Print Page
Email Page

Human Subjects

Policies & Guidance

Indiana Laws Affecting Research


IC 1-1-4-5

“Adult,” “of full age,” and “person in his majority” mean a person at least eighteen (18) years of age.

“Health record,” “hospital record,” or “medical record” means written or printed information possessed by a provider (as defined in IC 16-18-2-295) concerning any diagnosis, treatment, or prognosis of the patient, unless otherwise defined. Except as otherwise provided, the terms include mental health records and drug and alcohol abuse records.

“Infant” or “minor” means a person less than eighteen (18) years of age.

IC 16-36-1-1

“Health care” means any care, treatment, service, or procedure to maintain, diagnose, or treat an individual’s physical or mental condition. The term includes admission to a health care facility.

IC 16-36-1-2

“Representative” means an individual appointed to consent to health care of another under this chapter.

IC 16-36-1.5-2

“Mental health provider” means any of the following:
(1) A registered nurse or licensed practical nurse licensed under IC 25-23.
(2) A clinical social worker licensed under IC 25-23.6-5.
(3) A marriage and family therapist licensed under IC 25-23.6-8.
(4) A psychologist licensed under IC 25-33.
(5) A school psychologist licensed by the Indiana state board of education.
(6) An individual who claims to be a mental health provider.

Protection of Patient’s Identity

IC 16-39-6-5

Members, agents, or employees of a hospital medical staff committee may not disclose the identity of any patient whose records have been studied in a report or publication of the committee.

Members, agents, and employees of the medical staff committee shall protect the identity of a patient whose condition or treatment has been studied and may not disclose or reveal the identity of any patient.

Consent to Own Health Care; Minors

IC 16-36-1-3

  • (a) Except as provided in subsections (b) and (c), unless incapable of consenting under section 7 of this chapter, an individual may consent to the individual’s own health care if the individual is:
    • (1) an adult; or
    • (2) a minor and:
      • (A) is emancipated;
      • (B) is:
        • (i) at least fourteen (14) years of age;
        • (ii) not dependent on a parent for support;
        • (iii) living apart from the minor’s parents or from an individual in loco parentis; and
        • (iv) managing the minor’s own affairs;
      • (C) is or has been married;
      • (D) is in the military service of the United States; or
      • (E) is authorized to consent to the health care by any other statute.
  • (b) A person at least seventeen (17) years of age is eligible to donate blood in a voluntary and noncompensatory blood program without obtaining parental permission.
  • (c) An individual who has, suspects that the individual has, or has been exposed to a venereal disease is competent to give consent for medical or hospital care or treatment of the individual.

Incapacity to Consent; Invalid Consent

IC 16-36-1-4

(a) An individual may consent to health care unless, in the good faith opinion of the attending physician, the individual is incapable of making a decision regarding the proposed health care.

(b) A consent to health care is not valid if the health care provider has knowledge that the individual has indicated contrary instructions in regard to the proposed health care, even if the individual is believed to be incapable of making a decision regarding the proposed health care at the time the individual indicates contrary instructions.

Persons Authorized to Consent for Incapable Parties; Minors

IC 16-36-1-5

  • (a) If an individual incapable of consenting has not appointed a health care representative or the health care representative is not reasonably available or declines to act, consent to health care may be given:
    • (1) by a judicially appointed guardian of the person or a representative appointed; or
    • (2) by a spouse, a parent, an adult child, or an adult sibling, if:
      • (A) there is no guardian or other representative described in (1) above;
      • (B) the guardian or other representative is not reasonably available or declines to act; or
      • (C) the existence of the guardian or other representative is unknown to the health care provider;
    • (3) by the individual’s religious superior, if the individual is a member of a religious order
      • (A) there is no guardian or other representative described in (1) above;
      • (B) the guardian or other representative is not reasonably available or declines to act; or
      • (C) the existence of the guardian or other representative is unknown to the health care provider.
  • (b) Consent to health care for a minor not authorized to consent may be given by any of the following:
    • (1) A judicially appointed guardian of the person or a representative appointed.
    • (2) A parent or an individual in loco parentis if:
      • (A) there is no guardian or other representative described in (1) above;
      • (B) the guardian or other representative is not reasonably available or declines to act; or
      • (C) the existence of the guardian or other representative is unknown to the health care provider.
    • (3) An adult sibling of the minor if:
      • (A) there is no guardian or other representative described in (1) above;
      • (B) a parent or an individual in loco parentis is not reasonably available or declines to act; or
      • (C) the existence of the parent or individual in loco parentis is unknown to the health care provider.
  • (c) An individual delegated authority to consent has the same authority and responsibility as the individual delegating the authority.
  • (d) An individual authorized to consent shall act in good faith and in the best interest of the individual incapable of consenting.

