Preface

This booklet contains information about the “Privacy Rule,” a Federal regulation under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 that protects certain health information. The Privacy Rule was issued to protect the privacy of health information that identifies individuals who are living or deceased. The Rule balances an individual’s interest in keeping his or her health information confidential with other social benefits, including health care research. This booklet provides researchers with a basic understanding of the Privacy Rule and how it may affect health research. It also addresses how researchers may be directly or indirectly affected by the Rule when their research requires the use of, or access to, an individual’s identifiable health information. The Privacy Rule (also known as Standards for Privacy of Individually Identifiable Health Information) is in Title 45 of the Code of Federal Regulations, Part 160 and Subparts A and E of Part 164. The full text of the Privacy Rule can be found at the HIPAA Privacy Web site of the Office for Civil Rights (OCR): http://www.hhs.gov/ocr/hipaa.

The Department of Health and Human Services (HHS) issued the Privacy Rule; HHS’s OCR has been given the authority to implement and enforce it. To increase researchers’ understanding of the Privacy Rule, OCR has developed guidance and technical assistance materials, which can be found at the HIPAA Privacy Web site noted above. In working with OCR, HHS’s Office for Human Research Protections (OHRP) and HHS’s research agencies, including the Agency for Healthcare Research and Quality (AHRQ), the Centers for Disease Control and Prevention (CDC), the Food and Drug Administration (FDA), and the National Institutes of Health (NIH) have developed Privacy Rule educational materials for the research community. This booklet, Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule, and its companion pieces for clinical, health records, and health services research, and for institutional review boards (IRBs) and Privacy Boards, are part of HHS’s ongoing efforts to educate the research community about the Privacy Rule. This booklet and its companion pieces can be found at http://www.hhs.gov/hipaaprivacy/research and at the OCR HIPAA Privacy Web site noted above.

Most parties subject to the Privacy Rule must implement the Rule’s standards and requirements by April 14, 2003. In addition to accessing the helpful information on the OCR and other Departmental Web sites, researchers should direct questions to their institutions or contact legal counsel about how the Rule may apply to a specific research project or organization. In addition to the information provided in this booklet, other sources of information about the Privacy Rule are listed under “Sources of Information about the Privacy Rule.”