JHSPH IRB Application for Disclosure of Johns Hopkins Medicine JHM PHI

From electronic medical/billing records via a JHU student SOM, SON, and/or SPH working under the direction of a credentialed JHHS workforce member and who have signed a HIPAA Workforce A

JHSPH IRB APPLICATION FOR DISCLOSURE OF JOHNS HOPKINS MEDICINE (JHM)

PROTECTED HEALTH INFORMATION (PHI) (based on JHSPH IRB Policy on Use of PHI in Research)

I JHM Protected Health Information for Living Participants (For Decedents, go to Section V)

1 Identify the specific JHM Covered Entity 1 and JHM Departments from which the PHI will be obtained: The Johns Hopkins Hospital The Johns Hopkins Bayview Medical Center

Howard County General Hospital JH Community Physicians

All Children’s Hospital JH Pharmaquip

JH Pediatrics at Home Priority Partners Managed Care Organization

JH University School of Medicine Johns Hopkins Employee Health Plans, e.g EHP

JH University School of Nursing JH Home Health Services

Other Hopkins Providers (specify):

List the specific JHM department(s) from which the PHI is sought:

2 Select the personal identifiers you seek to access/use in your research project.

Geographic information smaller than State,

including city, county, and zip code and their

equivalent geocodes, except for the initial three

digits of a zip code if, according to the current

publicly available data from the Bureau of the

Census:

(1) The geographic unit formed by combining

all zip codes with the same three initial digits

contains more than 20,000 people; and

(2) The initial three digits of a zip code for all

Vehicle identifiers and serial numbers, including license plate numbers

1 An updated list of Johns Hopkins Medicine covered entities may be found at:

http://intranet.insidehopkinsmedicine.org/privacy_office/about_hipaa/

1

fewer people is changed to 000.

All elements of dates except years (e.g., birth

date, admission date, date of death, age by year if

>89 years of age)

Device identifiers and serial numbers

prints

images

characteristic or code

3 Describe specifically the types of health information you will collect (e.g diagnosis, test results, treatments, etc.)

4 Identify how you will access the JHM PHI you want to use in your study Choose all that apply.

i Directly from the study participant with a signed JHSPH IRB Approved Consent/HIPAA Privacy

Authorization Form

What type of form do you plan to use?

a Combined consent/HIPAA authorization document

b Stand-alone Medical Records Release form with HIPAA authorization document

c Stand-alone HIPAA authorization document

ii From electronic medical/billing records via a credentialed JHHS Workforce Member

iii From electronic medical/billing records via a JHU student (SOM, SON, and/or SPH) working under

the direction of a credentialed JHHS workforce member and who have signed a HIPAA Workforce Agreement either for this study or as part of their patient care responsibilities

iv From electronic medical/billing records via JHU-employed research personnel (including faculty

and staff) working under the direction of a credentialed JHHS workforce member, and who have signed a HIPAA Workforce Agreement for this study

v From electronic medical/billing records via a JHM Privacy Office certified Honest Broker*

II Will you use PHI to identify and/or contact potential participants for your research?

Yes No

If yes, complete the sections below

1 Will you access PHI to identify potential participants for the study?

Yes No

If yes, you must confirm the following:

i You will only obtain the “minimum necessary” PHI;

ii The PHI will not leave the JHM covered entity or, if electronic, go outside JHM firewalls;

iii The PHI will not be used or disclosed to anyone outside the approved recruitment plan; and

iv All PHI will be destroyed after it has been used for recruitment purposes

Confirm

2 Please identify the individual(s) who will access PHI to identify potential participants for your research.

JHHS Credentialed Workforce Member(s) with treatment

relationship to potential participants

SPH, SON or SOM student(s) who has signed a HIPAA

Workforce Agreement as part of patient care

responsibilities

SPH Student(s) who has signed HIPAA

Workforce/Confidentiality Agreement for this study

JHU Researcher(s) who has signed HIPAA Workforce

Agreement

3 Will you use PHI to contact (in person or via mechanism like mail or phone) potential participants for the

study? Note: Successful recruitment will require a signed consent/authorization from participants who join the study

Yes No

If yes, please check all that apply

i Will a clinician with a treatment relationship obtain verbal permission from the potential participant to

provide name and contact information to the researcher so the researcher may directly contact the

potential participant from within the JHM covered entity?

Yes No

If yes, confirm the following:

3

 That the clinician will note the verbal permission in the medical record.

