Beware: Data privacy compliance concerns in clinical research

Many health care providers participate in clinical research activities, either as active investigators, or as contributors of data to studies being conducted by others.

Even if the study has approval by an Institutional Review Board (IRB), it is critical to determine whether the IRB waived any requirements for patient authorizations to use or disclose protected health information (PHI) in connection with the study. If there is an IRB waiver, the providers should confirm that the wording of the waiver is broad enough to capture the full scope of contemplated uses or disclosures of PHI. Oftentimes the IRB waiver extends only to patients of the institution, and does not extend to offsite private practice locations that also may be recruited to participate in the research study.

If there is no IRB waiver, then it is important to determine whether HIPAA-compliant patient authorizations are required in order to use or disclose the PHI in connection with the study.