HSTA Lifestyles Project

HIPAA Training

For any individual who has contact with data gathered from humans, they must complete this training. HSTA teachers can then provide this training to their students who will have contact with the data. A verification form is signed and sent to Jenny Bardwell.

1. What does HIPAA stand for?

Health Insurance Portability and Accountability Act (HIPAA)
This Act took effect on April 14, 2003.

2. What is the Privacy Rule in HIPAA?

The Privacy Rule regulates who can see an individuals Protected Health Information (PHI).

Under HIPAA, anyone can choose to allow or not allow others to collect and/or use their PHI.

3. What is Protected Health Information (PHI)?

PHI stands for any identifiable health information that could be used against a person. For example, one’s heart rate and blood pressure, demographics, (not height or weight).

Individually Identifiable Health Information is information that could be used against a person. s a subset of health information, including demographic information collected from an individual, and:
1. Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
2. Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
i. That identifies the individual; or
ii. With respect to which there is a reasonable basis to believe the
information can be used to identify the individual.

Physicians have always been bound to protect this information revealed by patients or discovered by physicians during the course of medical treatment. This is an ethical as well as a professional obligation.

Researchers also have an obligation to keep this informational confidential!

5. Why is this Privacy Rule of benefit to individuals?

Examples:
Insurance companies and some physicians have sold the health information they have for profit. Pharmaceuticals can utilize such health information to rationalize benefits from medicines.
Persons who may be liable to getting AIDS
Computer screens in doctor’s offices must now be turned away from the persons in waiting rooms.

6. How Does the Researcher Gain Access to PHI?

Under HIPAA, research subjects can choose to allow or not allow researchers to collect and/or use PHI. An individual authorization form is used for this purpose: If the subject voluntarily signs the form, use is allowed. The individual authorization form can be viewed here: http://www.wvu.edu/~rc/irb/hip_auth.htm.

The authorization form is prepared by the researchers and must be submitted to/approved by the WVU IRB as a part of the application (protocol) to carryout research.

This authorization is collected from the subjects at the same time that informed consent and release is obtained (and assent in the case of minors). The consent and assent forms are separate forms from the authorization form. (Show sample of each form)

There are other ways that researchers can legally access PHI, but we will not be utilizing any of these routes. For further information on these routes, consult the on-line HIPAA training module at the WVU IRB site: http://www.wvu.edu/~rc/irb/index.htm

7. Can a Research Subject Revoke His/Her Authorization to Use PHI?

At any time, an individual can revoke his/her authorization for you to use PHI. However, PHI collected up to that point can still be utilized.

8. Questions and additional resources

For more information on HIPAA:

The complete HIPAA course is available here: http://www.wvu.edu/~rc/irb/hip_crse.pdf

The associated HIPAA quiz is available here: http://www.wvu.edu/~rc/irb/hip_quiz.pdf

9. Please sign the verification form upon completion and send to Jenny Bardwell

Jenny Bardwell
PO Box 9026
WVU
Morgantown, WV 26506
jbardwell@hsc.wvu.edu
800-345-4267