The Health Insurance Portability and Accountability Act (HIPAA) of 1996 was enacted to standardize the electronic transmission of healthcare and medical billing through the use of standardized transaction sets and to strengthen the requirements for maintaining the confidentiality of a patient's identifiable healthcare information. Access to medical records in any format (e.g., electronic, paper, oral) must be by either written authorization by the research participant or under a Waiver of Authorization approved by the HIC.

PHI in Research

To use or disclose Protected Health Information (PHI) created from a research study that includes treatment (e.g., a clinical trial), additional research-specific elements must be included in the consent and authorization form, which describe how PHI created for the research study will be used or disclosed. For example, if the covered entity/researcher intends to seek reimbursement from the research subject's health plan for the routine costs of care associated with the protocol, the authorization must describe types of information that will be provided to the health plan.

The Waiver of Authorization Form is required when searching records to identify potential research subjects, or when conducting a data collection study.