<\/p>\n
[\/et_pb_text][et_pb_text _builder_version=”4.27.4″ background_pattern_color=”rgba(0,0,0,0.2)” background_mask_color=”#ffffff” text_text_shadow_horizontal_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_horizontal_length_tablet=”0px” text_text_shadow_vertical_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_vertical_length_tablet=”0px” text_text_shadow_blur_strength=”text_text_shadow_style,%91object Object%93″ text_text_shadow_blur_strength_tablet=”1px” link_text_shadow_horizontal_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_horizontal_length_tablet=”0px” link_text_shadow_vertical_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_vertical_length_tablet=”0px” link_text_shadow_blur_strength=”link_text_shadow_style,%91object Object%93″ link_text_shadow_blur_strength_tablet=”1px” ul_text_shadow_horizontal_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_horizontal_length_tablet=”0px” ul_text_shadow_vertical_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_vertical_length_tablet=”0px” ul_text_shadow_blur_strength=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_blur_strength_tablet=”1px” ol_text_shadow_horizontal_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_horizontal_length_tablet=”0px” ol_text_shadow_vertical_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_vertical_length_tablet=”0px” ol_text_shadow_blur_strength=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_blur_strength_tablet=”1px” quote_text_shadow_horizontal_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_horizontal_length_tablet=”0px” quote_text_shadow_vertical_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_vertical_length_tablet=”0px” quote_text_shadow_blur_strength=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_blur_strength_tablet=”1px” header_text_shadow_horizontal_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength=”header_text_shadow_style,%91object Object%93″ header_text_shadow_blur_strength_tablet=”1px” header_2_text_shadow_horizontal_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_horizontal_length_tablet=”0px” header_2_text_shadow_vertical_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_vertical_length_tablet=”0px” header_2_text_shadow_blur_strength=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_blur_strength_tablet=”1px” header_3_text_shadow_horizontal_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_horizontal_length_tablet=”0px” header_3_text_shadow_vertical_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_vertical_length_tablet=”0px” header_3_text_shadow_blur_strength=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_blur_strength_tablet=”1px” header_4_text_shadow_horizontal_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_horizontal_length_tablet=”0px” header_4_text_shadow_vertical_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_vertical_length_tablet=”0px” header_4_text_shadow_blur_strength=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_blur_strength_tablet=”1px” header_5_text_shadow_horizontal_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_horizontal_length_tablet=”0px” header_5_text_shadow_vertical_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_vertical_length_tablet=”0px” header_5_text_shadow_blur_strength=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_blur_strength_tablet=”1px” header_6_text_shadow_horizontal_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_horizontal_length_tablet=”0px” header_6_text_shadow_vertical_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_vertical_length_tablet=”0px” header_6_text_shadow_blur_strength=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ z_index_tablet=”0″]<\/p>\n
Compliance Overview: <\/span>Health Insurance Portability and Accountability Act<\/span> (HIPAA) and Institutional Review Board (IRB) Requirements<\/span><\/strong><\/h1>\n\u00a0<\/h2>\n\u00a0<\/h2>\nSteps to Obtain <\/span><\/span><\/span>IRB Approval <\/span><\/span><\/span><\/strong><\/span>and Data Access<\/span><\/span><\/strong><\/span>\u200b<\/span><\/span><\/h2>\n![](\"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-content\/uploads\/sites\/342\/2025\/11\/HIPAA-IRB-slides-for-AIR-MS_Nov_6_2025_ET-1.jpg\")
