# Research Privacy Compliance Report — Asclepius Health Network

**Report Date**: 2026-01-25
**Prepared by**: Dr. Lisa Hernandez, IRB Administrator
**Reviewed by**: Sarah Mitchell, Chief Privacy Officer
**Scope**: Active research studies using PHI from Asclepius Health Network

---

## Organization Profile

| Attribute | Value |
|-----------|-------|
| Organization | Asclepius Health Network — Research Division |
| Active IRB-Approved Protocols | 67 |
| Studies Using PHI | 42 |
| PHI Access Pathways in Use | Authorization (18), IRB Waiver (12), Limited Data Set (7), De-identified (5) |

## Study-Level Compliance Assessment

### Studies Using Individual Authorization (§164.508)

| Study ID | Study Title | PI | Authorization Status | Findings |
|----------|------------|-----|---------------------|----------|
| AHN-2024-015 | Cardiac Biomarker Longitudinal Study | Dr. Patel | Compliant | None |
| AHN-2024-028 | Pediatric Asthma Genetic Factors | Dr. Kim | Compliant | None |
| AHN-2025-003 | Post-Surgical Pain Management RCT | Dr. Rivera | Compliant | None |
| AHN-2025-011 | Mental Health Outcomes in Chronic Disease | Dr. Thompson | Partially Compliant | Finding 1 |

### Studies Using IRB Waiver of Authorization (§164.512(i))

| Study ID | Study Title | PI | Waiver Status | Findings |
|----------|------------|-----|---------------|----------|
| AHN-2024-042 | Retrospective Sepsis Mortality Analysis | Dr. Okafor | Compliant | None |
| AHN-2024-051 | EHR-Based Readmission Risk Modeling | Dr. Chen | Compliant | None |
| AHN-2025-008 | Population Diabetes Prevalence Trends | Dr. Vasquez | Partially Compliant | Finding 2 |

### Studies Using Limited Data Set (§164.514(e))

| Study ID | Study Title | PI | LDS/DUA Status | Findings |
|----------|------------|-----|----------------|----------|
| AHN-2024-038 | Regional Cancer Incidence Mapping | Dr. Wu | Compliant | None |
| AHN-2025-006 | Health Disparities in Rural Communities | Dr. Johnson | Compliant | None |

### Studies Using De-Identified Data (§164.514(a)-(b))

| Study ID | Study Title | PI | De-ID Method | Status |
|----------|------------|-----|-------------|--------|
| AHN-2024-055 | National Flu Trends Analysis | Dr. Garcia | Safe Harbor | Compliant |
| AHN-2025-001 | ML Model for Patient Deterioration | Dr. Lee | Expert Determination | Compliant |

## Detailed Findings

### Finding 1: Incomplete Combined Authorization/Consent (High)

- **Study**: AHN-2025-011 — Mental Health Outcomes in Chronic Disease
- **Regulation**: 45 CFR §164.508(b)(3)(i)
- **Details**: The combined informed consent and HIPAA authorization document does not clearly distinguish the HIPAA authorization portion from the research informed consent. The authorization elements are embedded within the consent text without a separate section header or visual demarcation.
- **Risk**: Participants may not understand which portion constitutes the HIPAA authorization or that they could potentially refuse the authorization while still participating.
- **Remediation**: Revise the combined document to include a clearly labeled "HIPAA Authorization for Use and Disclosure of Protected Health Information" section with all required elements listed distinctly. Submit revised form to IRB for approval.
- **Deadline**: 2026-02-28
- **Owner**: Dr. Thompson (PI) + IRB Administrator

### Finding 2: Missing Identifier Destruction Plan in Waiver (High)

- **Study**: AHN-2025-008 — Population Diabetes Prevalence Trends
- **Regulation**: 45 CFR §164.512(i)(1)(i)(A)(2)
- **Details**: The IRB waiver documentation for this retrospective study does not include an adequate plan to destroy identifiers at the earliest opportunity. The waiver approval references a "reasonable timeframe" but does not specify when identifiers will be destroyed or provide justification for retention.
- **Risk**: Without a specific destruction timeline, identifiers may be retained indefinitely, increasing re-identification risk.
- **Remediation**: PI to submit amended protocol specifying identifier destruction timeline. IRB to update waiver documentation with explicit destruction plan or documented health/research justification for retention.
- **Deadline**: 2026-02-15
- **Owner**: Dr. Vasquez (PI) + IRB

### Finding 3: Preparatory Access Duration (Medium)

- **Study**: Pre-protocol feasibility review for proposed oncology trial
- **Regulation**: 45 CFR §164.512(i)(1)(ii)
- **Details**: A researcher was granted preparatory access to review patient records for feasibility assessment. The access period has extended to 4 months without a defined end date. While no PHI has been removed, extended preparatory access without a clear timeline may not be consistent with "solely to prepare a research protocol."
- **Remediation**: Set 90-day maximum for preparatory access. Require researcher to submit protocol or terminate access.
- **Deadline**: 2026-02-01
- **Owner**: Privacy Officer

## Summary Statistics

| Metric | Value |
|--------|-------|
| Total studies assessed | 42 |
| Compliant | 39 (92.9%) |
| Partially Compliant | 3 (7.1%) |
| Non-Compliant | 0 (0%) |
| Critical findings | 0 |
| High findings | 2 |
| Medium findings | 1 |

## Recommendations

1. Develop a standardized combined consent/authorization template with clearly demarcated HIPAA authorization section for all research studies.
2. Add identifier destruction timeline as a mandatory field in IRB waiver application forms.
3. Implement 90-day limit on preparatory-to-research access with mandatory Privacy Officer review for extensions.
4. Conduct annual training for PIs on HIPAA research pathway requirements, focusing on authorization elements and waiver documentation.

**Prepared by**: Dr. Lisa Hernandez, IRB Administrator
**Approved by**: Compliance Committee, January 2026