As an employee of the JHM covered entity, how does the HIPAA Privacy Rule affect my research?
Under the HIPAA Privacy Rule you must meet certain requirements before using or disclosing individually identifiable health information for research. (These HIPAA requirements are in addition to IRB requirements under federal regulations for the protection of human subjects.) The HIPAA Privacy Rule defines “individually identifiable” broadly, to include information such as name, address, or SSN, as well as “indirect identifiers” such as zip codes or date of birth, when attached to any health information. A covered entity and its employees may not use or disclose individually identifiable health information (called “protected health information,” or “PHI”) for research, except in one of the following circumstances:i) The patient has signed a written Authorization containing all the elements specified in the Privacy Rule; ii) An IRB has waived or altered the requirement for HIPAA Authorization; iii)The covered entity has “de-identified” the data prior to its use or disclosure for researc
