Waiver of Individual Authorization

Researchers may apply for a waiver of the privacy authorization requirements under HIPAA if the research meets the following criteria:

The use or disclosure of PHI involves no more than a minimal risk to the privacy of individuals based on, at least, the presence of the following elements;
An adequate plan to protect the identifiers from improper use and disclosure;
An adequate plan to destroy the identifier at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted by the HIPAA;
The research could not practically be conducted without the alteration or waiver; and
The research could not practically be conducted without access to and use of the PHI.