\u00a0<\/p>\n
\u00a0<\/h2>\nOverview<\/span><\/strong><\/h2>\nResearch involves several important compliance steps\u2014such as preparing a strong IRB protocol, defining clear inclusion and exclusion criteria, completing data use agreements (DUAs), and securing appropriate computational resources. Although this process may seem daunting, it is designed to be as efficient as possible and to ensure that studies are conducted responsibly and accurately. By following the guidelines below, researchers can complete their projects effectively while safeguarding patient privacy. Key concepts researchers should be aware of are:<\/span><\/p>\n\n- HIPAA\u00a0<\/span><\/strong><\/li>\n
- Identified vs. De-Identified Data<\/span><\/strong><\/li>\n
- HIPAA Minimum Necessary Rule and Inclusion \/ Exclusion Criteria<\/span><\/strong><\/li>\n
- IRB<\/span><\/strong><\/li>\n<\/ul>\n
\u00a0<\/h2>\nWhat is HIPAA?\u200b<\/span><\/strong><\/h2>\nHIPAA<\/span><\/b><\/a>\u00a0establishes <\/span><\/span>national standards for guarding protected health information (PHI)<\/b>\u00a0and promotes the\u00a0secure, ethical use of medical data<\/b> in both healthcare and research.\u200b<\/span><\/p>\nImportance of HIPAA<\/b><\/span>\u200b<\/span><\/p>\n\n- Protects Patient Privacy – <\/b>Safeguards all PHI from unauthorized access or disclosure.\u200b<\/span><\/li>\n
- Ensures Data Security – <\/b>Requires administrative, physical, and technical safeguards to keep health data secure.\u200b<\/span><\/li>\n
- Empowers Patients – <\/b>Gives patients rights to access, review, and request corrections to their medical records.\u200b<\/span><\/li>\n
- Standardizes Practices – <\/b>Sets national standards for healthcare transactions and data sharing.\u200b<\/span><\/li>\n
- Supports Insurance Portability – <\/b>Ensures patients can maintain health insurance coverage when changing jobs and prohibits discrimination based on pre-existing conditions.\u200b<\/span><\/li>\n
- Enforces Accountability – <\/b>Establishes penalties for violations and promotes compliance across all healthcare entities.<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nIdentified vs. De-Identified Data<\/span><\/strong><\/h2>\nThe first question researchers need to ask when working with health data is if they need de-identified or identified data:<\/span><\/p>\n![](\"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-content\/uploads\/sites\/342\/2025\/11\/De-ID-and-ID-Figure-e1763589835893.jpg\")
<\/p>\n
Based on this critical decision, the use of identified \/ de-identified data will determine how the IRB protocol, your inclusion\/exclusion criteria, and other project requirements are drafted.<\/span><\/p>\n\u00a0<\/h2>\nMinimum Necessary Information Requirement<\/span><\/strong><\/h2>\nHIPAA requires that only the minimum necessary information be provided for a specific research question. The minimum necessary rule can be found here:<\/span> Minimum Necessary Requirement | HHS.gov<\/a>.<\/p>\nThis is a critical rule to address when getting data for research: projects must have a focused project question, and clear inclusion \/ exclusion criteria. While it’s tempting to ask for all possible data and explore that data, this can increase the risk to patients if data were accidentally to leak to the public, if it were released through hacking, etc. So, at all times, only the smallest necessary dataset should be provided to researchers to address their questions.\u00a0<\/span><\/p>\nKey to this minimum necessary information requirement is well-defined inclusion \/ exclusion criteria. Here’s an example of some well-defined criteria:<\/span><\/p>\n![](\"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-content\/uploads\/sites\/342\/2025\/11\/HIPAA-IRB-slides-for-AIR-MS_Nov_6_2025_ET_3.jpg\")
<\/p>\n
\u200b<\/h2>\nThe Institutional Review Board\u00a0<\/span><\/strong><\/h2>\n\n- An <\/span>IRB<\/span><\/b><\/a>\u00a0<\/a>is a federally mandated ethics committee that reviews research involving human participants to ensure it is\u00a0ethical, scientifically sound, and minimizes risk<\/b>.\u200b<\/span><\/li>\n
