- HIPAA Authorization
- HIPAA Authorization (Spanish)
- HIPAA Child Authorization
- HIPAA Child Authorization (Spanish)
- HIPAA Waiver
All investigators must use the HIPAA authorization form. The study HIPAA form requires IRB review and must be stamped by the IRB. Please submit the study HIPAA form along with your PSF and other study materials in PRISM.
Along with the study consent form, research participants must sign a HIPAA authorization and receive a Notice of Privacy Practices (NPP), or the researcher will obtain a HIPAA Waiver of Authorization from the IRB. All of these forms are available below.
Protected Health Information (PHI) - 18 HIPAA Identifiers
2. Geographic subdivisions - smaller than a state (e.g., street address, city, county, etc.)
3. All elements of dates - (except year) for any date directly related to an individual, including dates for birth, admission, discharge, and death, and all ages over 89.
4. Telephone numbers
5. Fax numbers
6. Electronic email addresses
7. Social Security number
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers - license plates and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. Biometric identifiers - including genetic information, finger, or voice prints
16. Full face photographic images and any comparable images
17. Internet Protocol (IP) address numbers
18. Any other unique identifying number - characteristic or code that is derived from or related to the individual (e.g., initials, etc.)
Considerations for Phone Screens
Persons who are participating in a telephone screening must also receive HIPAA information.
- Describe what Personal Health Information (PHI) is being asked for during the telephone screening
- Describe how information will be used by the researchers
- Describe who else will receive the information (sponsor, government agency, etc.)
- Tell the persons whether their PHI will be kept if they choose not to enroll in the study or if they do not qualify to be in the study. If applicable, ask permission to retain the information that you collect (e.g., in a database)
- For those participants who will not be seen in person - Tell the person that they can change their mind about participating in the research, even after they have agreed to do so, and tell them who to call if they want to drop out. Otherwise, any information that has been collected may be used.
- For participants who will be seen in person after the telephone screening - Tell the person that they will be given a consent form and a HIPAA Authorization form which will allow you to use or disclose their PHI.
Link to additional information about the HIPAA regulations. (Note: ServiceNet link only available within NYSPI.)
The institutional Privacy Officer, at 646-774-8251 or Bennett@nyspi.columbia.edu if you have any questions.