About Us
Services
Research
Administration

Events / Training
Administrative
Procedures
 

   SOPs
   Working Instructions
   Miscellaneous

Forms

  Administrative
  Working Templates
IRB Online
Research Compliance
Committee

Newsletter
More About Research 
ICD 
 



Per MSHA HIPAA officer, below is the content that must be in an authorization form for access to PHI for research purposes at MSHA.

Per the Privacy Rule, 45 C.F.R. §164.508

The authorization to use and disclose Protected Health Information (PHI) for research purposes must include the following:

  • Description of PHI to be accessed, used or disclosed. Identify the information in a specific and meaningful manner, such as demographic information, date of birth, social security number, blood test, x-rays, medical record, etc.
  • The name(s) or other specific identification of person(s) or class of persons authorized to make the requested use or disclosure
  • The name(s) or other specific identification of the person(s) or class of persons who may use the PHI or to whom the covered entity may make the requested disclosure. Inform participant that MSHA representative will have an access to the study documents (Confidentiality and HIPAA section)
  • Description of each purpose of the requested use or disclosure, specific to research study, not for future unspecified research
  • Authorization expiration date or event of the authorization
  • Signature of the individual
    • If Authorization is signed by an individual’s personal representative, a description of the representative’s authority to act for the individual
  • Date signed by the individual
  • The individual's right to revoke his/her Authorization in writing and either (1) the exceptions to the right to revoke and a description of how the individual may revoke Authorization and who/how to contact
  • Notice of the covered entity's ability or inability to condition treatment, payment, enrollment, or eligibility for benefits on the Authorization, including research-related treatment, and, if applicable, consequences of refusing to sign the Authorization
  • The potential for the PHI to be re-disclosed by the recipient and no longer protected by the Privacy Rule.

Also, if potential research candidate decides not to sign the authorization, she/he has to be informed how collected data will be managed. It is highly recommended to include a language presented below:

  • It will not affect my treatment, payment or enrollment in any health plans nor affect my eligibility for benefits.
  • I cannot be allowed to participate in this research study.

After signing the Authorization, I can change my mind and:  

  • Not let the researchers disclose or use my protected health information (revoke the Authorization).
  • If I revoke the Authorization, I will send a written letter to: [name and contact information] to inform him/her of my decision.
  • If I revoke this Authorization, researchers may only use and disclose the protected health information already collected for this research study.
  • If I change my mind and withdraw the authorization, I may not be allowed to continue to participate in the study.

This Authorization does [or does not] have an expiration date. The expiration date is [State clearly what the expiration date is if there is one]