IRB & HIPAA: What you need to know

What is the Health Insurance Portability and Accountability Act (HIPAA)?

• Act that was passed by congress in 1996 to protect confidential patient medical records and information.

Does my QI project violate HIPAA?

• No, hospital improvement projects fall under the Law’s Health Care Operations Section 164.501, thus it is exempt.  Patient identifiable information is often not needed for data collection.  For example, knowing that 3 patients did not get vaccinated is more important than knowing which 3 patients were not vaccinated.

So, can I use identifiable patient information for data collection during my project?

• Yes, patient information can be used if:

  • • 1. Gathered data falls within the scope of the project – not used for snooping!

    • 2. Data is that of the fellow’s own patient in the clinic which the fellow works.

    • 3. If a fellow is using patients’ data from another physician's clinic, the data must DIRECTLY relate to the fellow’s specialty/scope of practice/expertise.

    Reference: UW Madison Institutional Review Board 

What is the IRB?

• The UW Health Sciences Institutional Review Board (IRB) is a committee tasked with ensuring that UW’s Medical Research 

  • Is conducted safely with appropriate regrd to participant risk;

  • Researchers comply with ethical and regulatory requirements.

  • Research needs to have IRB approval to conduct testing even with minimal risk. Quality improvement does not need this approval as there is very little risk to participants in QI.  Data linked to particular patients is not needed, rather accumulating frequency of events over time is tracked

  • Because there are times when the line between QI and research is grey, the UW IRB has developed a tool to ensure your project is QI and not research.

  • Fill out the IRB Research Decision Tool to ensure that your project is QI.