HIPAA Guidelines and Forms for Research

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) included provisions to protect the privacy of individually identifiable health information and established the conditions under which covered entities might release such information for research purposes. The new regulations went into effect as of Monday, April 14, 2003. For researchers who currently obtain protected health information (PHI) from a covered entity, and for those investigators who in the future may wish to obtain PHI as part of their research or to pre-screen potential research subjects, the requirements imposed by HIPAA will change how you conduct your research. The guidelines provided in the following document are designed to assist researchers affected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) which is commonly referred to as the Privacy Act.

For more information and assistance regarding HIPAA and Human Subjects Research, please contact:

Robin Dillner, M.A., CIP
IRB Administrator
Phone: 49-45942

Investigator Guidelines

Purdue University Research Guidelines for Compliance with HIPAA Privacy Rule Word or HTML.

Forms

1. Authorization for Release or Use of Protected Health Information for Research Purposes

   This form would be completed by your prospective research participants (subjects) to enable you to access their protected health information (PHI) for research purposes. Covered entities may have their own form which you can use.

2. Application for Waiver of Authorization or Modification of Authorization under HIPAA Privacy Rule

   Use this form to request a Waiver of Authorization from the IRB if you feel you can not or will not be able to get a valid authorization signed by all the potential research subjects.

3. Certification of Compliance with HIPAA Privacy Rule Regarding Activities Preparatory to Research

   Form to use when certifying to a covered entity your need and purpose in reviewing PHI prior to the research beginning.

4. Certification of Compliance with HIPAA Provacy Rule for Research Involving Decedent's Information Only

   Use this form when your research involves obtaining PHI of deceased persons. HIPAA now requires that the IRB review research protocols of decedents when PHI is involved.

5. Data Use Agreement

   Researchers can use this form when entering into an agreement with a covered entity to gain access to and utilize a Limited Data Set that has specific PHI deleted from it.

Purdue Policy

Purdue University's Policy Statement on HIPAA

Links for Additional Information

• HIPAA Privacy Rules
• Department Head Notification of HIPAA Compliance
• "The New HIPAA Privacy Rule - Will it affect your research?"
• Department of Health and Human Services, Office of Civil Rights - HIPAA
• HIPAA Compliance at Purdue University