The Health Insurance Portability and Accountability Act of 1996 included provisions to protect the privacy of individually identifiable health information.

The VCU IRB has the responsibility for review of research under the Common Rule (45 CFR 46) and is not directly affected by HIPAA. However, due to HIPAA, there are additional responsibilities, which may fall upon investigators as required by the VCU Health System or as related to certain VCU activities involving protected health information. Therefore, while HIPAA will not impact research protocol review through the VCU IRB, there are considerations, which investigators may wish to make prior to developing a protocol.

Please note: If your research is sponsored by industry AND you are using the Western Institutional Review Board (WIRB), the VCU Health System has provided authorization for investigators to follow the guidance of the WIRB for compliance with HIPAA. This means that protocols reviewed by WIRB should use the WIRB-approved language for Authorizations and that the VCU Health system will accept appropriate WIRB decisions regarding Waivers of Authorizations and other HIPAA-related approvals.

VCU and the VCU Health System have established a HIPAA website with links to the source documents and procedures and tools to ensure HIPAA compliance. These can be accessed at the following address: http://www.vcu.edu/hipaa.

Contact information: The Chief Compliance and Privacy Officer for HIPAA is Cynthia H. Earnhardt who can be reached at 828-0500 or chearnha@vcu.edu. For Privacy information or questions, contact Buzz Willis at 628-1853 or rcwillis@vcu.edu. For Security information and questions, contact David Houlette at 628-1144 or dhoulette@mcvh-vcu.edu.