 That contact with the individual will take place in person within the JHM covered entity

 That the PHI is the “minimum necessary” and will not leave the JHM covered entity

 That if the potential participant agrees to participate, you will obtain consent and authorization Confirm

ii Will the clinician with a treatment relationship with the potential participant contact that individual in person or via mail, phone, email, or other mechanism to obtain permission to share contact

information with the researcher so that the researcher may contact the potential participant from outside JHM to explain the study?

Yes No

If yes, confirm the following:

 That the clinician will obtain the verbal permission from the individual allowing the researcher to contact the individual, and will note that verbal permission in the medical record

 That the clinician who is recording the note in the medical record will be added as a

co-investigator to the study

 That the PHI given the researcher is the “minimum necessary” to make the contact

 That the PHI used for recruitment purposes will be destroyed after contact for those individuals who do not respond or who decline participation

 Those individuals who agree to join the study will sign a consent/authorization

 That the PHI for those who agree to participate will be retained in accordance with the HIPAA Authorization signed by the study participant

Confirm

III Are you requesting a Waiver of the HIPAA Authorization requirement?

Yes No

If yes, answer the sections below

1 Check off the purpose for which you seek the waiver:

i For study recruitment because it is impracticable to have the clinician with a treatment relationship

with the potential participants involved in the recruitment contact? [Note: The IRB will grant a waiver

for recruitment in rare circumstances; its expectation is that the researcher’s activities will follow the recruitment requirements provided in Section II, above.]

Yes No

Yes No

2 Explain why the research and/or recruitment could not practicably be conducted without the waiver Be

as specific as possible

3 Explain why the research and/or recruitment could not practicably be conducted without access to/use of the PHI Be as specific as possible

4 Confirm that the use of PHI pursuant to the waiver involves no more than minimal risk to the privacy of

the study participant

Confirm

5 Confirm that if you plan to enroll, or do enroll, 49 or fewer participants from JHM, you will “track” the disclosures of PHI to you, as required, in the SPH Johns Hopkins HIPAA Compliance System The database may be accessed at https://cfapps.jhsph.edu/SPH-JH-HIPAA-Compliance/

Confirm

6 When will you destroy the identifiers? (Must be at earliest opportunity)

IV LIMITED DATA SETS

Do you intend to use a Limited Data Set produced by a JHHS Certified Honest Broker or other HIPAA Workforce Member?

Yes No

1 If Yes, identify the person who will create the Limited Data Set:      

2 Please identify the individual(s) who will access prepare, and/or use the Limited Data Set:

JHHS Credentialed Workforce Member(s) with treatment

relationship to potential participants

SPH, SON or SOM student(s) who has signed a HIPAA

Workforce Agreement as part of patient care

responsibilities

5

Workforce/Confidentiality Agreement for this study.

JHU Researcher(s) who has signed HIPAA Workforce

Agreement

Note: A limited data set may include only the following identifiers:

 Dates, such as admission, discharge, service, DOB, DOD;

 City, state, five digit or more zip code or any other geographic subdivision, such as state, county, city, precinct and their equivalent geocodes except street addresses; and

 Ages in years, months, days, or hours (with ages >89 aggregated into a single category of 90 or older)

Have you obtained a Data Use Agreement from the Johns Hopkins Privacy Office?

Yes No

If yes, attach or upload a copy of the Data Use Agreement to this Application

If no, contact the Johns Hopkins Privacy Office for a Data Use Agreement

3 DECEDENTS-ONLY PHI

Do you seek to access and use JHM PHI from Decedents Only?

If yes, please answer the following questions

1 Please describe the research purposes for which the researcher intends to examine records/specimens of

deceased individuals

2 Please identify the source of the records/specimens of deceased individuals the researcher intends to

study

If yes, confirm the following:

i The use or disclosure of PHI is sought solely for research on the PHI of decedents No living individuals will be included

ii If the IRB requests it, the researcher will provide documentation as to the death of the individuals

iv The PHI will be obtained through a HIPAA Workforce Member.

Confirm

3 Please identify the individual(s) who will access, prepare, and/or use the decedent PHI.

SPH, SON or SOM student(s) who has signed a

HIPAA Workforce Agreement

SPH Student(s) who has signed a HIPAA

Workforce/Confidentiality Agreement for this

study

JHU Researcher(s) who has signed a HIPAA

Workforce Agreement for this study

Confirm the following: The PHI will not be reused or disclosed to any other person or entity, except:

 As required by law

 For authorized oversight of this research

 For other research for which use or disclosure of PHI is permitted under HIPAA I will not proceed with any such use without consultation with the Johns Hopkins Medicine HIPAA Privacy Office

Confirm

       _       _

Signature of Principal Investigator Date

7