Forms, Policies & Procedures

Hazardous Chemical Reporting

In order comply with the federal Emergency Planning and Community Right-to-Know Act (EPCRA), the EHS maintains an inventory of chemicals classified as hazardous that are used on campus for non-academic purposes and are stored in quantities above established threshold levels. The information in this inventory is used for local emergency planning and informs first responders of possible chemical hazards. The reportable chemical threshold levels are:

• Extremely Hazardous Substances – 55 gallons, 500 pounds, or the Threshold Planning Quantity (TPQ), whichever is lower.
• Hazardous Chemicals – 55 gallons or 500 pounds, whichever is lower

As part of the annual maintenance of the inventory, University departments are asked to review their list of chemicals used for non-academic purpose. EHS submits this information to the State of Delaware annually via the Tier II report form. For each chemical reported, the Tier II form requires:

• The chemical name or the common name as indicated on the SDS
• An estimate of the maximum amount of the chemical present at any time during the preceding calendar year and the average daily amount
• A brief description of the manner of storage of the chemical
• The location of the chemical at the facility

Each department is requested to complete the Workplace Chemical List each year; this information is used by EHS to develop the University’s Tier II report. As part of the EPCRA regulations, a list of hazardous chemicals used in a workplace must be prominently posted for reference by employees. Posting the completed Workplace Chemical List work sheet used to report your chemical inventory will meet this requirement.

Regulations

• Emergency Planning and Community Right-to-Know Act home page
• Federal reporting requirements
• Delaware State Emergency Response Commission
• Hazardous Chemical Reporting
• List of Extremely Hazardous Substances with Threshold Planning Quantities
• Electronic Tier II Reporting

Questions about Hazardous Chemical Reporting can be addressed to the Bill Harris at 302-831-8274.

Hazardous Material Shipments/Transportation

1. SCOPE OF PURPOSE
   To assure all shipments of hazardous materials off-campus are prepared in accordance with Department of Transportation (DOT) Regulations, International Air Transportation Authority (IATA) and International Civil Aviation Organization (ICAO) and to minimize the exposure of all persons to hazardous materials during their transport.

For further information please refer to the shipping procedures on the Environmental Health and Safety website, or contact ext 8475.

The complete policy and more can be found on the General Counsel’s web site.

Hazardous Waste Disposal

1. SCOPE OF PURPOSE
   To ensure the disposal of hazardous waste is conducted in compliance with the Resource Conservation and Recovery Act and Delaware regulations governing the disposal of hazardous waste.
2. POLICY
   Common examples of chemical waste requiring disposal under this policy include but are not limited to: spent solvents, outdated laboratory research chemicals, spent acids and bases, lead-acid batteries, nickel/cadmium batteries, unusable or broken mercury thermometers and barometers, chemical waste generated from experiments, waste silica gel, full or partially full aerosol cans, non-returnable gas cylinders, paint materials and used oil filters. …

For more information regarding this policy, contact the Department of Environmental Health and Safety (ext. 8475).

The complete policy and more can be found on the General Counsel’s web site.

HIPAA Hybrid Statement

1. Introduction
   As with some other research-intensive institutions¹ , the University of Delaware (“UD”) recognizes that the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) is a consumer protection law intended to protect individually identifiable information relating to the physical or mental health of an individual, the provision of health care to the individual, or the payment for the provision of health care to the individual. HIPAA applies to “Covered Entities,” which include health care providers, health plans and health care clearinghouses that conduct specified transactions electronically (“Covered Entities” or each a “Covered Entity”)² . UD is engaged in both Covered Entity and non-Covered Entity activities. HIPAA allows entities that are engaged in both Covered Entity functions and other activities that are not Covered Entity functions to designate themselves as “Hybrid Entities,” with the result that the HIPAA regulations do not apply to the non-covered functions.

   ¹For Example, Vanderbilt University (https://ww2.mc.vanderbilt.edu/osp/51235).

   ²https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html.

2. Hybrid Entity Status Assessment
   Based upon an assessment of UD units and a review of HIPAA standards, UD designates itself as a Hybrid Entity under HIPAA. Identification of individuals and entities that are part of the UD Covered Entity (“UDCE”) is complicated by the fact that UD is engaged in multiple covered functions and non-covered functions with a mission that includes education, health care, and research. Workforce members often have multiple roles, both covered and non-covered. Therefore, determination of those entities and individuals who are included in the UDCE is a dynamic and ongoing process that is based upon the data used and/or being disclosed, not based upon any particular overall department mission or activity.

   The UDCE includes health-related research centers, interdisciplinary programs, and University-wide programs. Whether a UD function or individual’s activity on behalf of UD is included in the UDCE is hereafter determined based not upon any particular department or unit, but instead upon the data being used and/or disclosed.

