OBJECTIVE:

To described the policy of VCU pertaining to the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

DESCRIPTION:

HIPAA, which took effect on April 14, 2003, was developed by the Department of Health and Human Services (HHS), and became the first-ever federal privacy standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals and other health care providers.  These new standards provide patients with access to their medical records and more control over how their personal health information is used and disclosed. They represent a uniform, federal floor of privacy protections for consumers across the country, specifically protecting medical records and other individually identifiable health information, whether it is on paper, in computers or communicated orally.  State laws providing additional protections to consumers are not affected by this new rule.

The VCU IRB approval is limited to review under 45 CFR 46, 21 CFR 50 and 56, and guidance offered by both the Office of Human Research Protections and the Food and Drug Administration.  Additional approvals or documentation may be required by the VCU Health System or certain VCU Departments/Divisions under the Health Insurance Portability and Accountability Act (HIPAA).

VCU and the VCU Health System have developed procedures and tools to ensure that research activities remain HIPAA compliant.  The following website provides extensive information for researchers: http://www.vcu.edu/hipaa/Research_Page.htm

Questions regarding compliance with HIPAA and research can be directed to:

Buzz Willis 804-628-1853 or Cynthia Earnhardt (Privacy Officer) 804-828-0500

RESPONSIBILITY:

It is the responsibility of the VCU, the VCU Health System Authority, and the principal investigator to ensure ongoing compliance with HIPAA.

REFERENCE:

OCR HIPPA Website http://www.hhs.gov/ocr/hipaa

VCU HIPPA Website http://www.vcu.edu/hipaa