HIPAA Authorization Forms/Language. Unless a Relying Institution provides its own HIPAA authorization form/language, and subject to Section 4.4.3, a Reviewing IRB/Reviewing IRB Institution performing Ceded Review or an Exemption Determination on behalf of a Relying Institution that is a HIPAA Covered Entity will provide a HIPAA authorization form/language meeting the requirements of 45 CFR 164.508(b) and (c) as necessary to permit the use and disclosure of Protected Health Information (“PHI”) (defined in Exhibit A) for the Research. A Relying Institution will notify the Reviewing IRB/Reviewing IRB Institution of any Local Considerations (defined below) that require a HIPAA authorization form/language to be separate from any consent documents for the Research; in the absence of any such Local Considerations, the Reviewing IRB/Reviewing IRB Institution may (but is not required to) merge the HIPAA authorization form/language into the consent documents. If a Reviewing IRB/Reviewing IRB Institution identifies concerns about the content of a HIPAA authorization form/language provided by a Relying Institution as may affect the rights or welfare of Research participants, the Relying Institution will work with the Reviewing IRB/Reviewing IRB Institution to address such concerns. A Reviewing IRB/Reviewing IRB Institution is under no obligation to review the content of a HIPAA authorization form/language provided by a Relying Institution unless such HIPAA authorization form/language will be merged into the consent documents, and even in the circumstance of merged documents is under no obligation to ensure that a HIPAA authorization form/language provided by a Relying Institution meets the requirements of 45 CFR 164.508(b) and (c).
