Alteration or waiver of HIPAA Authorization

version February 2025

The IRB, acting as a privacy board, is asked to approve a waiver or alteration of patient authorization for the use of or disclosure of PHI. In order to grant this waiver, the IRB must be able to determine that the alteration or waiver of authorization satisfies all of the criteria below. Provide sufficient information below to support elements A-C:

(A)    That the use of disclosure of PHI involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:

i.    An adequate plan to protect the identifiers from improper use and disclosure;


ii.    An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and


iii.    Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, or for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted by this subpart;


(B)    That the research could not practicably be conducted without the waiver or alteration; and

(C)    That the research could not practicably be conducted without access to and use of the protected health information.

Waiver type*