Waiver of Authorization

In some situations, the IRB can waive the requirement that research subjects sign an Authorization Form. In general, a Waiver of Authorization could be granted in the same situation where the IRB now grants a Waiver of Informed Consent. A typical example would be research that would use retrospective chart review, where the data are already collected. Studies that involve a Waiver of Informed Consent and that are approved by the IRB on or after April 14, 2003, must also have a Waiver of Authorization approved by the IRB. For studies that the IRB approved with Waiver of Informed Consent before April 14th, no Waiver of Authorization is required.

A Waiver of Authorization does not mean your research is exempt from HIPAA’s privacy regulations. It only means you do not need signed authorization from each research subject.

To qualify for Waiver of Authorization, investigators should indicate that:

  • The research use of the health information does not represent more than a minimal risk to privacy
  • That the research could not be done without the requested health information
  • That it would not be practical to obtain signed authorizations from the research subjects
  • That the specific elements of health information that are requested are not more than the minimum necessary to accomplish the goals of the study.

The completed “Waiver of Authorization” form should be submitted to the IRB Office. The IRB will review the Waiver Request at either a full board meeting or through expedited review, consistent with the review process for the research application. If approved, the investigator will get a statement from the IRB indicating that the waiver has been granted. The investigator can take this form to the site (“covered entity”) that is holding the requested health information, indicating IRB approval of its release.

An additional important point: if investigators who receive health information under a Waiver of Authorization disclose any of that information to other investigators, institutions, or agencies, the investigator is responsible for keeping an accounting of disclosures. Under HIPAA, subjects can request a record of how often their health information was released to others in the previous six (6) year period. For health information obtained under a Waiver of Authorization, it is the investigator’s responsibility to provide this record of disclosures.

Minimum Necessary applies: When using or disclosing protected health information(PHI) or when requesting protected health information from another covered entitiy, a covered entity must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

To acquire health information from BMC for research purposes, present your approved request form to: Ellen Jamieson, Grants Administration, Gambro 2, 617-414-5646. She will direct you to the source of information you need.



July 29, 2012
Primary teaching affiliate
of BU School of Medicine