HIPAA - Coded Information

This information was extracted from federal OHRP-HHS policy dated October, 16, 2008:

https://www.hhs.gov/ohrp/regulations-and-policy/guidance/research-involving-coded-private-information/index.html

For purposes of this document,  coded means that:

1. identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and
2. a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.

Federal OHRP considers the term  investigator to include anyone involved in conducting the research. OHRP does not consider the act of solely providing coded private information or specimens (for example, by a tissue repository) to constitute involvement in the conduct of the research. Note that if the individuals who provide coded information or specimens collaborate on other activities related to the conduct of this research with the investigators who receive such information or specimens, then OHRP would consider such additional activities to constitute involvement in the conduct of the research. Examples of such additional activities include, but are not limited to: (1) the study, interpretation, or analysis of the data resulting from the coded information or specimens; and (2) authorship of presentations or manuscripts related to the research.

Guidance

Under the definition of human subject at 45 CFR 46.102(f),  obtaining identifiable private information or identifiable specimens for research purposes constitutes human subjects research.  Obtaining identifiable private information or identifiable specimens includes, but is not limited to:

1. using, studying, or analyzing for research purposes identifiable private information or identifiable specimens that have been provided to investigators from any source; and
2. using, studying, or analyzing for research purposes identifiable private information or identifiable specimens that were already in the possession of the investigator.

In general, OHRP considers private information or specimens to be individually identifiable as defined at 45 CFR 46.102(f) when they can be linked to specific individuals by the investigator(s) either directly or indirectly through coding systems.

Conversely, OHRP considers private information or specimens not to be individually identifiable when they cannot be linked to specific individuals by the investigator(s) either directly or indirectly through coding systems. For example, OHRP does not consider research involving  only coded private information or specimens to involve human subjects as defined under 45 CFR 46.102(f) if the following conditions are both met:

1. the private information or specimens were not collected specifically for the currently proposed research project through an interaction or intervention with living individuals; and
2. the investigator(s) cannot readily ascertain the identity of the individual(s) to whom the coded private information or specimens pertain because, for example:
   1. the investigators and the holder of the key enter into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased (note that the HHS regulations do not require the IRB to review and approve this agreement);
   2. there are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigators under any circumstances, until the individuals are deceased; or
   3. there are other legal requirements prohibiting the release of the key to the investigators, until the individuals are deceased.

This guidance applies to existing private information and specimens, as well as to private information and specimens to be collected in the future for purposes other than the currently proposed research. The following are examples of private information or specimens that will be collected in the future for purposes other than the currently proposed research: (1) medical records; and (2) ongoing collection of specimens for a tissue repository.

In some cases an investigator who obtains coded private information or specimens about living individuals under one of the conditions cited in 2(a)-(c) above may (1) unexpectedly learn the identity of one or more living individuals, or (2) for previously unforseen reasons now believe that it is important to identify the individual(s). If, as a result, the investigator knows, or may be able to readily ascertain, the identity of the individuals to whom the previously obtained private information or specimens pertain, then the research activity now would involve human subjects under the HHS regulations. Unless this human subjects research is determined to be exempt under HHS regulations at 45 CFR 46.101(b), IRB review of the research would be required. Informed consent of the subjects also would be required unless the IRB approved a waiver of informed consent under HHS regulations at 45 CFR part 46.116(c) or (d).

Who Should Determine Whether Human Subjects are Involved in Research

OHRP recommends that institutions have policies in place that designate the individual or entity authorized to determine whether research involving coded private information or specimens constitutes human subjects research. The person(s) authorized to make the determination should be knowledgeable about the human subject protection regulations. In addition, the institution should ensure the appropriate communication of such a policy to all investigators. OHRP recommends that investigators not be given the authority to make an independent determination that research involving coded private information or specimens does not involve human subjects.