- The IRB\u2019s mission is to\u00a0protect the rights, welfare, and privacy<\/b>\u00a0of human subjects while supporting responsible scientific advancement.\u200b<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nWhy the IRB Matters\u200b<\/span><\/strong><\/h2>\n\n- Protects Participants:\u00a0<\/b>Reviews and approves studies to safeguard participants\u2019 rights and well-being.\u200b<\/span><\/li>\n
- Balances Risk and Benefit:\u00a0<\/b>Evaluates potential risks and ensures they are justified by the expected research benefits.\u200b<\/span><\/li>\n
- Ensures Ethical Conduct:\u00a0<\/b>Confirms research follows federal regulations, Mount Sinai policies, and ethical standards.\u200b<\/span><\/li>\n
- Validates Scientific Design:\u00a0<\/b>Reviews study methods to ensure sound, justified, and transparent research practices.\u200b<\/span><\/li>\n
- Crucial Distinction for AIR\u00b7MS Access:\u00a0<\/b>Access to PHI via Artificial Intelligence-Ready Mount Sinai (AIR\u00b7MS) requires IRB approval.<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nFrequently Asked Questions<\/span><\/strong><\/h2>\nQ: What are HIPAA compliant environments?<\/b><\/span>\u200b<\/span><\/p>\nA: These are secure systems or platforms that meet HIPAA standards for guarding protected health information through proper encryption, access controls, and auditing.\u200b<\/span><\/p>\nQ: What\u2019s the difference between identified and de-identified data?<\/b><\/span>\u200b<\/span><\/p>\nA: <\/i>Identified data<\/i>\u00a0includes personal information that can directly or indirectly identify an individual (e.g., name, date of birth).\u200bDe-identified data<\/i>\u00a0has had all identifiers removed so individuals cannot reasonably be identified.\u200b<\/span><\/p>\nQ: What is the purpose of the minimum necessary rule?<\/b><\/span>\u200b<\/span><\/p>\nA: It limits access to or use of PHI to the smallest amount needed to accomplish a task or purpose.\u200b<\/span><\/p>\nQ: Where can I learn more about inclusion\/exclusion criteria for datasets at Mount Sinai?<\/b><\/span>\u200b<\/span><\/p>\nA: You can learn more about inclusion and exclusion criteria for datasets at Mount Sinai by visiting the Mount Sinai Data Warehouse<\/a> or Research Informatics website, or by contacting the Mount Sinai IRB or data governance office<\/a> for specific dataset documentation and guidance.<\/span><\/p>\nQ: How long does IRB protocol approval take?<\/b><\/span>\u200b<\/span><\/p>\nA: Typically, IRB approval can take anywhere from a few weeks to several months, depending on the complexity of the study and the review type (expedited, exempt, or full board).\u200b<\/span><\/p>\nQ: What\u2019s a DUA and why do I need to sign it?<\/b><\/span>\u200b<\/span><\/p>\nA: A DUA<\/i>\u00a0is a legal contract that governs the sharing of restricted or limited-use data. It protects privacy and\u00a0defines how the data can be used and safeguarded.\u200b<\/span><\/p>\n\u200b<\/span><\/p>\n\u200b<\/p>\n
[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div> Scientific Computing and Data \/ AIR\u00b7MS (AI Ready Mount Sinai) \/ Compliance Overview (HIPAA and IRB Requirements) Compliance Overview: Health Insurance Portability and Accountability Act (HIPAA) and Institutional Review Board (IRB) Requirements\u00a0\u00a0Steps to Obtain IRB Approval and Data Access\u200b\u00a0\u00a0OverviewResearch involves several important compliance steps\u2014such as preparing a strong IRB protocol, defining clear inclusion […]<\/p>\n","protected":false},"author":699,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"class_list":["post-12636","page","type-page","status-publish","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/users\/699"}],"replies":[{"embeddable":true,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/comments?post=12636"}],"version-history":[{"count":51,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636\/revisions"}],"predecessor-version":[{"id":12844,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636\/revisions\/12844"}],"wp:attachment":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/media?parent=12636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u00a0<\/h2>\nSteps to Obtain <\/span><\/span><\/span>IRB Approval <\/span><\/span><\/span><\/strong><\/span>and Data Access<\/span><\/span><\/strong><\/span>\u200b<\/span><\/span><\/h2>\n
