What is HIPAA?
CUNY is not a HIPAA covered entity BUT
If your study involves individually identifiable protected health or mental health information (PHI), including demographic information and biological specimens identified to an individual, created or maintained by a hospital, a physician, a psychology psychotherapy or social work practice, a health insurer or health plan, HMO, community clinic social service or mental health agency--- YOU MUST GET HIPAA AUTHORIZATION for your project.
There are three ways to get HIPAA authorization:
- You can seek each subject’s HIPAA authorization (in addition to each subject’s informed consent). You may use either CUNY’s HIPAA Research Authorization form (found in IRB Net) OR the covered entity’s HIPAA form.
- You may request a waiver or alteration of HIPAA authorization using the proper form in IRB Net. An example of this situation would be: needing to use data that has already been collected (pre HIPAA) and the subjects cannot be practicably contacted. There are other instances but you must show that there is minimal risk and that the research could not be carried out any other way.
- The covered entity provides you with a limited data set for your research. You must attach a copy of the covered entity’s data use agreement to the application.