Human Research Protection Program

Home / Special Topics / HIPAA and Private Health Information

HIPAA and Protected Health Information

The Health Insurance Portability Accountability Act (HIPAA) Privacy Rule was issued to protect a person's individually identifiable health information and addresses the use and disclosure of such information.

The rule attempts to find a compromise between protecting an individual's privacy while allowing for the use of their individually identifiable health information to support the betterment of health care more generally through such things as medical research.

The HIPAA Privacy Rule protects the confidentiality of a person's protected health information (or individually identifiable health information) obtained from or through covered entities (health care providers such as hospitals, insurance companies, clinics, mental health providers, etc.) by giving the person the right to limit who may have access to it, and written authorization to use the person's protected health information must be obtained from that person.

Protected health information includes any information related to an individual's past, present or future physical or mental health; health care; or payment for health care in such a way as to reasonably expect possible identification of the individual.

Protected health information includes many common identifiers when they can be associated with the health information listed above:

Names (individual, employer, relatives, etc.).
Address (street; city; county; precinct; ZIP code — initial three digits if geographic unit contains more than 20,000 people; or any other geographical codes).
Telephone numbers.
Fax numbers.
Social Security numbers.
Medical record numbers.
Dates (except for years) connected to subjects, including date(s) of birth, admission, discharge, death, ages greater than 89 and all elements of dates indicative of such age (except that such age and elements may be aggregated as "Age ≥90").
Email addresses.
Health plan beneficiary numbers.
Account numbers.
Certificate/license numbers.
Vehicle identifiers and serial numbers (e.g., VINs, license plate numbers, etc.).
Device identifiers and serial numbers.
Universal resource locators (URLs).
Internet protocol (IP) addresses numbers.
Biometric identifiers (e.g., finger or voice prints).
Full-face photographic images (and any comparable images).
Any other unique identifying numbers, characteristics or codes.

Any health information by itself, without the 18 identifiers, is not considered to be protected health information (nor are the identifiers by themselves, without being linked to health information); and, if the health information can be de-identified, or the link between the health information and the 18 identifiers is broken, it is no longer considered to be protected health information.

HIPAA does not prohibit investigators who have not received a subject's written authorization from using the subject's health information in their research, however; it simply puts limits on what and how information may be used:

Expand All

Use of Limited Data Sets and DUAs

The investigator may also enter into a data use agreement with the covered entity, which allows the investigator to use a limited data set that excludes specified direct identifiers.

Under HIPAA rules, a limited data set cannot contain any of the following information:

Names.
Street addresses or postal address information with the exception of town/city, state, and ZIP code.
Phone/fax numbers.
Email addresses.
Social Security numbers.
Medical records numbers.
Health plan beneficiary numbers.
Other account numbers.
Certificate and license numbers.
Vehicle identifiers and serial numbers, including license plates.
Device identifiers and serial numbers.
URLs and IP addresses.
Biometric identifiers such as fingerprints, retinal scans and voice prints.
Full-face photos and comparable images.

The data use agreement must be accepted prior to the limited data set being shared and should outline the following:

Allowable uses and disclosures.
Approved recipients and users of the data.
An agreement that the data will not be used to contact individuals or re-identify them.
Require safeguards to be implemented to ensure the confidentiality of data and prevent prohibited uses and disclosures.
State that discovery of improper uses and disclosures must be reported back to the covered entity.
State that any subcontractors who are required to access or use the data also enter into a data use agreement and agree to comply with its requirements.

Requesting Waivers/Alterations of Authorization

Finally, the investigator may, under certain conditions, request a waiver/alteration of authorization from the Institutional Review Board, which could allow the investigator to use protected health information. The following criteria must be met before such a waiver can be granted:

The use or disclosure of the protected health information involves no more than minimal risk to the privacy of individuals based on, at least, the presence of the following elements:
- An adequate plan to protect health information identifiers from improper use and disclosure.
- An adequate plan to destroy identifiers at the earliest opportunity consistent with the conduct of the research (absent a health or research justification for retaining them or a legal requirement to do so).
- Adequate written assurances that the protected health information will not be reused or disclosed to (shared with) any other person or entity, except as required by law, for authorized oversight of the research, or for other research for which the use or disclosure of the protected health information would be permitted under the HIPAA Privacy Rule.
The research could not practicably be conducted without the waiver or alteration.
The research could not practicably be conducted without access to and use of the protected health information.

Investigators who wish to request a waiver/alteration of authorization from the IRB must include a completed application for waiver or modification of authorization for use or disclosure of PHI form in their IRB application.

Human Research Protection Program

HIPAA and Protected Health Information

Use of Limited Data Sets and DUAs

Requesting Waivers/Alterations of Authorization

More Information Regarding HIPAA and Research

Quick Links