Instructions for Tracking of Disclosures

Disclosure means the release, transfer, provision of access to, or divulging in any other manner of protected/personally identifiable health information (PHI) to any person who is not participating in carrying out the research protocol, whether or not employed by Penn State Health or Penn State.

Federal privacy regulations require that a record be made of a disclosure of any personally identifiable health information that is made without an authorization by the research participant. Therefore, tracking of disclosures will have to be undertaken for all disclosures when:

  • there is a waiver of authorization,
  • there is an approval for review preparatory to research,
  • there is an approval for the use of a decedent’s PHI obtained for purposes of research, and
  • for any disclosures not previously specified in a signed authorization document.

WHEN THE REVIEW INVOLVES THE DISCLOSURE OF PHI FROM 50 OR FEWER PEOPLE

The following information about any disclosure must be recorded and made available to the IRB and the individual who is the subject of the PHI upon request:

  • Date of disclosure;
  • Name of person/entity that received the PHI;
  • Description of what PHI was disclosed; and
  • Brief statement regarding the purpose of the disclosure.

If a research protocol requires multiple disclosures to the same outside party over a period of time, the following information is adequate:

  • For the first disclosure, all of the above must be recorded.
  • For subsequent disclosures, tracking can refer to the initial record of disclosure and should include the frequency, periodicity or the number of disclosures that will be made; also, the date of the last disclosure must be documented.

WHEN THE REVIEW INVOLVES THE DISCLOSURE OF PHI FROM MORE THAN 50 PEOPLE

Federal privacy regulations allow a modified tracking method. In this instance it is unnecessary to maintain a list of the specific persons about whom PHI has been disclosed. The following information about any disclosure must be recorded and made available upon request to the IRB and any individual who may have been included in the review:

  • The name and description of the protocol;
  • Brief descriptions of types of PHI disclosed;
  • Dates or time periods during which disclosures occurred; and
  • Contact information (name, address, telephone number) for sponsors and recipient researchers.

In addition, the Penn State Health/Penn State researcher must also assist in contacting the sponsor and recipient researcher if it is reasonably likely that an individual’s PHI was disclosed to them.

Tracking information as required by privacy regulations must be maintained by the principal investigator at least six years, and made available to the Privacy Officer.