The use of PHI to recruit an individual to participate in a research study must comply with HIPAA's general requirement the use must be pursuant to an authorization or some exception, such as a waiver of HIPAA authorization. Although recruitment procedures usually require access to a limited amount of health information, recruitment is considered to be an accessing of PHI and, therefore, must comply with HIPAA requirements.
Treating providers may not disclose PHI to a third party for purposes of recruitment in a research study without first obtaining authorization from the individual. A treating provider does, however, have the option to:
- Discuss with his/her own patients the option of enrolling in a study.
- Delegate recruitment to a member of the same Department/Division or Practice Plan
- Obtain written authorization from the patient for referral into a research study.
- Provide research information to the patient so that the patient can initiate contact with the researcher.
- Provide information to a researcher when the researcher has obtained an approved Waiver of Research Authorization from an IRB for recruitment purposes.
HIPAA also applies to recruitment and research activities conducted via medical records and medical registry reviews. Investigators must obtain either a Research Authorization from the subject or a Waiver of HIPAA Authorization approved by an IRB prior to commencing research recruitment activities from these sources. A Waiver of HIPAA Authorization for recruitment purposes only is referred to as a partial waiver. Researchers are required to obtain subjects' Research Authorizations after recruiting and enrolling subjects via a partial waiver and prior to creating or using PHI during research procedures.
« Return to previous FAQs page