Waiver
requires IRB/Privacy Board approval
and documentation of three (3) waiver criteria:
Use or disclosure involves no more than minimal risk to privacy of the subject based on, at least:
a) Adequate plan to protect the information from improper use and disclosure;
b) Adequate plan to destroy identifiers; and
c) Written assurances that the PHI will not be disclosed further than as set forth in the
waiver