Table 2.

HIPAA and Common Rule Updates to Streamline Research.

HIPAA can be used solely to determine appropriate research access for HIPAA-governed research. [45 CFR 46.104(d) (4)(iii)] (https://www.hhs.gov/ohrp/regulations-and-policy/regulations/45-cfr-46/index.html)
Both HIPAA and the Common Rule allow participants to provide broad authorization (consent) for secondary research uses of data, without the need for study-specific consent.
Individuals can broadly authorize future research uses of their data, as long as the research is such that a “reasonable” individual would “expect that his or her health information could be used or disclosed for such future research” (10).
Research-ready databases of identifiable information can be created under a broad consent; secondary use needs IRB review but does not require re-consent of the participants. [45 CFR 46.104(d)(7&8)] (https://www.hhs.gov/ohrp/regulations-and-policy/regulations/45-cfr-46/index.html)
Researchers can request an IRB to waive or alter the elements of informed consent (or authorization). In response to the 21st Century Cures Act, FDA has indicated that it would honor IRB approvals of alterations or waivers of informed consent issued under the Common Rule (8).
The Common Rule now requires single IRBs for federally funded research involving more than 1 institution (9).