Privacy Officer Core Responsibilities for Human Research Protection

1
Privacy Officer Core Responsibilities for Human
Research Protection

• Stephania H. Griffin, RHIA, CIPP/G
• VHA Privacy Officer

2
Responsibility of the Privacy Officers

• Non-voting Member of IRB or RD Committee
• Participate in IRB or RC Committee meetings in
  order to review research documentation and raise
  privacy issues directly to IRB or the RD
  Committee
• Final Privacy Review of Research
• Ensure legal authority exists prior to the use of
  Protected Health Information (PHI) for Research
  must review
• Protocol and Informed Consent, if applicable
• HIPAA-compliant authorization and/or
• IRB approval of waiver of HIPAA-compliant
  authorization and
• Appropriate agreements in instances where
  contractors will have access to PHI.

3
Responsibilities of the Privacy Officers

• Ensure legal authority exists prior to the
  disclosure of PHI to outside entities (e.g.,
  study sponsor) for Research must review
• HIPAA-compliant authorization or IRB approval of
  waiver of HIPAA-compliant authorization
• Authority exists for disclosure under Privacy Act
  and 38 USC 7332 and
• Ensure process exists for the maintenance of an
  accounting of all disclosures resulting from the
  Research.
• Ensure HIPAA-compliant Authorization is
  consistent with the Informed Consent.
• Final Review Required after IRB approval of
  research study and/or approval of waiver of
  HIPAA-compliant authorization, if applicable.

4
Responsibilities of the Privacy Officers

• Review each Protocol but not expected to
  understand all of the scientific language
• Your expertise is needed in the privacy legal
  requirements arena
• You are not approving the protocol
• Look for certain elements in the Protocol related
  to data use and data protection
• Look for inconsistencies
• Seek answers to any questions from the Principal
  Investigator, Research Compliance Officer,
  Research and Development administrator
• Communicate concerns/required changes to IRB or
  RD
• Review documents prior to the IRB meeting
• Provided you get the protocol and documents in a
  timely fashion

5
Responsibilities of the Privacy Officer

• Use the Research checklist as your road map
• Not mandatory to use but should be using some
  tool that is comparable to the checklist
• Use the checklist as your documenting tool to
  reflect changes to the protocol
• The Privacy Officer has distinct responsibilities
  but must work collaboratively with the other
  parts of the research team to accomplish the goal
  of an approved research protocol.