JHSPH IRB Application for Disclosure of Johns Hopkins Medicine JHM PHI

To be completed by the Principal Investigator JHSPH IRB APPLICATION FOR DISCLOSURE OF JOHNS HOPKINS MEDICINE (JHM) PROTECTED HEALTH INFORMATION (PHI) (based on JHSPH IRB Policy on Use of PHI in Research) PI Name IRB Number Study Title I                   JHM Protected Health Information for Living Participants (For Decedents, go to Section V) Identify the specific JHM Covered Entity1 and JHM Departments from which the PHI will be obtained: The Johns Hopkins Hospital Howard County General Hospital Suburban Hospital All Children’s Hospital JH Pediatrics at Home JH University School of Medicine JH University School of Nursing Other Hopkins Providers (specify):       The Johns Hopkins Bayview Medical Center JH Community Physicians Sibley Memorial Hospital JH Pharmaquip Priority Partners Managed Care Organization Johns Hopkins Employee Health Plans, e.g EHP JH Home Health Services List the specific JHM department(s) from which the PHI is sought:       Select the personal identifiers you seek to access/use in your research project Name Geographic information smaller than State, including city, county, and zip code and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: Certificate or license numbers Vehicle identifiers and serial numbers, including license plate numbers (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all An updated list of Johns Hopkins Medicine covered entities may be found at: http://intranet.insidehopkinsmedicine.org/privacy_office/about_hipaa/ *“Honest Broker” is someone who is authorized to create large datasets for analysis, but is not involved in the analysis 07Mar2018 – JHM Application To be completed by the Principal Investigator such geographic units containing 20,000 or fewer people is changed to 000 All elements of dates except years (e.g., birth date, admission date, date of death, age by year if >89 years of age) Device identifiers and serial numbers Telephone numbers Web URLs FAX numbers Internet Protocol (IP) address Email address Biometric identifiers, including finger and voice prints Social Security Number Full face photographic images and comparable images Medical record numbers Account numbers Health Plan beneficiary numbers Any other unique identifying number, characteristic or code Describe specifically the types of health information you will collect (e.g diagnosis, test results, treatments, etc.)       Identify how you will access the JHM PHI you want to use in your study Choose all that apply i Directly from the study participant with a signed JHSPH IRB Approved Consent/HIPAA Privacy Authorization Form What type of form you plan to use? a Combined consent/HIPAA authorization document b Stand-alone Medical Records Release form with HIPAA authorization document c Stand-alone HIPAA authorization document ii iii iv v From electronic medical/billing records via a credentialed JHHS Workforce Member From electronic medical/billing records via a JHU student (SOM, SON, and/or SPH) working under the direction of a credentialed JHHS workforce member and who have signed a HIPAA Workforce Agreement either for this study or as part of their patient care responsibilities From electronic medical/billing records via JHU-employed research personnel (including faculty and staff) working under the direction of a credentialed JHHS workforce member, and who have signed a HIPAA Workforce Agreement for this study From electronic medical/billing records via a JHM Privacy Office certified Honest Broker* II Will you use PHI to identify and/or contact potential participants for your research? Yes No If yes, complete the sections below Will you access PHI to identify potential participants for the study? *“Honest Broker” is someone who is authorized to create large datasets for analysis, but is not involved in the analysis 07Mar2018 – JHM Application To be completed by the Principal Investigator Yes No If yes, you must confirm the following: i ii iii iv You will only obtain the “minimum necessary” PHI; The PHI will not leave the JHM covered entity or, if electronic, go outside JHM firewalls; The PHI will not be used or disclosed to anyone outside the approved recruitment plan; and All PHI will be destroyed after it has been used for recruitment purposes Confirm Please identify the individual(s) who will access PHI to identify potential participants for your research Role Name(s) JHHS Credentialed Workforce Member(s) with treatment relationship to potential participants       SPH, SON or SOM student(s) who has signed a HIPAA Workforce Agreement as part of patient care responsibilities       SPH Student(s) who has signed HIPAA Workforce/Confidentiality Agreement for this study       JHU Researcher(s) who has signed HIPAA Workforce Agreement       JHHS Certified Honest Broker       Will you use PHI to contact (in person or via mechanism like mail or phone) potential participants for the study? Note: Successful recruitment will require a signed consent/authorization from participants who join the study Yes No If yes, please check all that apply i Will a clinician with a treatment relationship obtain verbal permission from the potential participant to provide name and contact information to the researcher so the researcher may directly contact the potential participant from within the JHM covered entity? Yes No If yes, confirm the following: *“Honest Broker” is someone who is authorized to create large datasets for analysis, but is not involved in the analysis 07Mar2018 – JHM Application To be completed by the Principal Investigator     That you are a HIPAA Workforce Member (need signed HIPAA Workforce Agreement) That the clinician will note the verbal permission in the medical record That contact with the individual will take place in person within the JHM covered entity That the PHI is the “minimum necessary” and will not leave the JHM covered entity  That if the potential participant agrees to participate, you will obtain consent and authorization Confirm ii Will the clinician with a treatment relationship with the potential participant contact that individual in person or via mail, phone, email, or other mechanism to obtain permission to share contact information with the researcher so that the researcher may contact the potential participant from outside JHM to explain the study? Yes No If yes, confirm the following:       That the