HIPAA Compliance Requirements for Longitudinal Cohort Study Centers

When HIPAA applies to longitudinal cohort research

HIPAA does not apply to every longitudinal cohort study simply because it collects health information. The Privacy Rule governs how health plans, health care clearinghouses, and certain health care providers—and their business associates—may use or disclose protected health information (PHI). A study center’s role and relationship to the organization holding the data matter: a research center may be part of a covered entity, a business associate, or neither. HHS guidance on who must comply with the Privacy Rule explains the covered-entity categories.

For a cohort study, assess each data source and transfer. Information may be PHI when it is individually identifiable health information held by a covered entity or business associate. If a covered entity provides identifiable records to a research team, the covered entity needs a permitted basis for that use or disclosure. A research center that is not itself covered by HIPAA may still have contractual, institutional, state-law, or other privacy obligations.

Longitudinal designs deserve particular attention because records may be linked across visits, facilities, and years. Before collecting or sharing data, identify which organization holds the PHI, who will access it, and whether the planned activity is covered by an authorization, a waiver of authorization, or another permitted pathway. HIPAA’s research provisions apply alongside any applicable human-subject protections; they do not replace them. HHS guidance on HIPAA and research describes these distinct requirements.

Choose authorization or seek a waiver of authorization

When a covered entity uses or discloses PHI for research, individual HIPAA authorization is one common pathway. The authorization must satisfy the Privacy Rule’s requirements, including describing the information and the use or disclosure, identifying the persons authorized to use or disclose it and the recipients, stating the purpose and expiration, and including the required signature and notices. For research, an authorization may state that it lasts until the end of the study or has no expiration date or event. HHS’s research guidance summarizes the special provisions for research authorizations.

Authorization is distinct from informed consent to participate. Informed consent addresses participation in the research as a whole; HIPAA authorization permits the use or disclosure of PHI for the specified purpose. The documents may be combined, but a combined form must meet the applicable requirements for both. HHS explains the difference between HIPAA authorization and informed consent.

If obtaining authorization is not practicable, an IRB or Privacy Board may approve a full or partial waiver only when the Privacy Rule’s criteria are met. The board must determine that the privacy risk is no more than minimal, including adequate plans to protect identifiers, destroy them at the earliest appropriate opportunity, and prevent impermissible reuse or disclosure. It must also determine that the research could not practicably be conducted without the waiver and could not practicably be conducted without access to and use of the PHI. A waiver of HIPAA authorization is not the same as a waiver of informed consent.

Use the pathway that matches the study’s actual data needs. A waiver is not a blanket permission to access every record or identifier: it applies to the approved scope. If the cohort protocol, data elements, sites, or intended disclosures change, ask the relevant privacy and review offices whether the existing authorization or waiver still covers the activity.

Document privacy approvals across multisite studies

For a multisite cohort, maintain a site-by-site record of who supplies, holds, accesses, and receives PHI, and the legal basis for each use or disclosure. Document whether a site relies on participant authorization, a waiver approved by an IRB or Privacy Board, a limited data set with a data use agreement, or another applicable pathway. Align those records with the protocol, data-sharing plan, and the specific PHI each site needs.

A central IRB or reliance arrangement can coordinate human-subject review, but do not assume that it automatically resolves every participating organization’s HIPAA responsibilities or local requirements. Confirm with each covered entity’s privacy office how it will rely on the relevant authorization, waiver documentation, or other permitted basis. HHS states that HIPAA waiver documentation must come from an IRB or a Privacy Board—not both—and describes what the documentation must contain. HHS guidance on documenting IRB or Privacy Board approval provides further detail.

Keep the approval record connected to the data flow it authorizes. For example, note which sites may disclose data, which receiving team may access it, what identifiers or variables are permitted, and any limits on onward sharing. Update the record when a site joins or leaves, a protocol amendment changes data access, or a new recipient is added. These practices help prevent a cohort’s original approval from being treated as permission for later, unreviewed uses.

Use limited data sets or de-identify study data

When a study does not need direct identifiers, consider whether it can use a limited data set or data that has been de-identified under the Privacy Rule. These are different options. A limited data set is still PHI: it excludes specified direct identifiers but may retain certain information, such as dates and city, state, and ZIP code. A covered entity may use or disclose a limited data set for research only under the applicable conditions and with a data use agreement (DUA) that limits use, identifies permitted users, requires safeguards, and bars re-identification or contacting individuals. HHS’s HIPAA audit protocol describes the limited data set and DUA requirements.

