HIPAA Training for Institutional Review Board Administration Staff

Institutional Review Board (IRB) administration staff may handle research submissions that involve protected health information (PHI), even when they do not access clinical records themselves. Understanding the HIPAA Privacy Rule helps you route submissions, recognize the difference between research approval and permission to use PHI, and follow your institution’s privacy procedures.

HIPAA requirements depend on the organization’s role and the activity involved. An IRB’s review of a study does not, by itself, authorize every use or disclosure of PHI. The covered entity that holds the information remains responsible for ensuring that the proposed use or disclosure is permitted.

Which HIPAA rules apply to IRB administration staff?

The HIPAA Privacy Rule governs when covered entities may use or disclose PHI, including for research. The HIPAA Security Rule adds safeguards for electronic PHI, and the Breach Notification Rule addresses notification obligations following certain breaches. HIPAA generally applies to health plans, health care clearinghouses, certain health care providers, and their business associates—not automatically to every institution or IRB. See HHS guidance on covered entities and business associates.

An IRB is not necessarily a covered entity simply because it reviews research. But staff employed by a covered entity may be members of its workforce, and the entity must train its workforce on PHI policies and procedures as necessary and appropriate for their duties. An IRB office may also operate within a larger institution whose covered-entity status and workforce arrangements determine which policies apply.

A business associate is generally an outside person or organization performing certain functions or services for a covered entity that involve PHI. A covered entity’s workforce member is not a business associate. Also, a researcher receiving PHI for research is not automatically a business associate merely because the research is conducted for or funded by a covered entity; the person’s actual function matters. See HHS guidance on researchers and business associate agreements.

For staff, the practical starting point is to follow the institution’s privacy and security policies, know who is authorized to determine whether PHI may be used or disclosed, and refer uncertain requests to the privacy officer or other designated compliance contact.

How does the Privacy Rule affect IRB review of research?

The Privacy Rule sets conditions for covered entities’ use and disclosure of PHI for research. It does not replace the Common Rule or FDA human-subject protection requirements; where more than one framework applies, each must be considered separately. HHS explains the research provisions in its HIPAA and Research guidance.

When reviewing a protocol, staff may help identify whether a study proposes access to identifiable health information and what route the covered entity will rely on: a valid research authorization, a documented IRB or Privacy Board waiver or alteration of authorization, or another permitted pathway. The IRB’s human-subject review and the covered entity’s HIPAA determination are related, but they are not interchangeable.

For example, IRB approval of a study does not by itself constitute a HIPAA authorization waiver. Likewise, the Privacy Rule does not generally require an IRB to review every HIPAA authorization form. HHS notes that the covered entity remains responsible for ensuring an authorization is valid; other requirements may apply when authorization language is integrated into an informed-consent document. See HHS guidance on IRBs and HIPAA authorizations.

Research using properly de-identified information is not subject to the Privacy Rule’s research authorization provisions for PHI. By contrast, a limited data set remains protected health information and requires a data use agreement when used or disclosed for research under that pathway.

When can protected health information be used or disclosed for research?

A covered entity may use or disclose PHI for research when the individual has provided a valid research authorization that meets HIPAA requirements. Research authorization is distinct from informed consent: informed consent addresses participation in the study, while authorization permits specified uses or disclosures of identifiable health information.

When authorization is not obtained, the Privacy Rule permits certain research uses or disclosures through specific pathways, including documented approval of an alteration or waiver of authorization by an IRB or Privacy Board. Other pathways include reviews preparatory to research and research involving decedents’ PHI, subject to the applicable representations and conditions. See HHS’s overview of permitted research uses and disclosures.

For a waiver or alteration under the research provision, the IRB or Privacy Board must determine that the required criteria are met. These include that the PHI use or disclosure presents no more than minimal risk to privacy, that the research could not practicably be conducted without the waiver or alteration, and that it could not practicably be conducted without access to and use of PHI. The covered entity must obtain and retain the documentation specified by the rule before relying on this route. See 45 C.F.R. § 164.512(i).

Preparatory-to-research access is limited: the researcher must represent that the information is sought solely to prepare a research protocol or for similar purposes, will not be removed from the covered entity, and is necessary for the research purpose. It is not a general permission to take PHI away or begin study activities without an appropriate authorization or other permitted basis.

What role does an IRB play in HIPAA authorization waivers?

An IRB may approve an alteration or waiver of HIPAA authorization when it meets the Privacy Rule’s requirements and is acting as a qualifying IRB under the rule. A qualifying Privacy Board may also approve a waiver or alteration. The covered entity may rely on the waiver pathway only when it has the required documentation; IRB approval of the research alone is not enough.

