# Standards and Regulatory References

## Primary Legislation

### HIPAA Privacy Rule — Research Provisions
- **45 CFR §164.508**: Authorization for research uses and disclosures of PHI. Specifies required elements of a valid authorization and research-specific provisions.
- **45 CFR §164.508(b)(3)**: Research-specific authorization provisions — permits general description of PHI, future unspecified research, and no expiration date.
- **45 CFR §164.512(i)(1)(i)**: Waiver or alteration of authorization by IRB or Privacy Board for research — requires documentation of minimal risk, impracticability without waiver, and impracticability without access to PHI.
- **45 CFR §164.512(i)(1)(ii)**: Reviews preparatory to research — PHI review permitted with representations that no PHI will be removed.
- **45 CFR §164.512(i)(1)(iii)**: Research on decedent information — permits use of decedent PHI with documentation.
- **45 CFR §164.512(i)(2)**: Documentation of IRB/Privacy Board waiver — must include required elements and be signed by chair or designee.

### HIPAA Privacy Rule — De-Identification and Limited Data Sets
- **45 CFR §164.514(a)**: Health information that does not identify an individual and there is no reasonable basis to believe it can identify an individual is not PHI.
- **45 CFR §164.514(b)**: Safe Harbor method — removal of 18 specified identifiers.
- **45 CFR §164.514(b)(1)**: Expert Determination method — statistical or scientific expert determines that risk of identification is very small.
- **45 CFR §164.514(e)**: Limited data set — excludes 16 direct identifiers; requires data use agreement.
- **45 CFR §164.514(e)(4)**: Data use agreement requirements — permitted uses, prohibited re-identification, safeguards, violation reporting.

### Common Rule — 45 CFR Part 46
- **45 CFR §46.116**: Informed consent requirements for human subjects research.
- **45 CFR §46.116(f)**: Waiver or alteration of informed consent — criteria parallel to but distinct from HIPAA waiver.
- **45 CFR §46.104(d)**: Exempt categories of research — certain secondary research on identifiable private information may be exempt under revised Common Rule (2018 Requirements).

### HITECH Act
- **HITECH Act §13405(c)**: Minimum necessary standard applies to research disclosures under waiver of authorization (not to authorized disclosures or individual access).

## Regulatory Guidance

- **OCR Research FAQ (2008, updated)**: Comprehensive FAQ addressing the relationship between HIPAA Privacy Rule and research, including authorization, waiver, de-identification, and limited data sets.
- **NIH Guidance on HIPAA and Research (2004, updated 2023)**: "Clinical Research and the HIPAA Privacy Rule" — how researchers at NIH-funded institutions can access and use PHI for research.
- **OHRP Guidance on Informed Consent and HIPAA Authorization (2008)**: Explains the difference between Common Rule informed consent and HIPAA authorization; when both are required.
- **FDA Guidance: Use of Electronic Health Record Data in Clinical Investigations (2018)**: How HIPAA applies when EHR data is used in FDA-regulated clinical trials.

## Enforcement Actions

- **University of Mississippi Medical Center (2016, $2.75M)**: Systemic failure in risk analysis and access controls affecting research data repositories containing ePHI.
- **University of Rochester Medical Center (2019, $3M)**: OCR settlement related to lost unencrypted devices containing research and clinical PHI; insufficient device-level encryption for research data.
- **Lurie Children's Hospital (2024, $3.45M)**: Research data containing PHI among compromised records; insufficient security for research systems.

## Professional Standards

- **CITI Program**: Collaborative Institutional Training Initiative — standard training program for HIPAA research privacy, used by over 2,300 institutions.
- **AAHRPP (Association for the Accreditation of Human Research Protection Programs)**: Accreditation standards for research privacy programs including HIPAA compliance.

## ISO/IEC Standards

- **ISO/IEC 27001:2022**: Information security management — applicable to research data systems storing PHI.
- **ISO/IEC 27701:2019 — Annex D**: Privacy controls for research data processing activities.