Waiver of HIPAA Authorization

Protocol Title:	Developing HIV prevention strategies to engage adolescent MSM and transgender youth
IRBNet Number:	919387-1
Protocol Version/Date:	V1.0 08-17-16
Principal Investigator:	Sean Cahill, PhD
Co-Investigators:	Kerith Conron, ScD, MPH and Holly Fontenot, PhD, RN, WHNP-BC
Study Coordinator	Sophia Geffen
Sponsor:	CDC Division of Adolescent and School Health, National Opinion Resource Center

In compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Fenway Community Health requires an “Authorization for the Use and Disclosure of Protected Health Information (PHI)” for most research conducted at Fenway Community Health. This authorization is included in the informed consent template. HIPAA allows for some exceptions, when a Waiver of HIPAA Authorization is permissible. Such waivers must be approved by the Fenway Institutional Review Board.

The use of PHI to recruit an individual to participate in a research study must comply with HIPAA's general requirement that the use must be pursuant to an authorization or some exception, such as a Waiver of HIPAA Authorization. Recruitment procedures usually require access to a limited amount of health information. A Waiver of HIPAA Authorization for recruitment purposes only is referred to as a Partial HIPAA Waiver. Partial HIPAA Waivers must be approved by the Fenway IRB.

All patients at Fenway Community Health are given a Notice of Privacy Practices at their first visit to the health center. The Notice of Privacy Practices informs patients that their protected health information may be used for research if and when the Fenway IRB reviews and approves the research.

An investigator may apply to the IRB for the following:

Waiver of HIPAA Authorization (Complete Sections A and B)

Partial HIPAA Waiver for Recruitment (Complete Sections A and C)

SECTION A: Description of Protected Health Information

1. Describe the particular types of protected health information which will be accessed? Please be specific and the list the specific type of information you are seeking to access with this waiver (i.e. date of birth, CD4 count, diagnosis of depression, demographics, insurance status, gender, billing information). Please note: The types of protected health information specified will be given to the Fenway data team and will determine the protected health information which may be accessed with this waiver.

During screening, we will collect the following PHI: age, gender identity, sex, sexual behavior, and other demographics.

2. How will this protected health information be obtained? Please be specific and include the source of the protected health information (i.e. electronic medical records, medical registry, reports generated from the electronic medical records, billing/payment database, etc.)

Screener information will be collected via paper screeners and online screeners and entered into a password protected database. In some instances we may conduct the screener over the phone. All collected information is based on self-report.

3. Please describe the purpose or reason for why the protected health information is being accessed?

This information is being accessed as part of recruitment and retention purposes for the study. This information will determine the participant’s eligibility for the study, as well as allow study staff to stay in contact with the participant to confirm one time participation.

Screening data will be linked to a screening ID and participant name for three reasons:

1. To verify that those who complete the screening survey on the phone are in fact eligible before being scheduled for a one time study visit (focus group) and being enrolled in the study

2. To reconcile any discrepancies between participants screened and enrolled (e.g., this will allow us to verify enrollment records against screening records). If, for example, we have more participants enrolled in a given week than screened, we will know that there were individuals enrolled who were not properly screened. We will be able to identify which participants were not properly screened because we will have identifiable screening data.

3. To evaluate and tailor recruitment efforts. Having identifiable participant data will also allow us to follow-up with potential participants who may become eligible to participate should eligibility criteria change.

Since screening to determine eligibility is typically performed prior to any physical contact with potential participants, it is difficult and often impossible to obtain HIPAA authorization. Under the HIPAA Privacy Rule and 45 CRF Part 46, we are seeking a HIPAA authorization and informed consent from each potential participant screened when the data collected are identifiable. This is in accordance with Fenway SOP pre-screening of research participants during recruitment (SOP#: IRB-002) and SOP for obtaining partial HIPAA waiver for recruitment (SOP #: IRB-003).

4. Please specify the requested data range you are interested in accessing protected health information. For example if you are interested in looking at insurance status from January- March 2010, the requested timeframe would be January 1, 2010- March 31, 2010. If you are interested in retroactively examining medications a participant was taking during the study, the requested timeframe would be from the participants’ enrollment through termination visit. If you are requested protected health information for recruitment purposes, the requested timeframe would be the study accrual period.

We are requesting to access PHI from January 2017 through September 2018.

SECTION B: Waiver of HIPAA Authorization

For a waiver of HIPAA authorization, the PHI being requested must fall into one of the three categories listed below. Please check off the applicable category, and be sure that all corresponding conditions will be met. Please detail how each condition is met for IRB review.

1. Research of PHI for the purpose of PREPARING for research

Please check and describe how all of the conditions below will be met:

Use or disclosure of PHI is sought solely for the purpose of protocol and/or research preparation; for example, to develop a hypothesis and/or protocol, or establish characteristics of a potential research cohort.

The PHI sought is necessary for the proposed research purpose.