\u00a0<\/p>\n
\u00a0<\/h2>\nOverview<\/span><\/strong><\/h2>\nResearch involves several important compliance steps\u2014such as preparing a strong IRB protocol, defining clear inclusion and exclusion criteria, completing data use agreements (DUAs), and securing appropriate computational resources. Although this process may seem daunting, it is designed to be as efficient as possible and to ensure that studies are conducted responsibly and accurately. By following the guidelines below, researchers can complete their projects effectively while safeguarding patient privacy. Key concepts researchers should be aware of are:<\/span><\/p>\n\n- HIPAA\u00a0<\/span><\/strong><\/li>\n
- Identified vs. De-Identified Data<\/span><\/strong><\/li>\n
- HIPAA Minimum Necessary Rule and Inclusion \/ Exclusion Criteria<\/span><\/strong><\/li>\n
- IRB<\/span><\/strong><\/li>\n<\/ul>\n
\u00a0<\/h2>\nWhat is HIPAA?\u200b<\/span><\/strong><\/h2>\nHIPAA<\/span><\/b><\/a>\u00a0establishes <\/span><\/span>national standards for guarding protected health information (PHI)<\/b>\u00a0and promotes the\u00a0secure, ethical use of medical data<\/b> in both healthcare and research.\u200b<\/span><\/p>\nImportance of HIPAA<\/b><\/span>\u200b<\/span><\/p>\n\n- Protects Patient Privacy – <\/b>Safeguards all PHI from unauthorized access or disclosure.\u200b<\/span><\/li>\n
- Ensures Data Security – <\/b>Requires administrative, physical, and technical safeguards to keep health data secure.\u200b<\/span><\/li>\n
- Empowers Patients – <\/b>Gives patients rights to access, review, and request corrections to their medical records.\u200b<\/span><\/li>\n
- Standardizes Practices – <\/b>Sets national standards for healthcare transactions and data sharing.\u200b<\/span><\/li>\n
- Supports Insurance Portability – <\/b>Ensures patients can maintain health insurance coverage when changing jobs and prohibits discrimination based on pre-existing conditions.\u200b<\/span><\/li>\n
- Enforces Accountability – <\/b>Establishes penalties for violations and promotes compliance across all healthcare entities.<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nIdentified vs. De-Identified Data<\/span><\/strong><\/h2>\nThe first question researchers need to ask when working with health data is if they need de-identified or identified data:<\/span><\/p>\n<\/p>\n
Based on this critical decision, the use of identified \/ de-identified data will determine how the IRB protocol, your inclusion\/exclusion criteria, and other project requirements are drafted.<\/span><\/p>\n\u00a0<\/h2>\nMinimum Necessary Information Requirement<\/span><\/strong><\/h2>\nHIPAA requires that only the minimum necessary information be provided for a specific research question. The minimum necessary rule can be found here:<\/span> Minimum Necessary Requirement | HHS.gov<\/a>.<\/p>\nThis is a critical rule to address when getting data for research: projects must have a focused project question, and clear inclusion \/ exclusion criteria. While it’s tempting to ask for all possible data and explore that data, this can increase the risk to patients if data were accidentally to leak to the public, if it were released through hacking, etc. So, at all times, only the smallest necessary dataset should be provided to researchers to address their questions.\u00a0<\/span><\/p>\nKey to this minimum necessary information requirement is well-defined inclusion \/ exclusion criteria. Here’s an example of some well-defined criteria:<\/span><\/p>\n<\/p>\n
\u200b<\/h2>\nThe Institutional Review Board\u00a0<\/span><\/strong><\/h2>\n\n- An <\/span>IRB<\/span><\/b><\/a>\u00a0<\/a>is a federally mandated ethics committee that reviews research involving human participants to ensure it is\u00a0ethical, scientifically sound, and minimizes risk<\/b>.\u200b<\/span><\/li>\n
