If the IRB-HSR determines that the research is exempt from IRB review, the research may not require a consent form. If, however, the research involves contact with a subject, verbal consent may be appropriate.
The IRB-HSR also serves as the HIPAA Privacy Board for Research for UVA, therefore, if the research involves protected health information, the researcher must seek approval from the IRB-HSR /HIPAA Privacy Board even if the research itself is exempt from IRB review under other federal regulations (e.g. DHHS or FDA). If the study includes identifiable health information ach subject must provide HIPAA authorization either through written or verbal methods, unless the IRB-HSR/HIPAA Privacy Board waives this requirement
If the study does not include the collection of health information with identifiers but someone from outside of UVA will have access to PHI while observing patients or healthcare providers who are administering care patients must sign the UVA Health HIPAA Authorization Form prior to the research observation taking place. The contract/agreement must include the required language for a HIPAA Data Use Agreement.