An altered authorization means that individuals are asked for permission to collect, use, or disclose their PHI, but some required elements or statements of the authorization are not included. See HRP-330-WORKSHEET: HIPAA Authorization for a list of required elements and statements. The altered authorization may be written, but briefer in nature, or may be an oral authorization process, depending on context. Examples of when an altered authorization may be appropriate include:

• You are collecting health information as part of a telephone screen and obtaining written, signed authorization would not be practicable.
• When the only risk in the research is breach of confidentiality and the research as designed, to reduce risks in relation to anticipated benefits, would not be practicable if the consent/authorization form included participants’ signatures.
• When a patient’s clinician requests permission to share only name and contact information with a study team so that the study team can contact the patient about a research opportunity.**
• When a patient is in a clinic visit and someone from the healthcare team asks whether the patient is interested in meeting with a member of the research team at the visit.**
• When using the short form consent for individuals with limited English proficiency to request an oral HIPAA authorization process (except no altered authorization is needed when using the stand-alone HIPAA Authorization that has been translated to Spanish). See: Authorization & Participants with Limited English Proficiency.

** Note that researchers who are employees of the HIPAA covered institution or members of its workforce for purposes of research may access and use PHI as a preparatory to research activity to contact potential participants for recruitment. In this case, no altered authorization is required. See the Clinical Recruitment Guidelines for more information.

If you are using a remote consent/authorization process in non-FDA regulated research as described in Remote Consent Processes and participants will type their name on a signature line, you do not need to request an altered authorization.

Because individuals are giving their permission for access to or use of the PHI, no accounting for disclosures is required.