- The IRB\u2019s mission is to\u00a0protect the rights, welfare, and privacy<\/b>\u00a0of human subjects while supporting responsible scientific advancement.\u200b<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nWhy the IRB Matters\u200b<\/span><\/strong><\/h2>\n\n- Protects Participants:\u00a0<\/b>Reviews and approves studies to safeguard participants\u2019 rights and well-being.\u200b<\/span><\/li>\n
- Balances Risk and Benefit:\u00a0<\/b>Evaluates potential risks and ensures they are justified by the expected research benefits.\u200b<\/span><\/li>\n
- Ensures Ethical Conduct:\u00a0<\/b>Confirms research follows federal regulations, Mount Sinai policies, and ethical standards.\u200b<\/span><\/li>\n
- Validates Scientific Design:\u00a0<\/b>Reviews study methods to ensure sound, justified, and transparent research practices.\u200b<\/span><\/li>\n
- Crucial Distinction for AIR\u00b7MS Access:\u00a0<\/b>Access to PHI via Artificial Intelligence-Ready Mount Sinai (AIR\u00b7MS) requires IRB approval.<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nFrequently Asked Questions<\/span><\/strong><\/h2>\nQ: What are HIPAA compliant environments?<\/b><\/span>\u200b<\/span><\/p>\nA: These are secure systems or platforms that meet HIPAA standards for guarding protected health information through proper encryption, access controls, and auditing.\u200b<\/span><\/p>\nQ: What\u2019s the difference between identified and de-identified data?<\/b><\/span>\u200b<\/span><\/p>\nA: <\/i>Identified data<\/i>\u00a0includes personal information that can directly or indirectly identify an individual (e.g., name, date of birth).\u200bDe-identified data<\/i>\u00a0has had all identifiers removed so individuals cannot reasonably be identified.\u200b<\/span><\/p>\nQ: What is the purpose of the minimum necessary rule?<\/b><\/span>\u200b<\/span><\/p>\nA: It limits access to or use of PHI to the smallest amount needed to accomplish a task or purpose.\u200b<\/span><\/p>\nQ: Where can I learn more about inclusion\/exclusion criteria for datasets at Mount Sinai?<\/b><\/span>\u200b<\/span><\/p>\nA: You can learn more about inclusion and exclusion criteria for datasets at Mount Sinai by visiting the Mount Sinai Data Warehouse<\/a> or Research Informatics website, or by contacting the Mount Sinai IRB or data governance office<\/a> for specific dataset documentation and guidance.<\/span><\/p>\nQ: How long does IRB protocol approval take?<\/b><\/span>\u200b<\/span><\/p>\nA: Typically, IRB approval can take anywhere from a few weeks to several months, depending on the complexity of the study and the review type (expedited, exempt, or full board).\u200b<\/span><\/p>\nQ: What\u2019s a DUA and why do I need to sign it?<\/b><\/span>\u200b<\/span><\/p>\nA: A DUA<\/i>\u00a0is a legal contract that governs the sharing of restricted or limited-use data. It protects privacy and\u00a0defines how the data can be used and safeguarded.\u200b<\/span><\/p>\n\u200b<\/span><\/p>\n\u200b<\/p>\n
[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div> Scientific Computing and Data \/ AIR\u00b7MS (AI Ready Mount Sinai) \/ Compliance Overview (HIPAA and IRB Requirements) Compliance Overview: Health Insurance Portability and Accountability Act (HIPAA) and Institutional Review Board (IRB) Requirements\u00a0\u00a0Steps to Obtain IRB Approval and Data Access\u200b\u00a0\u00a0OverviewResearch involves several important compliance steps\u2014such as preparing a strong IRB protocol, defining clear inclusion […]<\/p>\n","protected":false},"author":699,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"class_list":["post-12636","page","type-page","status-publish","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/users\/699"}],"replies":[{"embeddable":true,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/comments?post=12636"}],"version-history":[{"count":51,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636\/revisions"}],"predecessor-version":[{"id":12844,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636\/revisions\/12844"}],"wp:attachment":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/media?parent=12636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u00a0<\/p>\n
