National Institutes of Health


Sitemap Contact
National Institutes of Health HIPAA Privacy Rule - Information for Researchers
This website is currently in the process of being updated. For guidance on the HIPAA Privacy Rule in research, please see: https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
HomeDictionaryFAQResources

Educational Materials

Clinical Research

Authorizations

Institutional Review Boards

Privacy Boards

Information for Patients

HIPAA Privacy Rule Booklet for Research

Health Services Research and the HIPAA Privacy Rule

Research Repositories, Databases


What Is the Effect of the Privacy Rule on Research Started Before the Compliance Date?


Key Points:
  • Research that is ongoing before the applicable compliance date (usually April 14, 2003) is covered by the Privacy Rule's transition provisions if the research participant's informed consent, other legal permission for the research use and disclosure, or an IRB's waiver of informed consent was obtained by the covered entity before the applicable compliance date for the Privacy Rule.


The Privacy Rule includes a limited provision that "grandfathers" certain permissions obtained for research that were obtained prior to the compliance date. Under these transition provisions, a covered entity may use and disclose for the research purposes allowed by those permissions PHI that was created or received, either before or after the compliance date, if any one of the following is obtained before the compliance date:   Transition Provisions - A section of the Privacy Rule that permits covered entities to rely on express legal permission for use and disclosure of PHI, informed consent, or IRB-approved waiver of informed consent for research, provided the legal permission, informed consent, or IRB-approved waiver was obtained prior to the compliance date.
  • An Authorization or other express legal permission from an individual to use or disclose PHI for the research.
  • The informed consent of the individual to participate in the research.
  • A waiver of informed consent by an IRB.

However, if a waiver of informed consent was obtained prior to the compliance date, but informed consent is sought from the research subject after the compliance date, the covered entity must obtain the individual's Authorization as required under the Privacy Rule unless such use or disclosure is permitted without Authorization. For example, if there had been a temporary waiver of informed consent for emergency research under the FDA Protection of Human Subjects Regulations, and informed consent was later sought after the compliance date, a covered entity would have to obtain an individual Authorization before it could use or disclose PHI for the research, unless the activity is otherwise permitted by the Privacy Rule.

The Privacy Rule allows covered entities to rely on express legal permission, informed consent, or IRB-approved waiver of informed consent obtained before the compliance date to use and disclose PHI for research studies, as well as for any future research that may be included in such permission. This provision is different from those applying to an Authorization or a waiver obtained after the compliance date. Authorizations and waivers after the compliance date will only permit the use or disclosure for the specific research study for which they were obtained.

In some instances, existing express legal permissions, informed consents, or IRB-approved waivers of informed consents are not study specific. These permissions for research and waivers, even if provided for future unspecified research, are grandfathered by the transition provisions provided the permission or waiver was obtained prior to the compliance date and informed consent for research is not sought later.


Home - Dictionary - FAQ - News - Events - Resources - Site Map - Contact Information
Site last updated: 02/02/2007
Department of Health and Human Services National Institutes of Health USAGov The HIPAA Privacy Rule