[an error occurred while processing this directive]

Office for Civil Rights

The HIPAA Privacy Rule and Research

The Department of Health and Human Services (HHS) issued the Standards for Privacy of Individually Identifiable Health Information (the Privacy Rule) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to provide the first comprehensive Federal protection for the privacy of personal health information. Many of those who must comply with the Privacy Rule must do so by April 14, 2003.

While certain provisions of the Rule specifically concern research and may affect research activities, the Privacy Rule recognizes that the research community has legitimate needs to use, access, and disclose Protected Health Information (PHI) to carry out a wide range of health research protocols and projects. The Privacy Rule protects the privacy of such information while providing ways in which researchers can access and use PHI when necessary to conduct research.

This Web site has been developed to provide the research community with information about the HIPAA Privacy Rule and how it might affect research. The following publications are available:

Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule , a booklet discussing how provisions of the Privacy Rule may affect research.
Sample language that covered entities may wish to consider when developing an authorization for use and disclosure of protected health information for research.
Institutional Review Boards and the HIPAA Privacy Rule
Additional companion pieces to the booklet that will address the possible affects of the Privacy Rule on specific types of research activities are under development and will be available soon through this web site.

Tools are also available to help entities determine whether they are covered entities and subject to the Rule. Access these tools at: http://www.cms.hhs.gov/hipaa/hipaa2/support/tools/decisionsupport/default.asp.

To view the NIH web site on research and the Privacy Rule, go to: http://privacyruleandresearch.nih.gov.

To view the complete final Privacy Rule go to: http://www.hhs.gov/ocr/hipaa/finalreg.html.

Last Revised: October 3, 2003

The White House | USA.gov | HHS Archive | No FEAR Act