Delegated Authority to Consent on Behalf of Incapable Party

IC 16-36-1-6

  • (a) An individual authorized to consent to health care for another who for a time will not be reasonably available to exercise the authority may delegate the authority to consent during that time to another qualified individual. The delegation:
    • (1) must be in writing;
    • (2) must be signed by the delegate;
    • (3) must be witnessed by an adult; and
    • (4) may specify conditions on the authority delegated.
  • (b) Unless the writing expressly provides otherwise, the delegate may not delegate the authority to another individual.
  • (c) The delegate may revoke the delegation at any time by notifying orally or in writing the delegate or the health care provider.

Appointed Representative; Qualifications; Conditions; Effective Date; Duties; Resignation; Revocation of Appointment

IC 16-36-1-7

  • (a) An individual who may consent to health may appoint another individual as a representative to act for the appointor in matters affecting the appointor’s health care.
  • (b) A representative appointed under this section must be an individual who may consent to health care.
  • (c) An appointment and any amendment must meet the following conditions:
    • (1) Be in writing.
    • (2) Be signed by the appointor or by a designee in the appointor’s presence.
    • (3) Be witnessed by an adult other than the representative.
  • (d) The appointor may specify in the appointment appropriate terms and conditions, including an authorization to the representative to delegate the authority to consent to another.
  • (e) The authority granted becomes effective according to the terms of the appointment.
  • (f) The appointment does not commence until the appointor becomes incapable of consenting. The authority granted in the appointment is not effective if the appointor regains the capacity to consent.
  • (g) Unless the appointment provides otherwise, a representative who is reasonably available and willing to act has priority to act in all matters of health care for the appointor, except when the appointor is capable of consenting.
  • (h) In making all decisions regarding the appointor’s health care, a representative shall act as follows:
    • (1) In the best interest of the appointor consistent with the purpose expressed in the appointment.
    • (2) In good faith.
  • (i) A health care representative who resigns or is unwilling to comply with the written appointment may not exercise further power under the appointment and shall so inform the following:
    • (1) The appointor.
    • (2) The appointor’s legal representative if one is known.
    • (3) The health care provider if the representative knows there is one.
  • (j) An individual who is capable of consenting to health care may revoke:
    • (1) the appointment at any time by notifying the representative orally or in writing; or
    • (2) the authority granted to the representative by notifying the health care provider orally or in writing.

Probate Court Petition; Hearing; Notice; Findings

IC 16-36-1-8

  • (a) A health care provider or any interested individual may petition the probate court in the county where the individual who is the subject of the petition is present for purposes of receiving health care to:
    • (1) make a health care decision or order health care for an individual incapable of consenting; or
    • (2) appoint a representative to act for the individual.
  • (b) Reasonable notice of the time and place of hearing a petition under this section must be given to the following:
    • (1) The individual incapable of consenting.
    • (2) Anyone having the care and custody of the individual.
    • (3) Those individuals who are reasonably available and who are designated by the court.
  • (c) The probate court may modify or dispense with notice and hearing if the probate court finds that delay will have a serious, adverse effect upon the health of the individual.
  • (d) The probate court may order health care, appoint a representative to make a health care decision for the individual incapable of consenting to health care with the limitations on the authority of the representative as the probate court considers appropriate, or order any other appropriate relief in the best interest of the individual if the probate court finds the following:
    • (1) A health care decision is required for the individual.
    • (2) The individual is incapable of consenting to health care.
    • (3) There is no individual authorized to consent or an individual authorized to consent to health care:
      • (A) is not reasonably available;
      • (B) declines to act; or
      • (C) is not acting in the best interest of the individual in need of health care.

Mental Health Provider; Consent from Patient Required

IC 16-36-1.5-4

Before providing mental health services, a mental health provider must obtain consent from each patient.

Physician; Written Consent from Patient Required

IC 16-36-1.5-4.5

Before providing mental health services, a physician who is licensed under IC 25-22.5 must obtain consent from each patient as provided in IC 34-18-12.