3. Categories of Data
   The following defined categories of data are critical to the determination of covered functions and activities:

   A. Individually identifiable health information (IIHI) is information collected from an individual that is created or received by a health care provider, employer, plan or clearinghouse and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health

   care to an individual; or the past, present, or future payment for the provision of health care to an individual and identifies the individual, or can reasonably be used to identify the individual.

   B. Protected Health information (PHI) is IIHI that is transmitted or maintained in any form or medium by a covered function within the UDCE. This specifically excludes education records, which are protected by other privacy regulations, and employment records held by UD in its role as an employer. This also excludes research health information (see definition below), which is protected by other regulatory requirements.

   C. Research Health Information (RHI) is IIHI that is used for research purposes but that is not PHI, and thus is NOT subject to the requirements of HIPAA. RHI is IIHI that is created in connection with research activity and is not created in connection with patient care activity. When a researcher is not also functioning as a health care provider, and creates IIHI in connection with pure research activities (no patient care involved) the IIHI is not PHI and is not subject to the privacy and security rules of HIPAA. If a researcher is also a health care provider and IIHI is created in connection with the researcher’s health care provider activities, then the IIHI is PHI subject to HIPAA. IIHI that is created as PHI and is needed for research purposes may be disclosed to a researcher (the same individual healthcare provider who is also a researcher may disclose PHI to herself in her research role) pursuant to the IRB approval process, which includes proper patient authorization or IRB waiver of authorization. After the PHI is properly disclosed to the research setting, the IIHI transferred to the research setting becomes RHI, which is no longer subject to the requirements of HIPAA. In certain cases such as interventional clinical trials it is expected there will be two copies of some IIHI: a copy kept in the patient’s medical record which is PHI and subject to HIPAA, and a copy of the same data kept in the research record which is RHI and not subject to HIPAA.

   D. Key Determinants: The key determinants as to whether or not information is IIHI and not protected by the Privacy Rule or PHI and protected are: 1) the function being performed by the provider or health plan; and 2) the purpose for which an entity or workforce member has received, created or maintained the medical information (e.g., treatment, payment, operations). Record keeping practices are not the determinant. For example, an assessment of fitness for duty generates PHI when the UDCE administers or oversees a test of a UD employee. When the employee authorizes UD, the health care provider, to turn over the information to UD, the employer, it is a part of the employee’s employment record and no longer PHI. It is important to note that in most circumstances (exceptions include workplace injury, illness or medical surveillance) the employee must provide a signed authorization to the UD health care provider to release the information to UD, the employer.

4. Determining Covered Functions Criteria
   The following criteria are used to determine whether a function or individual workforce member is included in the UDCE:

   A. Health care or health plan use or disclosure: When the use or disclosure of IIHI is carried out in connection with a health care provider or health plan function by UD workforce members, the individual’s health information is defined as PHI, and HIPAA privacy and security regulations apply to those functions and to the workforce members who carry out those functions;

   B. Functions that support health care or health plan: When the use or disclosure of IIHI is carried out by business, financial, legal or administrative functions on behalf of UD’s health care provider and health plan activities, the individual’s information is PHI and the HIPAA privacy and security regulations apply to those functions and to the workforce members who carry out those functions;

   C. Employer and education functions: When the use and disclosure of IIHI is carried out by UD in its capacity as an employer or an educational institution, the information is not PHI and those UD functions are not subject to the privacy or security regulations of HIPAA, but the confidentiality of the individual’s health information is protected by other state and federal law, as well as by UD policy; and

   D. IRB functions: PHI may only be disclosed to a researcher for use in connection with an IRB-approved or exempt protocol and pursuant to a waiver or authorization. When a researcher requests access to PHI that has been created, received or maintained by the UDCE, the Privacy Rule requires that the UDCE receive specific assurances that the PHI will be protected once disclosed to the researcher for use as RHI, and UD must account for certain disclosures as required by the HIPAA regulations. UD’s IRB will function as the Privacy Board as defined by HIPAA.

