Skip to main content
Compliance Program

Compliance Program

Research Q&A

Question: What are the ways an investigator can access patient data?

Answer: There are six different categories under which an investigator can obtain authorization to access research data.

  1. Deidentified data (as defined by HIPAA — see de-identification)
  2. Work preparatory to research
  3. Decedent research
  4. Limited data set agreement
  5. Authorization by subject (or legal representative)
  6. Waiver of authorization

Question: How do I get approval to access patient data?

Answer: It depends upon the category under which you are obtaining the data. If an authorization or waiver of authorization is needed, the IRB will approve that. For work preparatory to research, decedent research, and limited data set agreements, you need to contact the privacy officer. Deidentified data is not covered by HIPAA, and there are no specific approval requirements, although you will have to contact the HIM department to obtain the data. These requirements do not replace the basic requirement to have the IRB approve human research. IRB approval (or exemption) is required for all except work preparatory to research and decedent research (if no identifiers are linked to living persons). See research requirements for more information.

Question: When does my study need to comply, and what does that mean for enrolling new patients?

Answer: April 14, 2003. Any patient who signed a consent form prior to that date can continue in the study. Any new patients must be enrolled with a consent form using new, approved, HIPAA-compliant language. Research studies in which consent has been waived by the IRB can continue enrolling new patients under the current approval.  For all other research studies that do not use consent forms, new patient data can only be collected after the investigator makes sure that the proper approvals have been obtained. The new research/HIPAA policy will detail how to obtain the approvals.

Question: What happens if a person withdraws from a study and revokes his or her authorization for use of his/her PHI?

Answer: 1) The covered entity cannot continue disclosing additional protected health information to a researcher and cannot continue using for its own research purposes information not already gathered at the time an individual withdraws his or her authorization. 2) There can be continued use and disclosure of protected health information to account for a subject's withdrawal from the research study, as necessary to incorporate the information as part of a marketing application submitted to the FDA, to conduct investigations of scientific misconduct, or to report adverse events. The Department believes ... this clarification of the Rule will minimize the negative effects on research caused by participant withdrawal and will allow for important continued uses and disclosures to occur, while maintaining privacy protections for research subjects. (paraphrased from Federal Register V. 67, No. 157, p. 53225)