The PHI will not be removed from the premises during review.

The researcher will only record information that has been de-identified.

2. Research of decedents’ PHI

Please check and describe how all of the conditions below will be met:

The PHI sought is of decedents.

The PHI sought is necessary for the research.

*Note, the IRB may request documentation of the death of the individuals about whom this information is being sought.

3. Research (data collection, analysis, and/or publication) of living participants’ PHI

Please check and describe how all of the below conditions are met:

The use or disclosure of PHI involves no more than minimal risk to the individuals whose PHI is being reviewed.

The alteration or waiver will not adversely affect the privacy rights and the welfare of the individuals.

The research could not be practicably conducted without the alteration or waiver.

The research could not be practicably conducted without access to, and use of, the PHI.

The privacy risks to individuals whose PHI is to be used or disclosed are reasonable in relation to both the anticipated benefits, if any, to the individuals; and the importance of the knowledge that may reasonably be expected to result from the research.

There is an adequate plan to protect the identifiers from improper use and unnecessary disclosure.

There is an adequate plan to destroy the identifiers at the earliest opportunity, consistent with conduct of the research; unless there is a health or research justification for

retaining the identifiers or such retention is otherwise required by law.

There are adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research, for which the use or disclosure of PHI would be permitted by this subpart.

SECTION C: Partial HIPAA Waiver for Recruitment

1. Will protection Information (PHI) be accessed during recruitment?

No

Yes (If the answer is yes, describe the plan for accounting for disclosures)

We will access the following during the screener: age, gender identity, sex, HIV status, sexual conduct, number of other sex partners, name (legal and/or preferred), phone number, email address.

Screener information will be collected via paper form and online form and entered into a password protected database. In some instances we may conduct the screener over the phone.

2. Describe the recruitment method, including the PHI source and specific items to be reviewed.

Active recruitment will be carried out by study staff. Participants will be recruited actively through InsideHeads, a marketing and research company, and at focus group sites (to be determined and described in a future amendment to the IRB.) Study staff will also visit local gathering spots of YMSM and transgender youth such as night clubs, events and public places, such as local parks, to identify and recruit potential participants. Participants will also be asked to refer friends or acquaintances that may be eligible. Passive approaches include the posting of study information via flyers, posters, and business cards describing the study on Facebook and in other media.

Participants who receive our recruitment materials and are interested in participating will contact study staff to be screened. All information collected will be self-reported.

3. Please document how the recruitment method meets the following four criteria:

1. The use of PHI for identifying eligibility and contacting potential subjects will not involve more than minimal risk to the individual’s privacy. (Specify who will have access to PHI and the plan for destroying PHI.)

This study presents no more than a minimal risk to participants. The probability and magnitude of harm resulting from participation are small. Further, participating in online/phone/in-person screening presents no more risk than events encountered in normal, daily activities.

Screening data and contact information will be stored separately within secure, HIPAA- compliant REDCap electronic databases on the Fenway server. Contact information and data will only be linked through the screening ID.

Only study staff will have access to the REDCap databases, which are password protected and highly secure. Any paper copies of screening data or contact information will be stored in locked cabinets, only accessible to study staff.

2. The partial waiver of authorization will not adversely affect the rights and welfare of the participants.

During screening, potential participants will be told about the study, informed of the nature and sensitivity of the questions, told how long the screening process is expected to take, and asked if they are interested and willing to answer screening questions to determine initial eligibility for the research study (verbal consent if over the phone to answer pre-screening questions). Potential participants will be informed that they are free to refuse to answer any questions or stop the screening at any point; however, it may not be possible to enroll in the study if initial eligibility cannot be assessed due to skipping questions.

Prior to screening, potential participants will also be informed that the researchers will maintain all screening data from potential participants, regardless of enrollment outcome and that this data will be stored separately from their contact information and linked via a screening ID. Participants will also be informed that data collected from the screeners will be used for research purposes only and the collected PHI will remain confidential.

By providing this information to potential participants prior to screening, the potential participant will be able to opt out of screening should they not be comfortable with this use of screening data.

We do not foresee any adverse affect to the rights and welfare of participants in this process.

3. Recruitment cannot be practicably carried out without the partial waiver of authorization.

The costs and time associated with requesting an in-person written HIPAA authorization would be prohibitive, as well as a deterrent to potential participants, who might object to a preliminary visit to determine eligibility. Further, linking screening information with participant ID allows us to reconcile any discrepancies between participants screened and enrolled as well as follow-up with ineligible individuals should eligibility criteria change at a later date. This recruitment strategy is central to the success of the study's enrollment.

4. Recruitment cannot practicably be conducted without the participant’s PHI.

Access to the PHI will allow us to identify eligible individuals. Only necessary PHI and identifying information will be collected during recruitment and eligibility screening. This recruitment strategy is central to the success of the study's enrollment.

IRB Waiver of HIPPA Authorization

Last Revised 07/21/2015

5