Skip to Content

Resources :: Guide :: Vulnerable and risk sensitive participants :: Vulnerable participants :: Potential for coerced consent :: Doctor/ Patient relationships in research :: Medical records and HIPAA

Medical Records and HIPAA

For many studies involving patients, medical records can be a valuable source of information.  However, please note that although you may have access to medical records as a doctor, you do not have access to medical records as a researcher unless a participant grants you that access. HIPAA (Health Insurance Portability and Accountability Act) was drafted in order to protect individuals’ private health information including information recorded in medical records. HIPAA specifies certain requirements for obtaining access to medical records and how this information should be handled in order to protect privacy. The IRB is required to assure that proper authorization is given by the patient to use their private health information.  The IRB can also partially or completely waive the requirement for authorization if various conditions are met as outlined in the Privacy Rule. Generally authorization can be included in a consent form, but in some cases requires additional documentation. 

The IRB-SBS does not review studies where HIPPA regulations apply. These studies are reviewed by the IRB-HSR.  To determine which IRB should review your study, please see Choosing the Right IRB: SBS vs. HSR.

Previous :: Recruitment and consent
Next :: Return to potential for coerced consent