a), do not require such review and approval. 

With FDA’s permission, OCR also addressed, in further detail, IRBs’ 

responsibilities under the ICH guideline entitled, “Good Clinical Practice: 

Consolidated Guideline” (1996), which some IRBs have misunderstood as 

requiring them to review all written materials provided to subjects, including 

stand-alone HIPAA authorizations. The OCR guidance clarified that the ICH 

guidelines are not legal requirements subject to enforcement by U.S. 

authorities. Furthermore, in adopting and publishing the ICH guideline, FDA’s 

“Good Clinical Practice: Consolidated Guideline” states, as is true of all 

guidance, that “[i]t does not create or confer any rights for or on any person and 

does not operate to bind FDA or the public. An alternative approach may be 

used if such approach satisfies the requirements of the applicable statutes, 

regulations, or both.” See 62 FR 25692, May 9, 1997. FDA is issuing this 

guidance to clarify that use of a stand-alone HIPAA authorization that an entity 

other than an IRB, such as an investigator or sponsor, has determined meets 

the requirements of FDA’s “Good Clinical Practice: Consolidated Guideline” 

would be an acceptable alternative, so long as it is permitted by the IRB’s 

(Emphasis added.) (See ICH E6 4.4.1.). 

8 
written procedures. Since the Privacy Rule does not require IRB review or 

approval of HIPAA stand-alone authorizations, the Privacy Rule would not affect 

the acceptability of this alternative. 

FDA regulations governing IRBs require, in pertinent part, that IRBs 

follow written procedures they have adopted for reviewing clinical research. See 

2 1 C.F.R. 56.108(a). Pursuant to this provision, IRBs that have written 

procedures requiring them to review all written materials provided to potential 

research subjects would have to review and approve stand-alone HIPAA 

authorizations, even though such review is not otherwise required under the 

Privacy Rule, FDA regulations governing IRBs, or international guidelines. 

Accordingly, if IRBs are backlogged in their review of stand-alone HIPAA 

authorizations, these IRBs might believe they have to halt enrollment in clinical 

investigations in order to complete their review in accordance with their written 

procedures.2 

In order to ensure the continued enrollment of subjects in clinical 

investigations, and to encourage IRB flexibility with respect to handling possible 

backlogs, FDA is announcing its intention to exercise ongoing enforcement 

discretion with respect to the requirements of 2 1 C.F.R. 56.108(a) to the extent 

that IRBs’ written procedures require the review and/or approval of standalone HIPAA authorizations because those written procedures require them to 

review all written materials provided to potential research subjects. FDA 

believes that enrollment in well-designed and well-conducted clinical 

investigations should not be interrupted for the purpose of IRB review and 

approval of stand-alone HIPAA authorizations. In exercising its enforcement 

9 
discretion, FDA does not intend to take enforcement actions against IRBs that 

decide not to review stand-alone HIPAA authorization even where an IRB’s 

written procedures would otherwise require this review and/or approval. FDA’s 

exercise of ongoing enforcement discretion with respect to 2 1 C.F.R. 56.108(a), 

along with OCR’s clarification that IRBs are not required to review and approve 

stand-alone HIPAA authorizations under the Privacy Rule, HHS Human Subject 

Protection Regulations, or international guidelines, should allow important 

studies to proceed in the best interest of the public health. 

’ Alternatively, IFWs could modify their written procedures to exclude a requirement for 

review and/or approval of stand-alone HIPAA authorizations. 

10