HIPAA Compliance Checklist for Central IRB Review Offices

This checklist equips you to standardize HIPAA oversight across multi-site studies, reduce privacy risk, and document defensible decisions. Use it to verify legal pathways for PHI use, enforce the Minimum Necessary Standard, and operationalize security controls that withstand audits.

IRB's Role in HIPAA Compliance

Core responsibilities

• Confirm whether the central IRB also serves as the HIPAA Privacy Board and, if so, document that authority.
• Ensure each protocol identifies a lawful basis for PHI use or disclosure before PHI flows.
• Check that site reliance arrangements address HIPAA roles, data flows, and documentation ownership.
• Require role definitions, user provisioning plans, and recordkeeping that align with Minimum Necessary.

PHI Privacy Risk Assessment

For each study, require a PHI Privacy Risk Assessment that maps data elements to purpose, collection method, storage location, recipients, retention, and destruction. Rate residual risks and specify mitigations such as redaction, coding, or a limited data set.

Documentation you must retain

• Signed HIPAA authorizations or approved HIPAA Authorization Waiver/alteration determinations.
• Data Use Agreement (for limited data sets), de-identification attestations, and reliance agreements.
• Audit and meeting records, including who reviewed what, when, and the decision rationale.

Determining HIPAA Applicability

When HIPAA applies

• PHI originates from a covered entity or its business associate and includes identifiers plus health information.
• Your IRB or a coordinating center is itself part of a covered entity or acting as a business associate.

Data classifications that drive requirements

• PHI: full identifiers with health data; HIPAA applies.
• Limited Data Set: excludes direct identifiers but may include dates, city, state, ZIP; requires a Data Use Agreement.
• De-identified data: safe harbor or expert determination; not PHI once de-identified.

Practical decision flow

• Is any PHI needed? If no, document de-identification or non-HIPAA status and proceed.
• If yes, identify the legal pathway (authorization, waiver, LDS+DUA, preparatory to research, or decedent research).
• Map where PHI will be accessed, stored, transmitted, and who will see it; apply Minimum Necessary.

Legal Pathways for PHI Use

HIPAA authorization

Use a plain-language authorization that specifies what PHI will be used, by whom, to whom it may be disclosed, the purpose, expiration, revocation rights, and required statements. Combine with informed consent when appropriate, but keep HIPAA-required elements intact.

HIPAA Authorization Waiver or alteration (Privacy Board)

• Document minimal risk to privacy with a plan to protect and destroy identifiers and assurances against improper reuse.
• Show why research is impracticable without the waiver and without access to PHI.
• Record scope, data elements approved, and expiration or review cycle.

Preparatory to research

Permit access to PHI solely to design a study or assess feasibility; no PHI leaves the covered entity and no recruitment occurs based only on this access. Require researcher representations and logging.

Research solely on decedents’ information

Obtain researcher representations that the PHI sought is exclusively about decedents and is necessary; require documentation as needed (for example, proof of death maintained by the covered entity).

Limited Data Set with a Data Use Agreement

• Define permitted uses and users, prohibit re-identification or contact, and require safeguards and breach reporting.
• List specific fields to be shared and retention/destruction terms.

De-identified data

Verify de-identification via safe harbor (all direct identifiers removed) or expert determination. Keep the attestation with the IRB file and confirm that re-identification risk is managed if codes are used.

Minimum Necessary Standard Implementation

Practical steps

• Translate study aims into a field-level inventory; justify each PHI element against the purpose.
• Use Role-Based Access Control so users only see fields needed to perform assigned tasks.
• Apply data minimization tactics: masking, date shifting, binning ages, or switching to an LDS where feasible.
• Require short-lived access tokens, time-bounded accounts, and periodic revalidation of access.

Exceptions and reminders

Minimum Necessary does not apply to disclosures to the individual, uses or disclosures pursuant to a valid authorization, or disclosures for treatment. It does apply to most research disclosures under a waiver or LDS.

Verification and sign-off

• Have a privacy reviewer or the Privacy Board sign off on the final PHI inventory.
• Capture approvals in your Audit Trail Management system and align with the PHI Privacy Risk Assessment.

Access Controls and Auditability

Role-Based Access Control

• Define roles (e.g., IRB reviewer, coordinator, statistician) and least-privilege permissions per role.
• Issue unique user IDs, require multi-factor authentication, and prohibit shared accounts.
• Implement joiner–mover–leaver workflows to grant, modify, and promptly revoke access.