\u00a0<\/h2>\nOverview<\/span><\/strong><\/h2>\nResearch involves several important compliance steps\u2014such as preparing a strong IRB protocol, defining clear inclusion and exclusion criteria, completing data use agreements (DUAs), and securing appropriate computational resources. Although this process may seem daunting, it is designed to be as efficient as possible and to ensure that studies are conducted responsibly and accurately. By following the guidelines below, researchers can complete their projects effectively while safeguarding patient privacy. Key concepts researchers should be aware of are:<\/span><\/p>\n\n- HIPAA\u00a0<\/span><\/strong><\/li>\n
- Identified vs. De-Identified Data<\/span><\/strong><\/li>\n
- HIPAA Minimum Necessary Rule and Inclusion \/ Exclusion Criteria<\/span><\/strong><\/li>\n
- IRB<\/span><\/strong><\/li>\n<\/ul>\n
\u00a0<\/h2>\nWhat is HIPAA?\u200b<\/span><\/strong><\/h2>\nHIPAA<\/span><\/b><\/a>\u00a0establishes <\/span><\/span>national standards for guarding protected health information (PHI)<\/b>\u00a0and promotes the\u00a0secure, ethical use of medical data<\/b> in both healthcare and research.\u200b<\/span><\/p>\nImportance of HIPAA<\/b><\/span>\u200b<\/span><\/p>\n\n- Protects Patient Privacy – <\/b>Safeguards all PHI from unauthorized access or disclosure.\u200b<\/span><\/li>\n
- Ensures Data Security – <\/b>Requires administrative, physical, and technical safeguards to keep health data secure.\u200b<\/span><\/li>\n
- Empowers Patients – <\/b>Gives patients rights to access, review, and request corrections to their medical records.\u200b<\/span><\/li>\n
- Standardizes Practices – <\/b>Sets national standards for healthcare transactions and data sharing.\u200b<\/span><\/li>\n
- Supports Insurance Portability – <\/b>Ensures patients can maintain health insurance coverage when changing jobs and prohibits discrimination based on pre-existing conditions.\u200b<\/span><\/li>\n
- Enforces Accountability – <\/b>Establishes penalties for violations and promotes compliance across all healthcare entities.<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nIdentified vs. De-Identified Data<\/span><\/strong><\/h2>\nThe first question researchers need to ask when working with health data is if they need de-identified or identified data:<\/span><\/p>\n<\/p>\n
Based on this critical decision, the use of identified \/ de-identified data will determine how the IRB protocol, your inclusion\/exclusion criteria, and other project requirements are drafted.<\/span><\/p>\n\u00a0<\/h2>\nMinimum Necessary Information Requirement<\/span><\/strong><\/h2>\nHIPAA requires that only the minimum necessary information be provided for a specific research question. The minimum necessary rule can be found here:<\/span> Minimum Necessary Requirement | HHS.gov<\/a>.<\/p>\nThis is a critical rule to address when getting data for research: projects must have a focused project question, and clear inclusion \/ exclusion criteria. While it’s tempting to ask for all possible data and explore that data, this can increase the risk to patients if data were accidentally to leak to the public, if it were released through hacking, etc. So, at all times, only the smallest necessary dataset should be provided to researchers to address their questions.\u00a0<\/span><\/p>\nKey to this minimum necessary information requirement is well-defined inclusion \/ exclusion criteria. Here’s an example of some well-defined criteria:<\/span><\/p>\n<\/p>\n
\u200b<\/h2>\nThe Institutional Review Board\u00a0<\/span><\/strong><\/h2>\n\n- An <\/span>IRB<\/span><\/b><\/a>\u00a0<\/a>is a federally mandated ethics committee that reviews research involving human participants to ensure it is\u00a0ethical, scientifically sound, and minimizes risk<\/b>.\u200b<\/span><\/li>\n
- The IRB\u2019s mission is to\u00a0protect the rights, welfare, and privacy<\/b>\u00a0of human subjects while supporting responsible scientific advancement.\u200b<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nWhy the IRB Matters\u200b<\/span><\/strong><\/h2>\n\n- Protects Participants:\u00a0<\/b>Reviews and approves studies to safeguard participants\u2019 rights and well-being.\u200b<\/span><\/li>\n
