HIPAA: List of Authorization Elements
An Authorization for Research must be written in plain language and must contain ALL of the following elements:
- A specific and meaningful description of the information to be used or disclosed.
- The name or identification of the persons or class of persons authorized to make disclosures of PHI and to use the PHI for research-related purposes.
- The name or identification of the persons or class of persons authorized to receive disclosures of the PHI and to use the PHI for research-related purposes.
- A description of each purpose of the use or disclosure.
- An expiration date or event, or a statement "end of research study" or "none" when appropriate (ex: for a research database).
- The individual's signature (or that of his/her authorized representative as determined by California law) and date.
- A statement that the individual may revoke the authorization if done in writing to the principal investigator; however, the researcher may continue to use and disclose, for research integrity and reporting purposes, any PHI collected from the individual pursuant to such Authorization before it was revoked.
- A statement that an individual's clinical treatment may not be conditioned upon whether or not the individual signs the research Authorization. However, participation in research may be conditioned on a signed Authorization, including treatment protocols (ex.: Phase III clinical trials).
- A statement that information disclosed under the Authorization could potentially be redisclosed by the recipient and would no longer be protected under HIPAA
- The individual must be provided with a copy of the signed Authorization.