• HIPAA
  
  Health Insurance Portability and Accountability Act (HIPAA) is a complex regulation that may affect researchers at Hunter.  HIPAA is designed to protect the use and disclosure of individually identifiable health information (also defined as Protected Health Information or PHI).
  
  Under the HIPAA privacy regulations, a Hunter investigator must obtain a written authorization (a HIPAA Research Authorization from his or her research subjects) in order to use and/or disclose any individually identifiable protected health information (''PHI'') of these subjects that is created or maintained by, or obtained from, a person or entity covered under HIPAA. Alternatively, a researcher can apply for an IRB waiver of authorization. 
   
• WAIVER OF AUTHORIZATION
  
  A waiver of authorization is documentation that an IRB  has reviewed the proposed research  and use of PHI and has approved a waiver of all or part of the authorization requirement for obtaining and using individually identifiable PHI in the research.  The waiver of authorization is based solely on an assessment of the privacy risks in the proposed research use of individually identifiable PHI.
  
   
• COVERED ENTITIES
  
  Examples of entities covered under HIPAA are hospitals; physicians, and practices in psychology, psychotherapy, or social work; health insurers, HMOs, and health plans; and certain community clinics and social service and mental health agencies.

CUNY is not an entity directly covered by HIPAA. Hunter investigators are therefore not covered under the HIPAA privacy regulations unless, in order to conduct research, they are using or disclosing patient or client information that they (a) create or receive when acting as HIPAA--covered health care providers, (b) create or receive as members of the workforce of a HIPAA-covered entity, or (c) obtain from a HIPAA-covered entity. For example, Hunter faculty or students who conduct or assist with research may also be employees or trainees in hospital or social service settings that are covered by HIPAA and may be using data obtained from those settings in research. Hunter investigators may also be collaborating with co-investigators who are covered by HIPAA.

• FORMS REQUIRED

When a study requires use or disclosure of health information from or by a covered entity or its employees or trainees, the Hunter researcher should complete the HIPAA Research Authorization form or IRB waiver application and submit it to the IRB for review.  Researchers should take care to ensure that all necessary uses and disclosures of health information are described accurately and completely.

The HIPAA Research Authorization form is separate from, and does not replace, the informed consent form that researchers may be required to have participants in their human subjects research sign.

• HIPAA IDENTIFIERS

  PHI is defined as any of the 18 HIPAA recognized identifiers) in combination with health information.

HIPAA recognized identifiers:

1. Names;
2. All geographic subdivisions smaller than a State, including street  address, city, county, precinct, zip code, and their equivalent geocodes;
3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death;
4. Telephone numbers;
5. Fax numbers;
6. Electronic mail addresses;
7. Social security numbers;
8. Medical record numbers;
9. Health plan beneficiary numbers;
10. Account numbers;
11. Certificate/license numbers;
12. Vehicle identifiers and serial numbers, including license plate numbers;
13. Device identifiers and serial numbers;
14. Web Universal Resource Locators (URLs);
15. Internet Protocol (IP) address numbers;
16. Biometric identifiers, including finger and voice prints;
17. Full face photographic images and any comparable images;
18. Any other unique identifying number, characteristic, or code.