HIPAA Compliance Guide for Hospital Research and IRB Offices

HIPAA Applicability in Research

This HIPAA Compliance Guide for Hospital Research and IRB Offices explains when and how the HIPAA Privacy and Security Rules apply to research. HIPAA governs uses and disclosures of Protected Health Information (PHI) by covered entities and their business associates, including hospitals and academic medical centers.

PHI is individually identifiable health information in any medium. Fully de-identified data (via Safe Harbor removal of direct identifiers or expert determination) is not PHI. A limited data set remains PHI but may be shared for research under a data use agreement. Your Institutional Review Board Policies often describe which pathway fits your project.

Common pathways to access PHI for research include:

• Research Subject Authorization signed by the individual or a legally authorized representative.
• IRB or Privacy Board waiver or alteration of authorization when criteria are met.
• Reviews preparatory to research (on-site review without recording identifiers beyond what is necessary to prepare a protocol).
• Research solely on decedents’ information with required representations.
• Use of a limited data set under a data use agreement or use of de-identified data.

Apply the minimum necessary standard to every use or disclosure. For ePHI, implement security safeguards such as access controls, encryption in transit and at rest, and audit logging. Align data handling with your PHI Documentation Standards.

IRB's Role as Privacy Board

The IRB may serve as the institution’s Privacy Board. In this role, it evaluates Privacy Board Compliance when reviewing requests to use or disclose PHI for research without individual authorization. The IRB ensures the minimum necessary PHI is requested and that privacy safeguards match the study’s risk profile.

When acting as a Privacy Board, the IRB documents its determinations, including the Authorization Waiver Criteria analysis, any alterations to standard elements, and limits on PHI access. It also verifies that data sharing aligns with Institutional Review Board Policies, data use agreements, and plans for secure storage, retention, and destruction.

Obtaining PHI Authorization

Most prospective research involving PHI requires Research Subject Authorization. Use plain language and ensure the individual understands what PHI will be used and why.

Required elements of authorization

• Description of the PHI to be used or disclosed and the study purpose.
• Who may use/disclose the PHI and who may receive it (e.g., study team, sponsors).
• Expiration date or event (for example, “end of the research” or “none” for certain repositories, if permitted).
• Right to revoke and how to do so, plus any exceptions after revocation.
• Whether authorization is a condition of receiving research-related care or benefits.
• Statement about potential re-disclosure by recipients not subject to HIPAA.
• Signature and date of the individual or legally authorized representative.

Best practices

• Tailor the authorization to the specific data elements; avoid open-ended PHI requests.
• Use combined authorizations judiciously and clearly separate conditioned from unconditioned components when applicable.
• Accommodate minors and decisionally impaired adults through appropriate representatives.
• Employ electronic signatures only if permitted by your Institutional Review Board Policies.
• Store signed authorizations securely and index them for retrieval per PHI Documentation Standards.

Waiver of Authorization

When obtaining individual authorization is impracticable, investigators may request a waiver or alteration from the IRB acting as a Privacy Board. This is common for minimal-risk studies such as retrospective chart reviews or feasibility queries.

Authorization Waiver Criteria

• Use/disclosure of PHI poses no more than minimal risk to privacy based on an adequate plan to protect identifiers.
• There is a plan to destroy identifiers at the earliest opportunity consistent with research needs and legal requirements.
• There are written assurances that PHI will not be reused or disclosed except as required by law, for oversight, or for other permitted research.
• The research could not practicably be conducted without the waiver.
• The research could not practicably be conducted without access to and use of the PHI requested.

Alterations and partial waivers

• Partial waivers may permit activities like screening or recruitment via medical records.
• Alterations may remove or modify certain authorization elements when justified.

Documentation and accounting

• Retain IRB/Privacy Board documentation of the waiver or alteration per PHI Documentation Standards.
• Coordinate with Health Information Management regarding any accounting of disclosures obligations for PHI disclosed without authorization.

Alternatives to a waiver include using a limited data set under a data use agreement, de-identified data, preparatory-to-research reviews, or decedent research when criteria are satisfied.

HIPAA Compliance Resources

Hospital researchers should leverage internal resources that translate regulations into day-to-day practice. Centralize these in your intranet or research portal and ensure they are reflected in team workflows and study start-up checklists.

• Institutional Review Board Policies for research with PHI, recruitment, databases/repositories, and data sharing.
• HIPAA Training Programs tailored to research staff, with refreshers for role changes and new systems.
• Templates: Research Subject Authorization, waiver/alteration request forms, data use agreements, and business associate addenda.
• PHI Documentation Standards: retention schedules, secure storage locations, version control, and access provisioning.
• De-identification and limited data set toolkits, including identifier checklists and data dictionaries.
• Security guides for ePHI: encryption, approved applications, audit logging, and breach response procedures.

Contact Information for HIPAA Inquiries

Direct HIPAA questions to institutional offices that can give prompt, authoritative guidance for research workflows.

• Privacy Officer or Compliance Office for Privacy Board Compliance and policy interpretation.
• Health Information Management for release-of-information workflows and accounting of disclosures.
• Information Security for ePHI safeguards, approved tools, and incident reporting.
• Research Administration for contracting terms (e.g., data use agreements, business associate provisions).

What to include in your inquiry

• Study title, protocol number, and principal investigator.
• Specific PHI elements requested and the research purpose.
• Data sources, recipients, storage locations, and sharing plans.
• Whether you seek authorization, a waiver, or another pathway.
• Timelines or deadlines that affect review.

IRB Contact Information

Engage the IRB early for studies involving PHI, especially when designing recruitment, data abstraction, or multi-institution data sharing.

• Contact the IRB office via the research portal, phone, or designated email for pre-submission consultations.
• Request guidance on reliance/single-IRB arrangements and Privacy Board review logistics.
• Ask about expected review timelines for authorizations, waivers, and amendments affecting PHI.
• Provide data flow diagrams and role-based access plans to streamline review.

FAQs

What is the role of the IRB as a Privacy Board under HIPAA?

The IRB can act as the institution’s Privacy Board to evaluate requests to use or disclose PHI for research without individual authorization. It assesses Authorization Waiver Criteria, applies the minimum necessary standard, confirms privacy safeguards, and documents determinations to ensure Privacy Board Compliance.

How can researchers obtain authorization to use PHI in research?

Prepare a Research Subject Authorization that clearly states what PHI will be used, by whom, for what purpose, to whom it will be disclosed, and when it expires. Include rights to revoke, statements on re-disclosure, and required signatures. Use institution-approved templates and store signed forms per PHI Documentation Standards.

When can a waiver of authorization be granted by the IRB?

The IRB may grant a waiver or alteration when the study poses minimal privacy risk with adequate safeguards, identifiers will be destroyed when no longer needed, PHI will not be misused, and the research could not practicably proceed without both the waiver and the specific PHI requested.

Where can hospital researchers find resources for HIPAA compliance?

Consult your institution’s IRB website or intranet for Institutional Review Board Policies, HIPAA Training Programs, authorization and waiver templates, PHI Documentation Standards, and security guidance. Your Privacy Officer, HIM, and Information Security teams can provide additional tools and answers tailored to your study.