Documentation for a waiver or alteration includes identification of the reviewing IRB or Privacy Board and the approval date, a statement that the required criteria were met, a brief description of the PHI necessary for the research, a statement about the review procedure, and the designated chair’s or member’s signature. Staff can help ensure the determination is routed and recorded according to institutional procedures, but should not substitute an informal note or general study approval for the required documentation.

A waiver may be partial. For instance, a board may approve access to contact information to recruit potential participants while requiring authorization for later research use of their PHI. HHS describes this distinction in its guidance on PHI access for research recruitment.

How should staff handle access to and disclosure of PHI?

Give staff access only when their assigned duties require it, and use approved systems and procedures to review, transmit, store, and discuss information. The covered entity must identify workforce roles that need access, the categories of PHI needed for each role, and applicable access conditions, then make reasonable efforts to limit access accordingly. See 45 C.F.R. § 164.514(d).

The minimum necessary standard generally calls for reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the purpose. It does not apply to every situation—for example, it does not apply to disclosures made pursuant to a valid authorization. For research disclosures, a covered entity may reasonably rely on appropriate documentation or representations from an IRB or Privacy Board about the minimum PHI needed, while retaining responsibility for its own obligations. See HHS guidance on the minimum necessary requirement.

Use institution-approved secure methods for sending documents, confirm the intended recipient and authorization to receive information, and avoid placing PHI in routine email or meeting materials unless permitted by policy. If information is misdirected, exposed, or accessed without authorization, report it promptly through the institution’s established privacy or security incident process so the responsible office can assess and respond.

When a request is unclear, incomplete, or inconsistent with the protocol’s approved PHI pathway, pause the disclosure and ask the privacy officer, research compliance office, or other designated institutional contact to review it. Do not assume that a study number, IRB approval, or confidentiality statement alone makes a disclosure permissible.

What training and documentation support HIPAA compliance?

Training should match staff responsibilities. Relevant topics may include recognizing PHI, distinguishing authorization from informed consent, identifying the approved research pathway, applying role-based access rules, using secure communication methods, and reporting suspected incidents. Covered entities must train workforce members on applicable PHI policies and procedures as necessary and appropriate to their functions, including new workforce members within a reasonable period and affected staff after material policy changes. The rule also requires the covered entity to document that required training was provided. See 45 C.F.R. § 164.530(b) and (j).

HIPAA does not establish a universal annual training schedule or require every employee to earn an individual HIPAA certificate. An employer may set its own recurring training and certificate requirements. Completing a training course or receiving a certificate documents individual learning; it does not, by itself, establish that the institution or IRB is HIPAA compliant.

Depending on the staff member’s role, useful records may include training completion, current access approvals, waiver or authorization documentation, applicable data use agreements, and incident reports. The covered entity must retain documentation required by the Privacy Rule for six years from its creation or the date it was last in effect, whichever is later. Institutional policy may set additional documentation expectations.

In short, effective HIPAA training helps IRB administration staff recognize when PHI is involved, route authorization and waiver decisions correctly, restrict access to job-related needs, and maintain the records required by institutional policy and applicable rules.

FAQs.

Do IRB administration staff need HIPAA training?

If IRB administration staff are members of a covered entity’s workforce, the covered entity must train them on PHI policies and procedures as necessary and appropriate for their duties. The training should reflect their actual access and responsibilities. HIPAA does not impose one universal annual training schedule or require a personal certificate for every staff member.

When is HIPAA authorization required for research?

When a covered entity uses or discloses identifiable PHI for research, it generally needs a valid individual authorization unless another Privacy Rule permission applies. Examples of alternatives include a qualifying IRB or Privacy Board waiver or alteration, a permitted preparatory-to-research review, research involving decedents’ PHI under the rule’s conditions, or a limited data set with a data use agreement.

Can an IRB waive HIPAA authorization?

Yes. A qualifying IRB or Privacy Board may approve a waiver or alteration if the Privacy Rule’s criteria are met and the required documentation is obtained. The covered entity must have that documentation before relying on this pathway. Ordinary IRB approval of a study does not automatically waive HIPAA authorization.

What is the minimum necessary standard for research PHI?

It generally requires covered entities to make reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the purpose, when the standard applies. For research, a covered entity may reasonably rely on appropriate IRB or Privacy Board documentation about the PHI needed. The standard has exceptions, including disclosures made pursuant to a valid authorization.