Reviews preparatory to research

What does Reviews preparatory to research mean in clinical research?

Under 45 CFR 164.512(i)(1)(ii), a covered entity may let a researcher use or access protected health information without authorization when the researcher represents three things: the use is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research, no PHI will be removed from the covered entity during the review, and the PHI is necessary for the research.^⁠[1]

Sites commonly rely on this pathway to answer feasibility questionnaires, for example by counting how many patients appear to meet a study's key criteria. FDA's 2023 informed consent guidance adds that a feasibility survey of patient records does not require informed consent under FDA regulations, but it must comply with HIPAA.^⁠[2]

Practical note: a preparatory review supports counting and planning. Contacting patients is a separate step with its own requirements, such as IRB approval of the recruitment plan and, where needed, a waiver of authorization, so check with your privacy office before any outreach. See the feasibility questionnaire template and how Bond handles PHI on the Security page.