HIPAA and Human Research

Collection of new health information from patients for use in research

Charles River Campus

Researchers may collect health information from patients within a Charles River Campus HIPAA-covered component for research purposes, only if:

  1. The Principal Investigator is authorized to treat patients in that component.
  2. The protected health information that is collected will be treated as PHI of that component.
  3. The protected health information will be used and protected in compliance with all BU HIPAA Privacy Policies and HIPAA Security Policies of the component.
  4. The research staff with access to the collected health information has received BU HIPAA Workforce Privacy Training and Security Training.

Researchers should consult with the records administrator of the component about these requirements. Records administrators should consult with the HIPAA Privacy or Security Officer about any questions. On the Charles River Campus, health information collected for research outside of a HIPAA-covered component is subject to IRB approval but is not subject to HIPAA.

Boston University Medical Campus

At Boston University Medical Campus, if the Principal Investigator is any one or more of the following, the entire research staff of a study is defined as part of the applicable HIPAA-covered workforce:

  • BMC employee
  • Has a BMC clinical appointment
  • Is a member of the Faculty Practice Plan
  • BUSDM Dental Clinic employee
  • Human Genetics Laboratory employee
  • Dental Pathology Laboratory employee
  • BU Dental Plan employee; or
  • Boston Public Health Commission employee

Researchers who are members of a HIPAA-covered workforce, as explained above, may collect health information at Boston University Medical Campus for research purposes, only if:

  1. Research staff with access to the collected health information has received, as applicable, either
    • BMC HIPAA Workforce Privacy Training and Security Training or
    • BU HIPAA Workforce Privacy Training and Security Training.
  2. Protected health information that is collected will be treated as PHI of, as applicable
    • BMC or
    • BU HIPAA-covered component
  3. Protected health information will be used, and protected in compliance with all HIPAA Privacy Policies and HIPAA Security Policies of BMC or the BU HIPAA-covered component (as applicable).

Researchers should consult with the records administrator of the entity or component whose workforce is carrying out the research. Records Administrators should consult with the applicable HIPAA Privacy or Security Officers about any questions.