HIPAA - Frequently Asked Questions (FAQs) - The University of Oklahoma Health Sciences Center

4. Is patient Authorization required to use and disclose Protected Health Information for research?

Generally, a research participant must execute a written Authorization to permit researchers to use his/her Protected Health Information for research. There are 3 exceptions to this general rule:

1. IRB Waiver: The researcher can seek a waiver of the Authorization requirement from the IRB. The IRB can approve a waiver only if the use of PHI will pose no more than a “minimal risk” to the privacy of individuals and the research cannot practicably be conducted without the waiver.

2. Preparatory Review: The researcher must represent that the uses and disclosures of PHI are necessary for the research and that no Protected Health Information will be removed from the premises of the Covered Entity providing the information.

3. Decedent Research: The researcher must represent that the access is necessary for research and that the use or disclosure of PHI is solely for the purpose of reviewing the protected health information of the deceased.