Overview of Research Compliance
Health information used in research is subject to a distinct set of regulatory requirements layered on top of HIPAA, including the Common Rule and institutional review board oversight. RHIA candidates must understand how these frameworks interact and what HIM professionals are responsible for when data is disclosed for research purposes.
HIPAA Pathways for Research Disclosure
- Individual authorization: the patient signs a specific authorization permitting use of their data for a named research study
- IRB or privacy board waiver: an institutional review board determines that authorization can be waived because the research meets specific criteria, such as minimal risk to privacy and impracticability of obtaining authorization
- Limited data set with a data use agreement: direct identifiers are removed and the recipient signs an agreement restricting further use
- De-identified data: data stripped of all eighteen HIPAA identifiers may be used freely, as it is no longer considered protected health information
The Common Rule and Informed Consent
The Common Rule, also known as the Federal Policy for the Protection of Human Subjects, requires informed consent from research participants and mandates IRB review of research involving human subjects at institutions receiving federal funding. Informed consent is distinct from HIPAA authorization: consent addresses participation in the study itself, while authorization addresses use and disclosure of the participant's protected health information.
Preparatory to Research Reviews
Researchers may review records to prepare a research protocol, such as assessing feasibility of enrollment, without authorization, provided the researcher represents that the review is solely to prepare the protocol, no protected health information will be removed from the covered entity, and the information is necessary for the research purpose. HIM staff must document and verify these representations.
Accounting for Disclosures
Research disclosures made without patient authorization, such as those under an IRB waiver, must be tracked and included in an accounting of disclosures if the patient requests one, unlike routine treatment, payment, and operations disclosures which are generally excluded from such an accounting.
Exam Tips
Expect questions distinguishing the four research disclosure pathways and identifying which applies to a given scenario. Also expect questions on preparatory-to-research reviews and on what must be tracked for disclosure accounting purposes.
Key takeaway: Research compliance requires HIM professionals to correctly apply HIPAA's research-specific pathways alongside Common Rule and IRB requirements, a frequently tested Compliance domain intersection.