Under the Privacy Rule, CMS is permitted to disclose protected health information for research either with individual authorization, or without individual authorization. To use or disclose protected health information without individual authorization, CMS must obtain documentation that an IRB or a CMS Privacy Board has approved a waiver of research participants' authorization for use/disclosure of information about them for research purposes. If the researcher provides CMS with documentation of IRB waiver approval, the data request will be reviewed under an expedited CMS review process.

For a data use or disclosure to be permitted by CMS based on documentation of approval of an alteration or waiver, under the HIPAA privacy rule, the documentation provided to CMS must include:

• Identification of the IRB and the date on which the alteration or waiver of authorization was approved;
• A statement that the IRB has determined that the alteration or waiver of authorization, in whole or in part, satisfies the three criteria in the Rule;
• A brief description of the protected health information for which use or access has been determined to be necessary by the IRB;
• A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures; and
• The signature of the chair or other member, as designated by the chair, of the IRB, as applicable.

This documentation can be a copy of your IRB waiver documentation if it contains all items listed above. If what you receive from your IRB does not include the above items, you will need to include additional documentation which includes the above requested items. This additional documentation can be a photocopy of information submitted to your IRB or a written summary clearly referencing the study, Principal Investigator, IRB the submission was directed to and date of the IRB submission.

Visit the Office of Civil Rights (OCR) website for additional guidance on the Privacy Rule as it relates to research.