I: What is an Individual Authorization?

Adapted from the Health and Human Services’ Office of Civil Rights http://www.hhs.gov/ocr/hipaa/

Research Use/Disclosure With Individual Authorization. The Privacy Rule permits covered entities to use or disclose protected health information for research purposes when a research participant authorizes the use or disclosure of information about him or herself. Today, for example, a research participant’s authorization will typically be sought for most clinical trials and some records research. In this case, documentation of IRB or Privacy Board approval of a waiver of authorization is not required for the use or disclosure of protected health information.

Some Researcher-Specific Points:

To use or disclose protected health information with authorization by the research participant, the covered entity must obtain an authorization that satisfies the requirements of 45 CFR 164.508. The Privacy Rule has a general set of authorization requirements that apply to all uses and disclosures, including those for research purposes. However, several special provisions apply to research authorizations:

I. Unlike other authorizations, an authorization for a research purpose may state that the authorization does not expire, that there is no expiration date or event, or that the authorization continues until the “end of the research study;” and

I. An authorization for the use or disclosure of protected health information for research may be combined with a consent to participate in the research, or with any other legal permission related to the research study.

A model individual authorization is available.

**Please note:  THIS REPORT HAS NOT BEEN APPROVED BY THE AGENCY FOR HEALTH CARE RESEARCH AND QUALITY (AHRQ).