Consent by Mentally Incompetent Patient

IC 16-36-1.5-5

  • (a) This applies to a patient who:
    • (1) receives mental health services; and
    • (2) is mentally incompetent.
  • (b) A patient described in subsection (a) shall provide consent for mental health treatment through the informed consent of one (1) of the following:
    • (1) The patient’s legal guardian or other court appointed representative.
    • (2) The patient’s health care representative.
    • (3) An attorney in fact for health care.
    • (4) The patient’s health care representative acting in accordance with the patient’s psychiatric advance directive as expressed in a psychiatric advance directive.

Records Excepted from Disclosure Requirements; Names and Addresses; Time Limitations; Destruction of Records

IC 5-14-3-4

  • (a) The following public records are excepted and may not be disclosed by a public agency, unless access to the records is specifically required by a state or federal statute or is ordered by a court under the rules of discovery:
    • [(1) – (5), (7) – (8), and (10) – (11) intentionally omitted]
    • (6) Information concerning research, including actual research documents, conducted under the auspices of an institution of higher education, including information:
      • (A) concerning any negotiations made with respect to the research; and
      • (B) received from another party involved in the research.
    • (9) Patient medical records and charts created by a provider, unless the patient gives written consent.
    • (12) A Social Security number contained in the records of a public agency.

Conflict of Interest

IC 35-44-1-3

Indiana law generally declares it a crime for a public employee to knowingly or intentionally derive a pecuniary benefit from transactions of the public employer. The law provides certain defenses to a charge of conflict of interest, including disclosure of the conflict to and acceptance of the disclosure by the public employer. To avoid criminal penalties, therefore, IU employees should disclose any situations likely to result in a contract involving a purchase, sale, services, or other matters between IU and the employee or the employee’s dependents. This law does not apply to the normal contract of employment. It is a defense in a prosecution under this law that the employee’s interest in the transaction in any one year is less than $250.

  • [(a) – (j) intentionally omitted]
  • (k) As used in this section, “dependent” means any of the following:
    • (1) The spouse of a public servant.
    • (2) A child, stepchild, or adoptee of a public servant who is:
      • (A) unemancipated; and
      • (B) less than eighteen (18) years of age.
    • (3) Any individual more than one-half (1/2) of whose support is provided during a year by the public servant.

Research Purposes; Request for Access to Information

210-IAC 1-6-7

All requests for access to offender or juvenile records for research purposes shall be made to the director of planning services in the Department of Corrections in written form. Such requests shall include the name of the agency or organization performing the research, the names of the persons directly responsible for the following:

  • (1) Conducting such research.
  • (2) The purpose of such research.
  • (3) How the research is to be performed.
  • (4) What measures will be taken to assure the proper protection of classified information.

Approval of such requests will then be granted or denied consistent with provisions of IC 4-1-6-8.6 and department procedures.

Duty to Report Child Abuse or Neglect

IC 31-33-5

Duty to Make Report

IC 31-33-5-1

An individual who has reason to believe that a child is a victim of child abuse or neglect shall make a report as required by this article.

Notification of Individual in Charge of Institution, School, Facility, or Agency; Report

IC 31-33-5-2

(a) If an individual is required to make a report under this article in the individual's capacity as a member of the staff of a medical or other public or private institution, school, facility, or agency, the individual shall immediately notify the individual in charge of the institution, school, facility, or agency or the designated agent of the individual in charge of the institution, school, facility, or agency.
(b) An individual notified under (a) shall report or cause a report to be made.

Immediate Oral Report to Local Child Protection Service or Law Enforcement Agency

IC 31-33-5-4

A person who has a duty under this chapter to report that a child may be a victim of child abuse or neglect shall immediately make an oral report to:

  • (1) the local child protection service; or
  • (2) the local law enforcement agency.

Indiana Law Prohibiting the Disclosure of Social Security Numbers

IC 4-1-10

It is a crime for IU or an IU employee to disclose someone’s Social Security number outside of the university, except in the following circumstances:

  • (1) The individual has expressly consented in writing to the disclosure;
  • (2) The disclosure is made to a state, local, or federal agency;
  • (3) The disclosure is made by a state law enforcement agency (which would include IUPD) for purposes of furthering an investigation;
  • (4) The disclosure is expressly required by federal or state law or a court order;
  • (5) The disclosure is for the purpose of administering the health benefits of a state agency employee or his/her dependent;
  • (6) Only the last four digits of the SSN are disclosed;
  • (7) The disclosure is made in order to comply with certain anti-terrorism provisions of the USA PATRIOT Act or a corresponding Presidential Executive Order addressing antiterrorism efforts; or
  • (8) The disclosure is made to a commercial entity for certain uses that are allowed under one of three federal laws – the Driver’s Privacy Protection Act, the Fair Credit Reporting Act, or the Financial Services Modernization Act (popularly known as “Gramm-Leach-Bliley”).