   E. Examples of UD workforce members who may provide services to covered functions: Workforce members of the following components of UD may provide administrative functions on behalf of the UDCE (use of PHI subject to the requirements of HIPAA) and on behalf of non-covered components of UD (IIHI not subject to the requirements of HIPAA):

   • Alumni Relations (https://www.udconnection.com/)
   • Development (https://www1.udel.edu/giving/)
   • Economic Innovation & Partnerships (http://www.oeip.udel.edu/)
   • Environmental Health & Safety (https://www1.udel.edu/ehs/)
   • Finance and Administration (https://sites.udel.edu/vpfinance/)
   • General Counsel (https://sites.udel.edu/generalcounsel/)
   • Institutional Research & Effectiveness (https://ire.udel.edu/)
   • Institutional Review Board (https://www1.udel.edu/research/preparing/humansub.html)
   • Internal Audit (https://www1.udel.edu/Treasurer/internalaudit.html)
   • Public Safety (https://www1.udel.edu/police/)
   • Research & Research Compliance (https://www1.udel.edu/research/about/index.html)
   • Risk Management (https://sites.udel.edu/vpfinance/departments/risk-management/)
   • Other UD entities that perform covered functions within the UDCE, such as:
     1. Applicable Academic Programs
        • College of Agriculture and Natural Resources (https://canr.udel.edu/)
        • College of Arts and Sciences (https://www.cas.udel.edu/Pages/default.aspx)
        • Alfred Lerner College of Business and Economics (https://lerner.udel.edu//)
        • College of Earth, Ocean, and Environment (https://www.ceoe.udel.edu/)
        • College of Engineering (https://www.engr.udel.edu/)
        • College of Health Sciences (https://chs.udel.edu/)
        • College of Education and Human Development (https://www.cehd.udel.edu/)
        • Biomechanics & Movement Science  (https://sites.udel.edu/bioms/)
        • Cognitive Science (https://www.lingcogsci.udel.edu/)
     2. Research Centers/Institutes
        • Applied Science & Engineering Laboratories (http://www.asel.udel.edu/)
        • Center for Bioinformatics & Computational Biology (http://bioinformatics.udel.edu/)
        • Center for Biomedical Engineering Research (http://www.cber.udel.edu/)
        • Center for Environmental Genomics (http://www.ceoe.udel.edu/ceg/index.shtml)
        • Center for Science, Ethics & Public Policy (http://www.sepp.udel.edu/)
        • Center for Spintronics and Biodetection (https://wiki.physics.udel.edu/csb/Main_Page)
        • Center for Translational Cancer Research (https://www1.udel.edu/ctcr/)
        • Delaware Biotechnology Institute (http://www.dbi.udel.edu/)
        • Delaware Design Institute (http://ddi.udel.edu/)
        • Delaware Physical Therapy Clinic (http://sites.udel.edu/ptclinic/)
        • Delaware Rehabilitation Institute (http://www1.udel.edu/dri/)
        • Institute for Global Studies (http://www1.udel.edu/global/)
        • Institute for Transforming Undergraduate Education (http://www1.udel.edu/inst/)
        • Small Business & Technology Development Center (http://delawaresbdc.org/)
     3. University-wide Units
        • Academic Enrichment Center (https://www1.udel.edu/AEC-workshop/resource.html)
        • Counseling & Student Development (http://sites.udel.edu/counseling/)
        • Student Health Service (http://www1.udel.edu/studenthealth/)
        • Student Services for Athletes (http://www.bluehens.com/SportSelect.dbml?DB_OEM_ID=29100&SPID=176008&SPSID=1036210)
5. Protected Health Information transfer between covered and non-covered componentsA. Patient authorization required: When workforce members who provide services to the UDCE perform services on behalf of non-covered components of UD, these non-covered functions are not part of the UDCE. Workforce members must not disclose PHI to non-covered UD components without the individual or patient’s authorization, or waiver of authorization by the IRB in the case of disclosures for research purposes, as required by the Privacy Rule.

   B. Disclosure between Health Plan and Providers: Workforce members who provide business and finance services to both UDCE providers and UDCE health plans cannot use or disclose PHI between those entities unless it is allowed in the Privacy Rule.

Direct Inquiries to:

Sean Hayes, J.D., Ph.D.
Research Advisor
Institutional Privacy Officer
Email: hayes@udel.edu
Phone: 302-831-7445

OR

Cordell Overby, Sc.D.
Associate Vice President for Research & Regulatory Affairs
Email: overbyc@udel.edu
Phone: 302-831-2383

The complete policy and more can be found on the UD Research Office’s web site.

Human Subjects in Research and Research-Related Activities

1. SCOPE OF POLICY
   This policy addresses the University of Delaware (“UD” or “University”) obligation to ensure the protection of the rights and welfare of individuals used as subjects in research-related activities and applies to all University departments, units, faculty, staff and students.
2. POLICY
   UD bears full responsibility for the performance of all research involving Human Subjects, including complying with federal, state, and local laws as they may relate to such research. In meeting its obligations in this area, the University is guided by the ethical principles set forth in the report of the Ethical Principles and Guidelines for the Protection of Human Subjects of Research (the “Belmont Report”), and adheres to the regulations of Title 45, Part 46 of the Code of Federal Regulations, 45 CFR 46, and the University’s FWA with the U.S. Department of Health and Human Services (and all other requirements from governmental entities with legal jurisdiction oversight) for the protection of Human Subjects in research.

