The Health Insurance Portability and Accountability Act (HIPAA) regulates the protection of private health information for individuals. HIPAA's "Privacy Rule" sets standards for the use and disclosure of all individually identifiable health information obtained from a covered entity. All forms of health information that are associated with any of the 18 identifiers specifically defined by HIPAA are considered to be protected health information (PHI) subject to HIPAA regulations. To access this information, all research studies must obtain either an individual's authorization to access their information, granted by the provider of the PHI, or obtain an approval of a waiver of authorization. Effective April 14, 2003, all human subjects researchers must be in compliance with the Privacy Rule.

UC Berkeley's covered entities are the Tang Health Center, the Optometry Clinic, and the Psychology Clinic. Use of data from these units must receive prior CPHS approval. For more information about UCB covered entities, contact UC Berkeley Privacy Official Steve Lustig, Assistant Vice Chancellor, University Health and Counseling Services. For more information about protocol review, check with CPHS staff.