Human Research Protection Program

HIPAA and Human Subjects Research

The Health Insurance Portability and Accountability Act (HIPAA) regulates the protection of private health information for individuals. HIPAA’s “Privacy Rule” sets standards for the use and disclosure of all individually identifiable health information obtained from a covered entity. All forms of health information that are associated with any of the 18 identifiers specifically defined by HIPAA are considered to be protected health information (PHI) subject to HIPAA regulations. To access this information, all research studies must obtain either an individual’s authorization to access their information, granted by the provider of the PHI, or obtain an approval of a waiver of authorization. Effective April 14, 2003, all human subjects researchers must be in compliance with the Privacy Rule.

UC Berkeley’s covered entities are the University Health Services (including its health care services on behalf of Intercollegiate Athletics), and the Optometry Clinic. Specifically, these are the Tang Health Center, Optometry Clinic, Human Resources Health Plan, and Athletics and Recreational Sports. Use of data from these units must receive prior CPHS approval. For more information about UCB covered entities, contact Lisa Ho, Campus Privacy Officer. For more information about protocol review, check with CPHS staff.




  • UC Research Authorization for Release and Use of Personal Health Information and Personally Unidentified Study Data (for individual subjects) - PDF or Word
  • UCB Waiver of AuthorizationPDF  or  Word