Table 2.

Privacy Requirements for consent under the Common Rule and authorization under HIPAA.

Common Rule (45 CFR 46.116) Consent36	HIPAA Authorization35 (45 CFR 164.508)
A statement that explains the purpose, duration, procedures, alternative procedures, risks and benefits of the research.	An authorization must be written in plain language with specific terms.
A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.	All authorizations must include information regarding the information to be disclosed or used, the person(s) disclosing and receiving the information, expiration, right to revoke in writing, and other data.
A statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty or loss of benefits to which the subject is otherwise entitled.	Treatment, payment, enrollment, or benefits eligibility may not be a condition for authorization.