- Balances Risk and Benefit:\u00a0<\/b>Evaluates potential risks and ensures they are justified by the expected research benefits.\u200b<\/span><\/li>\n
- Ensures Ethical Conduct:\u00a0<\/b>Confirms research follows federal regulations, Mount Sinai policies, and ethical standards.\u200b<\/span><\/li>\n
- Validates Scientific Design:\u00a0<\/b>Reviews study methods to ensure sound, justified, and transparent research practices.\u200b<\/span><\/li>\n
- Crucial Distinction for AIR\u00b7MS Access:\u00a0<\/b>Access to PHI via Artificial Intelligence-Ready Mount Sinai (AIR\u00b7MS) requires IRB approval.<\/span><\/li>\n<\/ul>\n
\u00a0<\/h2>\nFrequently Asked Questions<\/span><\/strong><\/h2>\nQ: What are HIPAA compliant environments?<\/b><\/span>\u200b<\/span><\/p>\nA: These are secure systems or platforms that meet HIPAA standards for guarding protected health information through proper encryption, access controls, and auditing.\u200b<\/span><\/p>\nQ: What\u2019s the difference between identified and de-identified data?<\/b><\/span>\u200b<\/span><\/p>\nA: <\/i>Identified data<\/i>\u00a0includes personal information that can directly or indirectly identify an individual (e.g., name, date of birth).\u200bDe-identified data<\/i>\u00a0has had all identifiers removed so individuals cannot reasonably be identified.\u200b<\/span><\/p>\nQ: What is the purpose of the minimum necessary rule?<\/b><\/span>\u200b<\/span><\/p>\nA: It limits access to or use of PHI to the smallest amount needed to accomplish a task or purpose.\u200b<\/span><\/p>\nQ: Where can I learn more about inclusion\/exclusion criteria for datasets at Mount Sinai?<\/b><\/span>\u200b<\/span><\/p>\nA: You can learn more about inclusion and exclusion criteria for datasets at Mount Sinai by visiting the Mount Sinai Data Warehouse<\/a> or Research Informatics website, or by contacting the Mount Sinai IRB or data governance office<\/a> for specific dataset documentation and guidance.<\/span><\/p>\nQ: How long does IRB protocol approval take?<\/b><\/span>\u200b<\/span><\/p>\nA: Typically, IRB approval can take anywhere from a few weeks to several months, depending on the complexity of the study and the review type (expedited, exempt, or full board).\u200b<\/span><\/p>\nQ: What\u2019s a DUA and why do I need to sign it?<\/b><\/span>\u200b<\/span><\/p>\nA: A DUA<\/i>\u00a0is a legal contract that governs the sharing of restricted or limited-use data. It protects privacy and\u00a0defines how the data can be used and safeguarded.\u200b<\/span><\/p>\n\u200b<\/span><\/p>\n\u200b<\/p>\n
[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div> Scientific Computing and Data \/ AIR\u00b7MS (AI Ready Mount Sinai) \/ Compliance Overview (HIPAA and IRB Requirements) Compliance Overview: Health Insurance Portability and Accountability Act (HIPAA) and Institutional Review Board (IRB) Requirements\u00a0\u00a0Steps to Obtain IRB Approval and Data Access\u200b\u00a0\u00a0OverviewResearch involves several important compliance steps\u2014such as preparing a strong IRB protocol, defining clear inclusion […]<\/p>\n","protected":false},"author":699,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"class_list":["post-12636","page","type-page","status-publish","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/users\/699"}],"replies":[{"embeddable":true,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/comments?post=12636"}],"version-history":[{"count":51,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636\/revisions"}],"predecessor-version":[{"id":12844,"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/pages\/12636\/revisions\/12844"}],"wp:attachment":[{"href":"https:\/\/labs.icahn.mssm.edu\/minervalab\/wp-json\/wp\/v2\/media?parent=12636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Research involves several important compliance steps\u2014such as preparing a strong IRB protocol, defining clear inclusion and exclusion criteria, completing data use agreements (DUAs), and securing appropriate computational resources. Although this process may seem daunting, it is designed to be as efficient as possible and to ensure that studies are conducted responsibly and accurately. By following the guidelines below, researchers can complete their projects effectively while safeguarding patient privacy. Key concepts researchers should be aware of are:<\/span><\/p>\n HIPAA<\/span><\/b><\/a>\u00a0establishes <\/span><\/span>national standards for guarding protected health information (PHI)<\/b>\u00a0and promotes the\u00a0secure, ethical use of medical data<\/b> in both healthcare and research.