GUIDANCE ON WAIVERS OF INFORMED CONSENT AND HIPAA AUTHORIZATION

---

Listed below are the criteria for obtaining a Waiver of Informed Consent and a Waiver of HIPAA Authorization. Where appropriate, e.g., retrospective chart reviews, you must request both waivers as part of your IRB application. Note, that while similar, they differ and all criteria must be met. In requesting these waivers, please consider the criteria as questions and provide full answers. It is not adequate to just say yes or to just list the criteria.

Criteria for Waiver of Informed Consent 

The IRB may waive the requirement for informed consent if all of the following apply: 

1. The research involves no more than minimal risk to the subjects;  
2. The waiver will not adversely affect the rights and welfare of the subjects;
3. The research could not practicably be carried out without the waiver or alteration, even if the research involves use of identifiable private information or identifiable biospecimen; and,
4. Whenever appropriate, the subjects will be provided with additional pertinent information after participation. 

Criteria for Waiver of Documentation of Informed Consent or Permission to Obtain Verbal Consent

For research regulated by the 2018 Common Rule, the IRB may waive the requirement for documentation of informed consent and/or allow for verbal informed consent if any of the following apply: 

1. The only record linking the subject and the research would be the signed informed consent form, and the principal risk would be potential harm resulting from a breach in confideniality, and each subject or LAR will be asked whether the subject wants documentation linking them with the research; or,  
2. The research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context; or,  
3. For research involving distinct cultural groups, all of the following apply:

• • The research presents no more than minimal risk of harm to subjects; 
  • The subject or LAR is a member of a distinct cultural group or community in which signing forms is not the norm; and, 
  • There is an appropriate, alternative mechanism for documenting that informed consent was obtained. 

For research regulated by the FDA, the IRB may waive the requirement for documentation of informed consent and allow for verbal informed consent if the following applies:

1. The research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside the research context. 

Criteria for Waiver or Alteration of HIPAA Authorization      

For research regulated by the HIPAA Privacy Rule, the IRB may waive the requirement for HIPAA Authorization or documentation of such authorization if one or more of the following apply:    

1. The use or disclosure of protected health information involves no more than minimal risk to the privacy of the subjects based on, at least, one of the following:
   • An adequate plan to protect the identifiers from improper use or disclosure; and/or,
   • An adequate plan to destroy the identifiers at the earliest opportunity, unless there is a health, legal, or research justification for retaining the identifiers; and/or, 
   • Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information is permitted; and/or, 
2. The research could not practicably be conducted without the waiver or alteration; and/or,  
3. The research could not practicably be conducted without access to and use of the protected health information.