Privacy Rule de-identification is a separate standard. HHS recognizes two methods: a qualified expert’s determination that the risk of identification is very small, or Safe Harbor, which removes specified identifiers and requires that the covered entity lack actual knowledge that the remaining information could identify a person. Properly de-identified information is no longer PHI under the Privacy Rule. HHS guidance on Privacy Rule de-identification explains both methods.

For longitudinal research, assess whether dates, rare conditions, small geographic areas, or combinations of variables could identify participants, especially when records are linked over time or combined with outside data. A DUA may help govern a limited data set, but it does not turn that data into de-identified information or replace the Privacy Rule’s de-identification methods. Select the approach that preserves the detail the research needs while meeting the applicable privacy requirements.

Apply safeguards to PHI access and sharing

Limit access to PHI to workforce members who need it for authorized study duties. Use role-based permissions, individual user accounts, appropriate authentication, and procedures for approving, reviewing, and removing access as roles change. Train personnel on the organization’s privacy and security procedures, and establish a process for promptly escalating suspected misdirected disclosures or other security incidents.

For electronic PHI, covered entities and business associates must apply reasonable and appropriate administrative, physical, and technical safeguards. The HIPAA Security Rule includes access controls, audit controls, authentication, and transmission security, among other standards. The specific measures should reflect the organization’s size, systems, and security risks. HHS’s summary of the Security Rule describes these obligations.

Set sharing rules for each recipient and transfer method. Confirm that disclosures match the authorization, waiver, or DUA; use secure channels and approved storage; and prevent recipients from using data beyond the approved purpose. Where a vendor performs services involving PHI on behalf of a covered entity, determine whether a business associate agreement is required and ensure that the arrangement permits the intended work.

Retain HIPAA authorization and waiver documentation

Keep the signed authorization or the required waiver-approval documentation, along with records that show what the permission covers and when it applies. For a waiver, the documentation must identify the approving IRB or Privacy Board and approval date; state that the required waiver criteria were met; briefly describe the PHI approved as necessary; indicate whether review was normal or expedited; and include the chair’s or designated member’s signature. HHS lists the required waiver documentation elements.

HIPAA’s documentation retention rule generally requires covered entities to retain required Privacy Rule documentation for six years from its creation or the date it was last in effect, whichever is later. Apply that period to required authorization and waiver records, and check whether state law, other federal requirements, a sponsor, or institutional policy calls for a longer period. This is a documentation rule, not a universal HIPAA requirement to retain every medical record for six years. HHS’s audit protocol summarizes the six-year documentation period.

Use a retention schedule that accounts for ongoing enrollment, follow-up, amendments, and the closeout date for each site. Restrict access to retained records, preserve them in a retrievable format, and dispose of them securely when the applicable retention period ends and no other requirement applies. In practice, a sound compliance plan starts by determining whether HIPAA applies, then documenting the right permission for each data flow, minimizing or de-identifying data where appropriate, safeguarding access, and retaining the required evidence.

FAQs

When does HIPAA apply to information collected in a longitudinal cohort study?

HIPAA applies when a covered entity or its business associate uses or discloses protected health information in connection with the study. A cohort center is not automatically covered just because it conducts health research. Determine which organizations are covered entities or business associates, whether the information is PHI in their hands, and how it moves between sites. HHS guidance on covered entities and business associates explains who must comply.

Is HIPAA authorization separate from informed consent?

Yes. Informed consent is permission to participate in the research; HIPAA authorization permits specified uses or disclosures of PHI. They may appear in one combined document, but that document must satisfy the requirements that apply to both. HHS explains how the two permissions differ.

What must a study document to use a waiver of authorization?

The study must obtain documentation identifying the approving IRB or Privacy Board and approval date; confirming that the required waiver criteria were met; briefly describing the PHI approved as necessary; stating whether the waiver received normal or expedited review; and bearing the signature of the board chair or designated member. The board must also determine that the privacy risk is no more than minimal and that the research could not practicably be conducted without the waiver and without access to and use of the PHI. HHS’s HIPAA and research guidance sets out these criteria and documentation elements.

How long should HIPAA waiver records be retained?

Covered entities generally must retain required Privacy Rule documentation for six years from its creation or the date it was last in effect, whichever is later. Check applicable state law, other federal requirements, and institutional or sponsor policies for any longer period. This six-year rule concerns required documentation; it does not create a universal HIPAA medical-record retention period. HHS’s audit protocol summarizes the documentation retention requirement.