HIPAA and Human Research
Access to existing health information for use in research
Researchers may obtain access to existing health information of any HIPAA-covered component or Boston Medical Center by using one of six pathways below.
Contacts
- Charles River Campus HIPAA-covered component
For access to records, contact the HIPAA-covered component's Records Administrator who may consult with the BU Privacy Officer or the BU Office of the General Counsel (353-2326). - BU Medical Campus HIPAA-covered component or of Boston Medical
Center
For access to records, contact the BUMC IRB for guidance and the Records Administrator for assistance. For more information, visit Privacy and Research: HIPAA. - External Entity
For access to the records, contact its records administrator.
Pathways
- Authorization (most common pathway): You must have all patients participating in the research sign a HIPAA compliant Authorization before you review their pre-existing health records. Obtain the form of Authorization from Contacts listed above. Have your IRB approve the form of your HIPAA Authorization.
- Waiver (Privacy Board) Obtain a waiver of HIPAA authorization from a Privacy Board. For assistance consult Contacts above.
- Access Preparatory to Research: Provide required statements to the HIPAA-covered Component or Boston Medical Center for access preparatory to research. For assistance consult Contacts above.
- Access Solely to Records of Decedents: Provide required statements to the HIPAA-covered Component or Boston Medical Center. For assistance consult Contacts above.
- Access to De-identified Data: Work with the HIPAA-covered Component or Boston Medical Center to ensure that all (18) required identifiers are removed; For assistance consult Contacts above.
- Limited Data Use Agreement: Work with the HIPAA-covered Component or Boston Medical Center to develop a Limited Data Use Agreement. For assistance consult Contacts above.
