How can researchers obtain PHI for approved studies under HIPAA?

• A. By obtaining an authorization from the patient.
• B. By a waiver of authorization from an IRB/Privacy Board.
• C. By use of a Limited Data Set with a Data Use Agreement.
• D. All of the above.

Answer: (D)

Under HIPAA, researchers can obtain PHI for approved studies through multiple legitimate pathways, not just one. First, a patient can authorize the disclosure of their PHI specifically for the research, spelling out what information will be shared and with whom. This explicit permission supports access to the needed PHI.

Second, a waiver of authorization can be granted by an IRB or Privacy Board when the study meets certain safeguards and criteria—such as minimal risk to privacy, impracticability of obtaining authorization, a plan to protect privacy and limit uses/disclosures, and provisions to destroy or secure identifiers when no longer needed. This allows the research to proceed without individual patient authorizations.

Third, a Limited Data Set can be used under a Data Use Agreement. A Limited Data Set excludes most direct identifiers but may include certain allowed data elements, and the Data Use Agreement governs how the data can be used and disclosed and requires safeguards to prevent re-identification.

Because all of these approaches are permitted under HIPAA for approved research, the best choice recognizes all valid pathways.