Transition – Prior Permission
lPrivacy Rule includes a transition provision
lAllows for reliance on consent or IRB waiver obtained prior to 04/14/03 lMay use or disclose PHI created before or after 04/14/03 based on then valid consent lCan rely on existing consent for “future unspecified research”
HIPAA requires specific authorization for well-defined information (usually not entire medical record).  Prior consent giving access to entire record is still valid

Allows access to information in hand and information that will be obtained in course of study – even after effective date.

CE may use or disclose PHI that was created or received for research, either before or after the compliance date, if the CE obtained any one of the following prior to the compliance date
   - Authorization or other legal permission to use or disclose PHI information for research
   - Informed consent of the individual to participate in the research
   - A waiver of informed consent by an IRB in accordance with the Common Rule

Must obtain authorization at any point that individual is “re-consented”