What do the HIPAA privacy regulations require in order to use PHI for research?
The general rule under the privacy regulations is that in order to use PHI for research a HIPAA compliant authorization must be obtained from the subject. These authorizations may be combined with any other type of written permission for the same research study, including consents to participate in such research and covered health care providers may condition the provision of research-related treatment on receipt of a prior authorization for the use or disclosure of PHI.
