How should a site document a missing signature on a HIPAA authorization form?

Question: 

A subject in a clinical trial signed the informed consent document but did not sign the HIPAA authorization. Does this failure to obtain the subject’s signature need to be reported to the IRB or can the missing signature just be documented in a Note to File?

- Project Manager, Device Company

Response: 

Under the HIPAA Privacy Rule, an individual’s signed authorization allows the use or disclosure of the subject’s protected health information collected during the clinical trial. HIPAA authorizations for research can be either embedded within the research consent form or be separate from the research consent form.  When they are separate, an IRB may review the HIPAA authorization but does not have to do so. 

If the authorization has been reviewed and approved by the IRB, whether embedded or separate, then the failure to have the authorization signed should be reported to the IRB as noncompliance.  However, if the IRB did not review the authorization, then the failure to have the authorization signed should be reported to the privacy officer or other institutional office of the covered entity.

About the Author

David Forster, JD, MA, CIP | Chief Compliance Officer

Mr. Forster joined Western IRB (WIRB) in 1996 and is currently the Chief Compliance Officer for the WIRB-Copernicus Group (WCG). A strong advocate for human subject protections, Mr. Forster co-chairs the Secretary’s Advisory Committee on Human Research Protections (SACHRP) Sub-Committee on Harmonization. He previously served a four-year term as a member of SACHRP, and was previously a member of the SACHRP Sub-Committee on Inclusion of Individuals with Impaired Decision-Making in Research. Mr. Forster also served on the Certified IRB Professional (CIP) Council. Mr. Forster has a law degree and a Masters in Medical Ethics from the University of Washington.

Follow on Linkedin More Content by David Forster, JD, MA, CIP | Chief Compliance Officer
Previous Post
Should we create a protocol deviation for an unscheduled visit?
Should we create a protocol deviation for an unscheduled visit?

Next Post
Is IRB review required for publication of a case study?
Is IRB review required for publication of a case study?

Ask The IRB Experts

Submit Question