My institution is not a Covered Entity. Can it still act as the Reviewing IRB for a Relying Institution that is a Covered Entity?
Yes. The Reviewing IRB does not need to be a Covered Entity or part of a Covered Entity itself in order to make HIPAA determinations on behalf of the Relying Institution to permit the use and disclosure of PHI for research. However, in recognition that some Relying Institutions may not be comfortable with a Reviewing IRB making these HIPAA determinations on its behalf (for example, when the Reviewing IRB does not regularly make such determinations), the Agreement allows a Relying Institution to request, and the Reviewing IRB to agree, that the Relying Institution use its own freestanding HIPAA authorization form (when authorization is required) or conduct the review of a request for waiver/alteration of authorization itself (when waiver/alteration is requested).
In the rare case when a Reviewing IRB is not willing to make any necessary HIPAA determinations to permit use/disclosure of PHI (for example, if an institution that is not a Covered Entity has indicated that its IRB will not perform such determinations), a Relying Institution that is a Covered Entity must make its own such determinations. If in such case a Relying Institution determines that individual authorization is required, it must use its own form of authorization language, which must be a freestanding form separate from the informed consent documents, and the Relying Institution would be responsible for ensuring the HIPAA authorization form is compliant with HIPAA’s requirements for authorizations and is consistent with the IRB-approved consent form and protocol.
Prior to participating in a determination of the acceptability of Ceded Review for a given research study, a potential Reviewing IRB must inform all Participating Institutions involved in the research if it will not perform HIPAA-related determinations.