Statement of Practice: HIPAA and U-M study team members outside Michigan Medicine in eResearch applications

For IRB applications, it is important to identify the status of a study team member (within the CE or outside CE) and how the PHI will be utilized so the IRB application can be reviewed according to the applicable regulations and institutional policies.

1. In question 01.8 Project Summary of the IRB application, identify the study team members who are within U-M and outside the CE.
   Indicate whether these study team members will have access to Michigan Medicine PHI (i.e., any identifiable health information collected from U-M medical records (Michart, etc.) or the health information collected from a research study and then entered into U-M medical records). Note that the 'dates of service' are also considered PHI.
2. If these members (within-U-M and outside-CE) will NOT have access to Michigan Medicine PHI:
   1. answer “No” to any questions on system-activated pages asking about sharing PHI outside the CE:
      • 25-2.7 (HIPAA waiver page)
      • 25-3.3 (Certification Preparatory to Research)
      • 25-4.3 (Limited Data Set)
      (unless PHI is disclosed outside U-M entirely)
   2. Secondary Use Research applications: answer “Yes” to question 8.1 on page 01-1.2 (Scope) to indicate all PHI is kept within the CE (unless PHI is shared outside U-M entirely).
3. If these members (within U-M and outside the CE) will have access to Michigan Medicine PHI (generally because Michigan Medicine study team member(s) access/collect PHI and share it with the U-M study team member outside the CE)
   1. answer “Yes” to any questions on system-activated pages asking about sharing PHI outside the CE:
      • 25-2.7 (HIPAA waiver page)
      • 25-3.3 (Certification Preparatory to Research)
      • 25-4.3 (Limited Data Set)
   2. Secondary Use Research applications: answer “No” to question 8.1 on page 01-1.2 (Scope). This will most usually open additional sections (05, 10, and 11) for the study team to complete to request ‘standard’ IRB approval. (as opposed to Exempt human subjects research determination).
   3. The Responsible Data Use & Disclosure Attestation document should be completed per the Michigan Medicine Limited Data Sets Policy, 01-04-342 (U-M internal sharing template is available as an Attachment on the Policy 01-04-342 page).
      • Upload the signed copy into the IRB application at 25-4.3 (if system-activated) or 44.1 (additional supporting documents).
      • If there is a delay in completing and uploading this document to the IRB application for any reason, communicate this information with the IRB staff and re-submit the IRB application/submission.

• IRBMED will not hold the IRB approval for the signed copies of the attestation document. However, completion of the document is important as part of compliance with appropriate U-M policies and HIPAA regulations.
• Per the Michigan Medicine Policy 01-04-342, the attestation document should be utilized for a limited data set scenario, but it is also in use for sharing full PHI. Note that access to and use of PHI must be limited to the minimum necessary to perform the work.
• For any questions regarding the attestation document or a member status as it relates to CE, contact the U-M Corporate Compliance (phone 734-615-4400, email compliance-group@med.umich.edu Website: https://www.med.umich.edu/u/compliance/hipaa/index.html)