HIPAA Compliance Guide for Clinical and Translational Science Institutes

Clinical and translational research can involve protected health information (PHI), including electronic protected health information (ePHI), at multiple stages—from identifying potential participants to analyzing and sharing results. Whether HIPAA applies depends on the institute’s legal status, its relationship to a covered entity or business associate, and how the information is used or disclosed.

When HIPAA applies to clinical and translational research

HIPAA applies to covered entities—health plans, health care clearinghouses, and certain health care providers—as well as business associates handling PHI on a covered entity’s behalf. A clinical and translational science institute is not automatically a covered entity simply because it conducts health research or holds identifiable health data. Its status depends on its functions and organizational relationships. HHS guidance on covered entities and business associates

Universities and other institutions that perform both covered and noncovered functions may elect to operate as a HIPAA hybrid entity. In that case, the institution designates its health care components, and most Privacy Rule requirements apply to those components. The institution’s written designation and organizational structure matter when determining whether a research unit is within the HIPAA-regulated component. HHS guidance on research components of hybrid entities

When a covered entity uses or discloses PHI for research, the HIPAA Privacy Rule requires an allowed basis for that use or disclosure. The Privacy Rule defines research as a systematic investigation designed to develop or contribute to generalizable knowledge, and it permits use of properly de-identified information without the research-specific authorization pathways described below. HHS HIPAA and Research guidance

What HIPAA training do research staff need?

A covered entity must train its workforce on its PHI policies and procedures as necessary and appropriate for each person’s role. The workforce can include employees, volunteers, trainees, and other people whose conduct is under the entity’s direct control. The Security Rule also requires a security awareness and training program for workforce members. HHS Summary of the HIPAA Privacy Rule and HHS Summary of the HIPAA Security Rule

Training for research staff should reflect their actual responsibilities. Depending on their access, that may include recognizing PHI, following approved authorization or waiver pathways, using role-based access, protecting study files and devices, sharing data only through approved channels, reporting suspected incidents, and following institutional retention and disposal procedures.

HIPAA requires training for new workforce members within a reasonable period and training when material changes affect their functions. The federal rule does not establish a universal annual training-certificate renewal schedule; an institute may set a more frequent schedule through its own policies. A completion certificate documents a person’s training, but it does not certify that the institute or a study is HIPAA-compliant. 45 CFR § 164.530(b)

When is HIPAA authorization required for research participants?

A covered entity generally needs a valid HIPAA authorization to use or disclose a participant’s identifiable PHI for research unless another Privacy Rule permission applies. The authorization must meet the rule’s requirements. It may be combined with research informed consent, but the two serve different purposes: informed consent addresses participation in the study, while HIPAA authorization permits specified uses and disclosures of PHI. HHS HIPAA and Research guidance

Authorization is not required in every research situation. A covered entity may use or disclose PHI without individual authorization when it has the required documentation of an IRB or Privacy Board waiver or alteration of authorization. The waiver must meet HIPAA’s criteria, including that the use or disclosure presents no more than a minimal risk to privacy and that the research could not practicably be conducted without the waiver and access to the PHI. IRB approval alone does not automatically establish a HIPAA waiver; the required waiver documentation must be in place.

Other specific pathways include a preparatory-to-research review, which can support activities such as study feasibility assessment or recruitment but does not permit the researcher to remove PHI from the covered entity, and research involving decedents when the required representations are made. A covered entity may also disclose a limited data set for research under a data use agreement. HHS guidance on preparatory research and HHS guidance on limited data sets

Properly de-identified information is no longer PHI under the Privacy Rule’s de-identification standard. HIPAA recognizes two methods: Expert Determination and Safe Harbor. A limited data set is different: it remains PHI, and its research use or disclosure requires a data use agreement. HHS de-identification guidance

How to protect PHI throughout the research data lifecycle

Set the permitted purpose and data pathway before collecting or accessing PHI. Document where the information comes from, which authorization or other Privacy Rule permission supports its use, who may access it, and whether the project needs identifiable data, a limited data set, or de-identified information. When the minimum necessary standard applies, limit access and disclosures to the PHI reasonably needed for the research purpose. HHS Minimum Necessary Requirement guidance

During collection and analysis, use approved systems and restrict access according to each person’s study role. Where appropriate, code or de-identify data and keep any re-identification key separate with access limited to authorized personnel. Check that data exports, analytic workspaces, and backups follow institutional safeguards and the approved research plan.

Before sharing data, verify the recipient, purpose, permitted data elements, and applicable agreement. Use approved transfer methods, review datasets and outputs for identifiers, and confirm that any authorization, waiver, or data use agreement covers the planned disclosure. If the purpose, recipient, or data elements change, pause the new use until the responsible privacy or compliance office reviews it.

