HIPAA and Research
Use and Disclosure of Patient Information for Research
The HIPAA Privacy Rule is a regulation that governs the way health information is collected, maintained, used, and disclosed. The HIPAA Privacy Rule requires covered entities to use and disclose Protected Health Information (PHI) according to specific requirements including:
- Written authorization from the study participant and subject of the PHI
- Special representations for reviews preparatory to research and use of decedent information
- Approved waiver of HIPAA authorization from an IRB or Privacy Board
- Data Use Agreements if the information is released as a limited data set
OSUMC and Access to Patient Information for Research
Obtaining approval from the IRB is the first step to starting research involving PHI. Once appropriate IRB approval has been obtained the research team will need to provide the proof of IRB approval to the department of Medical Information Management to access PHI from patient medical records for the purposes of research. Additional forms may need to be completed.
- OSU Medical Center: Guide to Information Access for Research Activities https://www.medctr.ohio-state.edu/Departments/MIM/Resources/Research.aspx
- Request for Research Access to Health System Clinical Information https://www.medctr.ohiostate.edu/Departments/MIM/Forms/PDF/ReqForResearchAccessToClinInfo.pdf
- Research Statement of Confidentiality https://www.medctr.ohiostate.edu/Departments/MIM/Forms/PDF/ResearchStatementOfConfidentiality.pdf
Access to electronic medical records for research is limited to employees of OSUMC who can show proof of or have provided the appropriate representations to the Department of Medical Information Management. If you access electronic records for research, you may be asked to provide confirmation of IRB approval prior to or after access.
- Office of Responsible Research Practices: HIPAA and Human Subjects Research http://orrp.osu.edu/irb/hipaa/index.cfm
- National Institutes of Health Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule http://privacyruleandresearch.nih.gov/pdf/HIPAA_Booklet_4-14-2003.pdf
- Health Services Research and the HIPAA Privacy Rule http://privacyruleandresearch.nih.gov/pdf/HealthServicesResearchHIPAAPrivacyRule.pdf
- Research Repositories, Databases, and the HIPAA Privacy Rule http://privacyruleandresearch.nih.gov/pdf/research_repositories_final.pdf
- Clinical Research and the HIPAA Privacy Rule http://privacyruleandresearch.nih.gov/pdf/clin_research.pdf
- Institutional Review Boards and the HIPAA Privacy Rule http://privacyruleandresearch.nih.gov/irbandprivacyrule.asp
- Privacy Boards and the HIPAA Privacy Rule http://privacyruleandresearch.nih.gov/privacy_boards_hipaa_privacy_rule.asp
- HIPAA Authorization for Research http://privacyruleandresearch.nih.gov/pdf/authorization.pdf