clinician will obtain the verbal permission from the individual allowing the researcher to contact the individual, and will note that verbal permission in the medical record That the clinician who is recording the note in the medical record will be added as a coinvestigator to the study That the PHI given the researcher is the “minimum necessary” to make the contact That the PHI used for recruitment purposes will be destroyed after contact for those individuals who not respond or who decline participation Those individuals who agree to join the study will sign a consent/authorization That the PHI for those who agree to participate will be retained in accordance with the HIPAA Authorization signed by the study participant Confirm III Are you requesting a Waiver of the HIPAA Authorization requirement? Yes No If yes, answer the sections below Check off the purpose for which you seek the waiver: i For study recruitment because it is impracticable to have the clinician with a treatment relationship with the potential participants involved in the recruitment contact? [Note: The IRB will grant a waiver for recruitment in rare circumstances; its expectation is that the researcher’s activities will follow the recruitment requirements provided in Section II, above.] Yes ii No For secondary data analysis or a broad program evaluation? *“Honest Broker” is someone who is authorized to create large datasets for analysis, but is not involved in the analysis 07Mar2018 – JHM Application To be completed by the Principal Investigator Yes No Explain why the research and/or recruitment could not practicably be conducted without the waiver Be as specific as possible       Explain why the research and/or recruitment could not practicably be conducted without access to/use of the PHI Be as specific as possible       Confirm that the use of PHI pursuant to the waiver involves no more than minimal risk to the privacy of the study participant       Confirm Confirm that if you plan to enroll, or enroll, 49 or fewer participants from JHM, you will “track” the disclosures of PHI to you, as required, in the SPH Johns Hopkins HIPAA Compliance System The database may be accessed at https://cfapps.jhsph.edu/SPH-JH-HIPAA-Compliance/ Confirm When will you destroy the identifiers? (Must be at earliest opportunity)       IV LIMITED DATA SETS Do you intend to use a Limited Data Set produced by a JHHS Certified Honest Broker or other HIPAA Workforce Member? Yes No If Yes, identify the person who will create the Limited Data Set:       Please identify the individual(s) who will access prepare, and/or use the Limited Data Set: Role Name(s) JHHS Credentialed Workforce Member(s) with treatment relationship to potential participants       SPH, SON or SOM student(s) who has signed a HIPAA Workforce Agreement as part of patient care responsibilities       *“Honest Broker” is someone who is authorized to create large datasets for analysis, but is not involved in the analysis 07Mar2018 – JHM Application To be completed by the Principal Investigator SPH Student(s) who has signed HIPAA Workforce/Confidentiality Agreement for this study       JHU Researcher(s) who has signed HIPAA Workforce Agreement       JHHS Certified Honest Broker       Note: A limited data set may include only the following identifiers:  Dates, such as admission, discharge, service, DOB, DOD;  City, state, five digit or more zip code or any other geographic subdivision, such as state, county, city, precinct and their equivalent geocodes except street addresses; and  Ages in years, months, days, or hours (with ages >89 aggregated into a single category of 90 or older) Have you obtained a Data Use Agreement from the Johns Hopkins Privacy Office? Yes No If yes, attach or upload a copy of the Data Use Agreement to this Application If no, contact the Johns Hopkins Privacy Office for a Data Use Agreement DECEDENTS-ONLY PHI Do you seek to access and use JHM PHI from Decedents Only? Yes No If yes, please answer the following questions Please describe the research purposes for which the researcher intends to examine records/specimens of deceased individuals       Please identify the source of the records/specimens of deceased individuals the researcher intends to study       If yes, confirm the following: i The use or disclosure of PHI is sought solely for research on the PHI of decedents No living individuals will be included ii If the IRB requests it, the researcher will provide documentation as to the death of the individuals iii The PHI is necessary for the research purposes *“Honest Broker” is someone who is authorized to create large datasets for analysis, but is not involved in the analysis 07Mar2018 – JHM Application To be completed by the Principal Investigator iv The PHI will be obtained through a HIPAA Workforce Member Confirm Please identify the individual(s) who will access, prepare, and/or use the decedent PHI Role Name(s) JHHS Credentialed Workforce Member(s)       SPH, SON or SOM student(s) who has signed a HIPAA Workforce Agreement       SPH Student(s) who has signed a HIPAA Workforce/Confidentiality Agreement for this study       JHU Researcher(s) who has signed a HIPAA Workforce Agreement for this study       JHHS Certified Honest Broker       Confirm the following: The PHI will not be reused or disclosed to any other person or entity, except:    As required by law For authorized oversight of this research For other research for which use or disclosure of PHI is permitted under HIPAA I will not proceed with any such use without consultation with the Johns Hopkins Medicine HIPAA Privacy Office Confirm       _ Signature of Principal Investigator      _ Date *“Honest Broker” is someone who is authorized to create large datasets for analysis, but is not involved in the analysis 07Mar2018 – JHM Application ... law For authorized oversight of this research For other research for which use or disclosure of PHI is permitted under HIPAA I will not proceed with any such use without consultation with the Johns. .. Agreement to this Application If no, contact the Johns Hopkins Privacy Office for a Data Use Agreement DECEDENTS-ONLY PHI Do you seek to access and use JHM PHI from Decedents Only? Yes No If yes, please... confirm the following: i The use or disclosure of PHI is sought solely for research on the PHI of decedents No living individuals will be included ii If the IRB requests it, the researcher will