   The UD Provost appoints the Deputy Provost for Research & Scholarship as IO for research involving Human Subjects. The Deputy Provost for Research and Scholarship may appoint the Associate Deputy Provost for Research & Regulatory Affairs to act in the capacity of IO. …

The complete policy and more can be found on the General Counsel’s web site.

Hydrofluoric Acid Safety Program

Hydrofluoric acid has a number of chemical, physical and toxicological properties, which make handling this material especially hazardous. All forms, including the solution or the vapor, can cause severe burns to tissue and cause serious toxic systemic effects. Fluoride ions are both acutely and chronically toxic. Fluorides are easily absorbed through the skin, cause death of soft tissue and erode bone as well as cause cardiac arrhythmias or cardiac arrest. Acute effects of hydrofluoric acid exposure include extreme respiratory irritation, immediate and severe eye damage and pulmonary edema. Skin, eye, or lung exposure to concentrated (>50%) hydrofluoric acid solutions will cause immediate, severe, penetrating burns. Exposure to less concentrated solutions may have equally serious effects, but the appearance of symptoms can be delayed for up to 24 hours.

Principal Investigators requesting authorization to purchase and use hydrofluoric acid in their research must complete a Standard Operating Procedure/Authorization Form and submit to the Chemical Hygiene Committee for approval.

Standard Operating Procedure/Authorization Form for Use of Hydrofluoric Acid

• Microsoft Word Document
• PDF Format

Hydrofluoric Acid User Authorization Form

• Microsoft Word Document
• PDF Format

Environmental Health & Safety Hydrofluoric Acid Spill and Splash Pamphlet

• Version for Review on the Web
• Version for Print

On-Line Hydrofluoric Acid Safety Refresher Training

Honeywell Specialty Materials – Hydrofluoric Acid Resources

Any questions or concerns related to safe use of hydrofluoric acid should be addressed to the Chemical Hygiene Officer at dehsafety@udel.edu or call 302-831-8475.

Hydrofluoric Acid User Authorization Form

This form must be completed by the Principal Investigator (PI) and the designated hydrofluoric acid user before any Hydrofluoric Acid usage and must be updated annually.

Industrial Hygiene Program

The University of Delaware Industrial Hygiene Program has been developed in response to identified hazards in the workplace as well as for the reduction and analysis of workplace injuries. Program responsibilities span the Department of Environmental Health & Safety staff, Labor Relations, and Safety Committees. Further information can be obtained for the programs listed below:

• Hazardous gas detection and monitoring
• Indoor Air Quality Program
• Respiratory Protection Program
• Ergonomics Program
• Exposure Evaluation Program
• Heat and Cold Stress Exposure
• Injury/Illness Reporting Program
• Near Miss Accident Reporting

Industry Research Agreement – Overview

This form is used to help manage the resources allocated from grants, gifts and sponsored agreements. Both the University and the government have specific protocols in place to prevent the misuse of funds and other resources. Please contact your assigned contract and grant specialist if you have specific questions, or if you have questions about other forms and steps in the award process. If you are unsure of who holds the contract and grant specialist position for your department, please refer to the Administrator Directory search on the Staff Directory Page.

Industry Research Agreement – Alternative

This form is a research agreement between a company and the University of Delaware. It has the following formal wording:

__________________________________________________________________

RESEARCH AGREEMENT BETWEEN COMPANY AND THE UNIVERSITY OF DELAWARE

THIS AGREEMENT is between , with offices at (hereinafter referred to as COMPANY), and the University of Delaware, with offices at Newark, Delaware 19716 (hereinafter referred to as UNIVERSITY), an educational nonprofit institution chartered under the laws of the State of Delaware. …

__________________________________________________________________

For a full description of the applicability of the “Research Agreements with Industry” please download this pdf. There are two options available to PI’s in IP Term Negotiations which include Standard Research Agreement and Exclusivity of Licensing to Private Sector Partner overviews.

Industry Research Agreement – Standard

This is a research agreement template between a company and the University of Delaware. It is meant as a template for aid in drafting of such agreements.

Infectious Waste Management

1. SCOPE OF PURPOSE
   To ensure the management of infectious waste* at the University is conducted in compliance with Section 11 of the State of Delaware Regulations Governing Solid Waste, 7 Delaware Code, Chapter 60.

* As defined in Section 11 of the Delaware Regulations Governing Solid Waste and the University of Delaware Infectious Waste Management Procedures.

The complete policy and more can be found on the General Counsel’s web site.