In the course of conducting research, researchers may obtain, create, use, and/or disclose individually identifiable health information. Under the Privacy Rule, covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.
Research Use/Disclosure Without Authorization.
To use or disclose protected health information without authorization by the research participant, a covered entity must obtain one of the following:
- Documented Institutional Review Board (IRB) or Privacy Board Approval
- Preparatory to Research
- Research on Protected Health Information of Decedents
- Limited Data Sets with a Data Use Agreement
- Research Use/Disclosure With Individual Authorization
- Accounting for Research Disclosures
- Transition Provisions