\u200b<\/span><\/p>\n Importance of HIPAA<\/b><\/span>\u200b<\/span><\/p>\n The first question researchers need to ask when working with health data is if they need de-identified or identified data:<\/span><\/p>\n Based on this critical decision, the use of identified \/ de-identified data will determine how the IRB protocol, your inclusion\/exclusion criteria, and other project requirements are drafted.<\/span><\/p>\n HIPAA requires that only the minimum necessary information be provided for a specific research question. The minimum necessary rule can be found here:<\/span> Minimum Necessary Requirement | HHS.gov<\/a>.<\/p>\n This is a critical rule to address when getting data for research: projects must have a focused project question, and clear inclusion \/ exclusion criteria. While it’s tempting to ask for all possible data and explore that data, this can increase the risk to patients if data were accidentally to leak to the public, if it were released through hacking, etc. So, at all times, only the smallest necessary dataset should be provided to researchers to address their questions.\u00a0<\/span><\/p>\n Key to this minimum necessary information requirement is well-defined inclusion \/ exclusion criteria. Here’s an example of some well-defined criteria:<\/span><\/p>\n Q: What are HIPAA compliant environments?<\/b><\/span>\u200b<\/span><\/p>\n A: These are secure systems or platforms that meet HIPAA standards for guarding protected health information through proper encryption, access controls, and auditing.\u200b<\/span><\/p>\n Q: What\u2019s the difference between identified and de-identified data?<\/b><\/span>\u200b<\/span><\/p>\n A: <\/i>Identified data<\/i>\u00a0includes personal information that can directly or indirectly identify an individual (e.g., name, date of birth).\u200bDe-identified data<\/i>\u00a0has had all identifiers removed so individuals cannot reasonably be identified.\u200b<\/span><\/p>\n Q: What is the purpose of the minimum necessary rule?<\/b><\/span>\u200b<\/span><\/p>\n A: It limits access to or use of PHI to the smallest amount needed to accomplish a task or purpose.\u200b<\/span><\/p>\n Q: Where can I learn more about inclusion\/exclusion criteria for datasets at Mount Sinai?<\/b><\/span>\u200b<\/span><\/p>\n A: You can learn more about inclusion and exclusion criteria for datasets at Mount Sinai by visiting the Mount Sinai Data Warehouse<\/a> or Research Informatics website, or by contacting the Mount Sinai IRB or data governance office<\/a> for specific dataset documentation and guidance.<\/span><\/p>\n Q: How long does IRB protocol approval take?<\/b><\/span>\u200b<\/span><\/p>\n A: Typically, IRB approval can take anywhere from a few weeks to several months, depending on the complexity of the study and the review type (expedited, exempt, or full board).\u200b<\/span><\/p>\n Q: What\u2019s a DUA and why do I need to sign it?<\/b><\/span>\u200b<\/span><\/p>\n A: A DUA<\/i>\u00a0is a legal contract that governs the sharing of restricted or limited-use data. It protects privacy and\u00a0defines how the data can be used and safeguarded.\u200b<\/span><\/p>\n \u200b<\/span><\/p>\n \u200b<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"\n
\u00a0<\/h2>\n
What is HIPAA?\u200b<\/span><\/strong><\/h2>\n
\n
\u00a0<\/h2>\n
Identified vs. De-Identified Data<\/span><\/strong><\/h2>\n
<\/p>\n\u00a0<\/h2>\n
Minimum Necessary Information Requirement<\/span><\/strong><\/h2>\n
<\/p>\n\u200b<\/h2>\n
The Institutional Review Board\u00a0<\/span><\/strong><\/h2>\n
\n
\u00a0<\/h2>\n
Why the IRB Matters\u200b<\/span><\/strong><\/h2>\n
\n
\u00a0<\/h2>\n
Frequently Asked Questions<\/span><\/strong><\/h2>\n