Only sites determined to be a covered entity are responsible for complying with the Privacy Rule. Covered entities are health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with certain defined HIPAA transactions, such as claims or eligibility inquiries.

To obtain guidance on determining if your site is a covered entity or for information on the authorization elements, CLICK HERE.

If HIPAA language is integrated in the informed consent document IntegReview will review the content for confidentiality language and readability. Because IRBs are not required to comply with the Privacy Rule, IntegReview is not responsible for ensuring that the appropriate HIPAA requirements are included.

However, in the event you have a stand-alone HIPAA authorization, federal regulations do not require you to include this information in the informed consent document.

Additionally, federal regulations do not require IRBs to review and approve stand-alone HIPAA authorizations. Following is a website presenting the IRBs role under the Privacy Rule from the National Institutes of Health. Please refer to paragraph 12, which identifies IRB obligations regarding these stand-alone documents.