HRPP Newsletter – May 2025

New HIPAA Guidance 

The Office of Compliance has posted two new guidance documents for researchers:

HIPAA guidance for non-HCC members' access to PHI through contractual agreements 

This document is for those individuals who are appointed or enrolled outside the Health Care Component (HCC), not brought into the HCC by other policy or regulation, and would like to receive access to protected health information (PHI) under a contractual agreement.

International Human Subjects Research Process Guidance 

This guidance is for research teams engaged in international studies with human subjects data, where the data is coming into the university from external sources. These steps can be taken concurrently.

Reminder: PIs going on leave 

Temporary changes in PI may be needed if the PI cannot provide oversight of a research study for a planned period of time (e.g., parental leave, sabbatical) or unplanned leave for a substantial period of time. For federally funded research, it is the responsibility of the PI to ensure that funding agencies are notified of any temporary changes.

In cases where the leave will be less than 6 weeks, but is assumed to be temporary, the PI is responsible either for ceasing study activities or ensuring oversight of these activities is delegated to a qualified member of the study team. The study team does not need to inform the IRB in these cases.

In cases where the leave will be 6 weeks or longer and the PI cannot provide research oversight, but the leave is assumed to be temporary, the study team should submit a New Information Report. Additional information about what should be in this report, along with other information related to PI changes, can be found here in our Investigator Manual.

Discretionary Certificates of Confidentiality (CoCs)

The NIH is currently not issuing CoCs for non-NIH funded research.  Study teams collecting highly sensitive data should check the NIH website periodically and, if/when available again, submit a Change of Protocol to request a discretionary CoC.  In the meantime, study teams should work with their IRB analyst to determine what additional data protection measures may be appropriate, such as altering the study design to not collect identifiers, if possible; confirming that identifiers will be destroyed at the earliest possible time; and/or including the following italicized text below in the consent form in the “What happens to the information collected for the research?” section:

“However, we cannot promise complete confidentiality. We will share information with individuals or organizations identified in this consent form. Federal or state laws may permit or require us to show information to university or government officials [and to study sponsors] responsible for carrying out or monitoring this study. This includes University of Wisconsin and its representatives and affiliates, including those responsible for ensuring compliance, such as the Human Research Protection Program.  In addition, while the university will strive to protect your data, in the rare instance that the university receives a court order to disclose data, it must comply.”