Research and HIPAA Privacy Protections (ID 14)

Under HIPAA, a "disclosure accounting" is required:

For all human subjects research that uses PHI without an authorization from the data subject, except for limited data sets.

If you're unsure about the particulars of HIPAA research requirements at your organization or have questions, you can usually consult with:

An organizational IRB or Privacy Board, privacy official ("Privacy Officer"), or security official ("Security Officer"), depending on the issue.

A HIPAA authorization has which of the following characteristics:

Uses "plain language" that the data subject can understand, similar to the requirement for an informed consent document.

A covered entity may use or disclose PHI without an authorization, or documentation of a waiver or an alteration of authorization, for all of the following EXCEPT:

Data that does not cross state lines when disclosed by the covered entity.

HIPAA's protections for health information used for research purposes...

Supplement those of the Common Rule and FDA.

The HIPAA "minimum necessary" standard applies...

To all human subjects research that uses PHI without an authorization from the data subject.

When required, the information provided to the data subject in a HIPAA disclosure accounting ...

must be more detailed for disclosures that involve fewer than 50 subject records.

Recruiting into research ...

Can qualify as an activity "preparatory to research," at least for the initial contact, but data should not leave the covered entity.

HIPAA includes in its definition of "research," activities related to:

Development of generalizable knowledge.

Under HIPAA, "retrospective research" (a.k.a., data mining) on collections of PHI generally ...

Is research, and so requires either an authorization or meeting one of the criteria for a waiver of authorization.