Notably, Indiana state law prohibits certain disclosures of student SSNs that are otherwise permissible but not required under the federal Family Educational Rights and Privacy Act (FERPA). This means that complying with FERPA in disclosing an SSN may still result in a violation of the law. For example, FERPA permits disclosure of student education records, including SSNs, without student consent in the event of a health or safety emergency. Under the Indiana’s SSN disclosure law, there is no separate health and safety exception, although disclosure of an SSN to a federal or state health agency is permissible as long as another law does not expressly forbid that disclosure.

The Indiana SSN disclosure law appears to cover disclosures made orally, on paper, or electronically.

Anyone who knowingly, intentionally, or recklessly discloses a Social Security number in violation of Indiana law commits a felony and may be punished with up to three (3) years imprisonment and $10,000 in fines. Negligent disclosures are treated as a criminal infraction and are punishable by up to one (1) year imprisonment and $5,000 in fines. It is not clear whether the law is intended to cover only affirmative disclosures, or will also cover – as either “negligent” or “reckless” disclosures – inadvertent exposure of SSNs to unauthorized third parties resulting from insufficient data security measures. This reinforces the need for IU, and all individuals who work with SSNs, to ensure that those data are properly secured against unauthorized access.

Indiana Law Requiring Secure Disposal of Personal Information

Indiana law makes it a crime to dispose of personal information without taking certain measures to protect that information against access by a third party. Personal information is defined as:

  • (1) SSNs (beyond the last five digits)
  • (2) First name/initial and last name plus more than four digits of any of the following:
    • (A) Credit card number
    • (B) Driver’s license number
    • (C) Financial account number and access code
    • (D) State identification card number

To comply with the law, personal information may be securely disposed of by shredding, incinerating, mutilating, erasing, or otherwise rendering information illegible or unusable.

The law exempts any personal information that is encrypted or redacted when disposed. Encrypted personal information has been transformed through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without use of a confidential process or key. Redacted personal information is truncated or blacked out so that no more than the last 5 digits of the SSN or the last 4 digits of other identifying numbers covered under the law are not visible.

The state law also exempts anyone who is disposing of personal information in a secure manner already under a program designed to comply with any of the following laws:

  • (1) HIPAA
  • (2) Gramm-Leach-Bliley Act
  • (3) Fair Credit Reporting Act
  • (4) Driver’s Privacy Protection Act
  • (5) USA PATRIOT Act/Executive Order 13224

Indiana Law Requiring Notification of Security Breaches

IC 4-1-11

Indiana Code Section 4-1-11 requires that IU give notice without unreasonable delay to persons whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized third person due to an electronic systems security breach.

This law covers electronic data only, and not disclosures or exposures of paper records that contain personal information. This does not prevent IU from notifying individuals of any breach in security concerning paper records that contain sensitive personal information.

The law covers only exposure or disclosure of data that is not encrypted. The law does not define encryption, but it makes sense to assume that the definition in the data disposal law would apply here as well: that is, the use of an algorithm or other method to render the data unusable and unreadable without a confidential key or process.

The law also does not require notice of a breach in the event that a portable device containing personal information is stolen, as long as the device is protected by a password that has not been shared. The law does not specify a particular strength for the password.

Notice can be given in writing or by email, if IU has those email addresses. If an incident involves more than 500,000 persons or it would cost IU more than $250,000 to give individualized notice, or if IU does not have the contact information needed to give individualized notice, IU can give notice instead by doing both of the following:

  • Notifying major statewide media; and
  • Conspicuous posting on IU’s website.

If IU must give notice to more than 1,000 individuals, it is also required to notify the consumer credit reporting agencies (Equifax, TransUnion, Experian). This is to put them on notice that individuals may be contacting them for credit reports and other help in spotting attempted identity theft.

Notice must be given without unreasonable delay. IU can delay notice for the reasonable time needed to determine the nature and scope of the breach, secure university systems, and meet the legitimate needs of law enforcement. “Legitimate needs of law enforcement” is not defined in the state law but presumably would permit IU to delay notice for a brief period to allow for securing data needed for a law enforcement investigation that might otherwise be lost. If law enforcement authorities ask IU to delay because giving notice might interfere with an investigation, notice can be delayed until law enforcement informs IU that delay is no longer needed.

RASD | Browser Recommendations | Webmaster | IU Emergency System | Office Information | Site Map