At the end of the study or retention period, follow applicable institutional policy and agreements for archiving, returning, or securely disposing of PHI and the media on which ePHI is stored. HIPAA requires policies and procedures for the final disposition of PHI and ePHI, but does not prescribe one disposal method for every situation. HHS guidance on PHI disposal

Which privacy and security safeguards protect research data?

The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. The safeguards should be selected in light of the organization’s risk analysis, the systems and data involved, and reasonably anticipated threats. HHS Security Rule guidance

• Administrative safeguards: conduct and document risk analysis and risk management; assign security responsibility; manage workforce access; train the workforce; and establish security-incident and contingency procedures.
• Physical safeguards: control access to facilities and workstations, secure devices, and manage electronic media that store or carry ePHI.
• Technical safeguards: use access controls, audit controls, integrity protections, person-or-entity authentication, and transmission security for systems that maintain or transmit ePHI.

Use unique user accounts and role-appropriate access so the system can restrict access and support review of activity. Protect ePHI during transmission and assess whether encryption is a reasonable and appropriate safeguard for the organization’s circumstances. HIPAA treats encryption specifications as addressable, which means the entity must assess and implement them when reasonable and appropriate or document why an alternative measure is appropriate—not ignore the safeguard objective. HHS Security Rule safeguards and HHS guidance on encryption

How compliance offices support research teams

A covered entity must designate a privacy official responsible for developing and implementing its privacy policies. The Security Rule also requires an assigned security responsibility. Depending on the institution, privacy, security, research compliance, information technology, and contracting teams may share operational support for research studies. HHS Summary of the HIPAA Privacy Rule and HHS Summary of the HIPAA Security Rule

A research privacy review can help the study team identify whether the proposed data are PHI, confirm the applicable authorization or other permission, assess the proposed data flow, and determine whether a business associate agreement or data use agreement is needed. The review may also identify required access controls, secure transfer methods, documentation, and incident-reporting steps. This institutional review supports HIPAA compliance but does not replace any separate IRB review or study approval required by the institution.

Involve the appropriate office before accessing records, onboarding a vendor, changing data fields or recipients, or moving study data into a new system. Early review can help resolve privacy and security questions before they affect recruitment, data access, or collaboration agreements.

Covered entity and business associate responsibilities

Covered entities are responsible for complying with applicable HIPAA Privacy, Security, and Breach Notification requirements. They must have appropriate policies and safeguards, train their workforce, and permit uses and disclosures of PHI only as allowed by the rules. When an institute operates as part of a covered entity or its designated health care component, research teams must follow the entity’s applicable policies and procedures.

A business associate is generally a person or organization outside the covered entity’s workforce that performs a regulated function or certain services on the covered entity’s behalf involving PHI. When a business associate relationship exists, the covered entity generally must have a written business associate agreement (BAA) that defines permitted uses and disclosures and requires appropriate safeguards. Business associates also have direct responsibilities under certain HIPAA provisions. HHS guidance on business associate contracts

A researcher does not automatically become a business associate merely by receiving PHI for research. HHS explains that a disclosure for research does not, by itself, require a BAA; the covered entity must still disclose PHI through a pathway permitted by the Privacy Rule, such as authorization, a waiver, or a limited data set with a data use agreement. HHS guidance on research disclosures and business associate contracts

In practice, compliance depends on getting the institute’s HIPAA status right, choosing a valid pathway for research data, training staff for their roles, and protecting PHI and ePHI from access or disclosure beyond what the study permits.

FAQs

When does HIPAA apply to research conducted by a clinical and translational science institute?

HIPAA applies when a covered entity or its business associate creates, receives, maintains, uses, or discloses PHI in a regulated capacity. An institute is not automatically covered just because it conducts research; its status, its relationship to a covered entity, and any hybrid-entity designation determine which requirements apply. HHS guidance on covered entities and business associates

Is HIPAA authorization required for every research participant?

No. Authorization is one permitted pathway, but HIPAA also allows certain research uses or disclosures under documented IRB or Privacy Board waivers, specific preparatory-to-research or decedent provisions, and limited-data-set disclosures with a data use agreement. Properly de-identified information is not PHI under the Privacy Rule’s de-identification standard. HHS HIPAA and Research guidance

How should research teams protect ePHI during storage and transmission?

Use approved systems, restrict access according to study roles, monitor system activity, protect data integrity, and use safeguards appropriate to the risks during transmission. Assess encryption as part of the Security Rule’s addressable specifications and document the selected approach. HHS Security Rule guidance

What HIPAA responsibilities apply to research business associates?

A business associate must use or disclose PHI only as permitted by its BAA or as required by law, apply required safeguards, and meet applicable HIPAA duties, including certain breach-reporting and subcontractor requirements. Researchers receiving PHI solely for research are not automatically business associates, so determine the relationship and permitted disclosure pathway before sharing data. HHS guidance on business associate contracts and HHS guidance on research disclosures