Audit Trail Management

• Log who accessed what, when, from where, and which action was taken (view, export, delete).
• Alert on anomalous events (bulk exports, after-hours spikes, access outside assigned roles).
• Retain logs and HIPAA-related decisions for at least six years to align with documentation requirements.
• Review logs on a defined cadence; document findings and remediation.

Data request governance

• Use standardized data request forms that capture justification, data elements, recipients, and retention.
• Track approvals, expirations, and downstream sharing in a centralized register.

Security and Administrative Safeguards

Administrative safeguards

• Conduct periodic risk analysis and maintain an Incident Response Policy with roles, contact trees, and playbooks.
• Train workforce annually on HIPAA, phishing, secure data handling, and sanctions for violations.
• Execute business associate agreements where vendors touch PHI; assess vendors before onboarding.

Technical safeguards and Encryption Standards

• Encrypt data at rest (e.g., AES-256) and in transit (e.g., TLS 1.2+); manage keys securely and rotate routinely.
• Harden endpoints with patching, EDR, disk encryption, and mobile device management.
• Segment networks, restrict administrative access, and use secure file transfer for data exchanges.
• Back up systems regularly and test restoration; securely dispose of media.

Physical safeguards

• Control facility access, secure workstations and paper records, and enforce clean-desk practices.
• Use locked storage for removable media; maintain visitor logs where appropriate.

Data Breach Handling Procedures

Immediate actions (IRB playbook)

• Contain: halt affected systems or data flows; preserve evidence and audit logs.
• Notify: escalate to privacy/security officers, site leads, and sponsors per the Incident Response Policy.
• Triage: identify data elements, affected individuals, systems, and jurisdictions.

Breach risk assessment

• Assess the nature and extent of PHI involved, including sensitivity and likelihood of re-identification.
• Identify the unauthorized person who used or received the PHI and whether it was actually viewed or acquired.
• Evaluate mitigation (e.g., retrieval, deletion confirmation, or strong encryption in place).

Notifications and reporting timelines

• Provide individual notifications without unreasonable delay and no later than 60 calendar days after discovery.
• Report to regulators consistent with thresholds (including HHS reporting) and notify media if large-scale impacts occur.
• Coordinate with sites to avoid duplicate or conflicting notices; maintain a single source of truth.

Post-incident remediation

• Document root cause, sanctions, and corrective actions (policy updates, retraining, technical controls).
• Amend or terminate Data Use Agreements as needed; reassess Minimum Necessary and access scopes.
• Close the loop with a written after-action report and measurable follow-ups.

Conclusion

By verifying a lawful pathway for PHI, enforcing Minimum Necessary with Role-Based Access Control, maintaining robust Audit Trail Management, and executing strong Encryption Standards and response playbooks, you create a repeatable HIPAA compliance program that protects participants and withstands scrutiny.

FAQs

What are the key HIPAA requirements for central IRB review offices?

Confirm a legal basis for PHI use (authorization, waiver, LDS+DUA, etc.), implement the Minimum Necessary Standard, enforce access controls with auditability, secure PHI through administrative/technical/physical safeguards, and maintain documented approvals and logs for at least six years. Coordinate breach handling and vendor oversight where PHI flows to third parties.

How does an IRB assess legal pathways for PHI use?

Start by determining whether HIPAA applies, then map the data and recipients. Select the appropriate pathway—authorization, HIPAA Authorization Waiver or alteration, preparatory to research, decedent research, or a limited data set with a Data Use Agreement—and document the justification, scope, and expiration or review cycle.

What safeguards are essential to comply with the Minimum Necessary Standard?

Use Role-Based Access Control to limit who can see which fields, require field-level PHI inventories tied to study aims, minimize or mask data where feasible, apply time-bounded access, and obtain privacy reviewer sign-off. Capture decisions and monitoring in your Audit Trail Management system.

How should data breaches be handled under HIPAA by IRBs?

Follow your Incident Response Policy: contain, notify, and assess risk using HIPAA’s factors. Provide individual notifications without unreasonable delay and no later than 60 days where required, report to regulators according to thresholds, coordinate with sites and sponsors, and complete post-incident remediation with documented corrective actions.