Table 1. Ways in Which Protected Health Information Can be Used and Disclosed by Covered Entities For Research Under the HIPAA Privacy Rule [45 CFR parts 160, 162, and 164].

With individual's authorization for research [See 45 CFR part 164.508] Without individual's authorization if one of the following applies and other conditions in the Rule have been met [See 45 CFR part 164.512]: IRB or Privacy Board waiver Preparatory to research (with certain representations) Limited data set (with data use agreement) De-identified dataset Research solely on decedents Informed consent, waiver of informed consent, or permission before compliance date