The following table lists the options for addressing HIPAA requirements in ARROW and states when they are appropriate.
Obtain HIPAA Authorization | Study teams should choose this option if they will be obtaining written HIPAA authorization. See HRP-330. |
Request for Waiver of Authorization | Study teams should choose this option if they wish to request a full waiver of authorization for the entire study. An example of when this is appropriate is a study that involves only review of medical records. See HRP-441. |
Request for Altered Authorization | Study teams should choose this option if they will obtain HIPAA authorization, but do not want to include all required elements or will obtain authorization in some way other than via a written signature. An example of this is obtaining authorization verbally over the phone. See HRP-441. |
Request for Partial Waiver of Authorization | Study teams should choose this option if they wish to request a full waiver of authorization for part of the study. An example of when this is appropriate is a study that involves a retrospective chart review of patients who are lost to follow-up in addition to prospective patient recruitment. A partial waiver of authorization would be requested for the retrospective subjects only, and written HIPAA authorization would be obtained for the prospective subjects. See HRP-441. |
Data Use Agreement for Limited Dataset | Study teams should choose this option under the following conditions: 1) if they will share a limited data set outside UW-Madison without obtaining subject authorization, 2) if they will receive (e.g., from SMPH Informatics) or record a limited data set for use within UW-Madison, but without obtaining subject authorization (Note: If identifiers will be retained beyond the creation of a limited data set, a waiver of authorization is also needed), or 3) if they will receive a limited data set from outside UW-Madison under a DUA. |
Create a De-identified Dataset | Study teams should choose this option if they will access subject PHI but will not record any HIPAA identifiers or link study data to identifiers via a study ID code. |
Certification for Use of Decedent PHI | Study teams should choose this option if data will be limited to decedents. A completed copy of the certification should be uploaded to ARROW. |