HIPAA in Research Posted on December 6, 2007 Celia B. Fisher (bio) outlines some key elements of the Health Insurance Portability and Accountability Act.

In terms of HIPAA, I think researchers have to understand what HIPAA is, understand whether or not they are a covered entity, that is whether or not they are providing health services, whether or not they’re collecting any information that is going to be used for the health care of an individual, whether or not the agency that they’re working with is a covered entity. And so they have to do their homework.

However, they also have to read all the different rules in HIPAA that are really quite responsive to research. There are some regulations in HIPAA that does not apply to research. For example, while HIPAA requires that all a patient’s records are available to them if they request them from a practitioner, that’s not the case with a researchers. A researcher who has protected health information as part of the research does not have to make that information available to the participant until the study is over.

In addition, they have to understand that they need to get authorizations from patients to have permission to use their, for example, archival or clinical data, that there’s a whole language that’s involved in HIPAA with legal terminology that they have to follow through. However, there are also times when HIPAA permits the waiver of informed consent if, in fact, an IRB approves that waiver, the covered entity has the right to also accept that waiver and provide individuals with access to their — to patient records.

One of the issues, I think one of the most critical issues - is how do you identify potential subject who are patients without violating their right to privacy? And that’s a big question for any practitioner or hospital that you may go to that you want to collaborate with them on some kind of research. So what we’ve done in the past is that if you can get agreement from a staff person, perhaps a secretary, to either provide on the counter when patients are coming in, here’s a research study, if you agree to be contacted, please sign that and we can authorize that we will provide your name. That’s one tack to take, because the patients do have to sign an authorization.

« Back to Article