I understand about obtaining information from covered entities records for use in research. Is PHI ever created within the course of conducting research?
When a health care activity is performed within the research study itself -for example, a clinical trial or other clinical intervention study – any individual clinical record information that is generated within that research is PHI that is subject to all the HIPAA regulations that apply to PHI that becomes part of the health care treatment, payment and operations records of the health care provider, health plan and/or health care clearinghouse. For example, clinical information generated within a research study may be simultaneously entered into the clinical record of an individual patient and into the research data set intended to produce generalizable knowledge. The research use of the PHI and protection of the privacy and security of the research data set must be in accord with the terms and conditions of the IRB approval, the informed consent and the authorization as well as relevant institutional policies on data privacy and security.
