University of the Pacific

HIPAA Privacy Rule Questionnaire

Project Title:
Instructions: If your study includes access to identifiable medical information, you must complete this questionnaire. The information requested will be used to determine whether your study requires a HIPAA Authorization Form or other legal agreements.
1 / In the conduct of this study, will you have access to subjects’ protected health information (PHI)? PHI is individual-level health information plus any information that could be used to link the identity of an individual with his/her health information
Yes
No →You do not need to answer questions 2-19 of this questionnaire
2 / Who will use the PHI in the context of this research?
Principal Investigator Co-investigator(s)
Research assistant(s) Pharmacist(s)
Programmer(s)/IT Others(specify):
3 / Will anyone who is not either a Pacific faculty, staff or student have access to PHI in the conduct of this study?
Yes No
4 / Does the data being used or created for this study qualify as a Limited Data Set (LDS)? A LDS is health information that can include dates and geographic descriptors but must exclude other identifiers.
Yes →Skip to question 16
No
5 / What PHI will be used in the conduct of this study?
Medical record (paper or electronic), including laboratory, pharmacy, radiology, etc.
Disease registry or any database maintained within Pacific
Research record (shadow file)
Research or non-routine laboratory, radiology or other reports (specify: )
Sensitive patient data, e.g., STD or HIV tests, genetic marker tests, etc. (specify: )
Other (list all: )
6 / Do you anticipate that your study will have a HIPAA Authorization for participants to sign?
Yes
No → Skip to question 8
7 / When will the participants’ authorization to use or disclose PHI expire?
At the end of the study →Skip to question 17
At a specified date after the IRB has accepted the final report (specify the date and give justification
for extending the authorization beyond the end of the study:
and skip to question 17
The authorization will never expire. Provide justification:
and skip to question 17
8 / Does the use or disclosure of PHI for this study present no more than a minimal risk to the privacy of the individuals whose PHI will be accessed?
Yes No
9 / Describe your plan to protect any identifiable information from use or disclosure not approved by the IRB.
10 / Describe your plan to destroy any identifiers at the earliest opportunity or provide a rationale for retaining the identifiers
11 / Describe why the research could not be done if you were required to obtain authorization from each individual whose PHI you intend to use
12 / Describe why the research could not be done without access to the PHI
13 / Is the PHI that you are requesting to use or disclose the minimum necessary to conduct this study?
Yes No
14 / How many individuals’ PHI will be disclosed?
No PHI will be disclosed. →Skip to question 19
Fewer than 50 individuals →Skip to question 16
50 or more individuals
15 / What type of PHI will be disclosed?
Clinical/Diagnostic
Health Care
Demographic
16 / Will you disclose PHI only as a Limited Data Set (LDS)?
Yes →Complete 16A – 16H
No →Skip to question 17
16A. Name of the recipient (individual or entity) received the LDS, including contact name and telephone number:
16B. What service will the recipient provide?
16C. Name of individuals or class of individuals (e.g., data analysts, etc.) permitted to use the LDS:
16D. What information will be included in the LDS?
16E. How will the recipient use the LDS (e.g., analyze data, produce report)?
16F. Will the recipient be permitted to re-disclose the information to a third party and if so, to whom (names of the individuals or entities?
16G. Will the recipient use subcontractors with access to the LDS (specify names)?
16H. In addition to disclosing PHI as an LDS, will you also be disclosing PHI which does not meet the criteria of an LDS?
Yes →Skip to question 17
No →Skip to question 18
17 / To whom will you disclose PHI?
PHI will not be disclosed
Sponsor or pass through entity (specify):
Sponsor’s agent(s), e.g., a central laboratory, etc. (specify):
Collaborating investigator (specify):
Data coordinating center (specify):
Service vendors contracting with Pacific to support this research, such as mailing, survey, data storage, laboratory services, etc. →Answer questions 17A – 17F for each vendor
Other (specify)______
If service vendors will receive or create PHI, provide the following information for each vendor (attach a separate page if necessary)
17A. Name, contact name and telephone number of the vendor
17B What service will the vendor provide?
17C What is the permitted use of the PHI by the vendor (e.g., only for this study)?
17D Will the vendor be permitted to disclose the information to a third party and if so, what is/are the name(s) of the individuals or entities?
17E Will the service vendor use subcontractors (specify names)?
17F Should Pacific impose additional restrictions on the use of this data?
18 / If the study is a clinical trial, will participants be required to waive their right to access their PHI collected during their participation in the clinical trial?
The study is not a clinical trial
Yes, participants will be required to waive their right to access their study records during the clinical trial.
No
19 / Do you assure that you will only use and disclose PHI as described in this Questionnaire, except as required by law? (Note that all changes in use and disclosure must be approved by the IRB prior to implementation)
Yes No