The institution’s IRB also serves as UW-Madison’s HIPAA Privacy Board. A HIPAA Privacy Board reviews requests for a waiver or an alteration of authorization for uses and disclosures of PHI. When serving as the reviewing IRB for external sites, the institution will typically agree to serve as Privacy Board for those sites, as applicable.

Even when the institution agrees to serve as Privacy Board for relying sites, those sites are responsible for adhering to their own institution’s HIPAA policies, including HIPAA security requirements. In addition, Privacy Boards only review requests for waivers and alterations of authorization. Review of authorization forms or language (if not included in a combined consent and authorization form) is the responsibility of the external site. This review will be completed by the relying site during the cede review process. (For information on how RELIANT works with relying sites, see the “Reliance Agreement Process” section.)

Please note that while UW-Madison considers pre-screening of medical records to determine eligibility to be preparatory to research and therefore not requiring a waiver of authorization, some institutions have a different interpretation and a waiver may be required. This is information the relying site typically provides to RELIANT during the cede review process.

For more information, see HRP-815-FORM-IAA Implementation Checklist.