HIPAA authorization

What does HIPAA authorization mean in clinical research?

Under the HIPAA Privacy Rule, a covered entity may not use or disclose protected health information without a valid authorization unless the rule otherwise permits or requires it. A valid authorization contains six core elements, including a specific description of the information, who may receive it, each purpose, an expiration, and the individual's signature and date. For research, the expiration can be the end of the research study or none.^⁠[1]

HIPAA also lets a research authorization be combined with the informed consent to take part in the same study, which is why many consent forms include a HIPAA section.^⁠[1] Recruitment usually happens before either is signed, so sites rely on other pathways to find and contact candidates: reviews preparatory to research, or an IRB or Privacy Board waiver or alteration of authorization, in whole or in part.^⁠[2]

Practical note: write down which pathway covers each recruitment step, from chart review to first call to consent, and make sure the IRB submission says the same thing. See the IRB and HIPAA outreach guide and how Bond handles PHI on the Security page.