HIPAA and Human Subjects Research
The Health Insurance Portability and Accountability Act (HIPAA) regulates the protection of private health information for individuals. HIPAA’s “Privacy Rule” sets standards for the use and disclosure of all individually identifiable health information obtained from a covered entity. All forms of health information that are associated with any of the 18 identifiers specifically defined by HIPAA are considered to be protected health information (PHI) subject to HIPAA regulations. To access this information, all research studies must obtain either an individual’s authorization to access their information, granted by the provider of the PHI, or obtain an approval of a waiver of authorization. Effective April 14, 2003, all human subjects researchers must be in compliance with the Privacy Rule.
UC Berkeley’s covered entities are the Tang Center, the Human Resources Health Plan, Intercollegiate Athletics, the Optometry Clinic, and the Psychology Clinic. Use of data from these units must receive prior CPHS approval. For more information about UCB covered entities, contact UC Berkeley Privacy Official Steve Lustig, Assistant Vice Chancellor, University Health and Counseling Services. For more information about protocol review, check with CPHS staff.
- HIPAA Decision Tree: non-UCB PHI
- HIPAA Decision Tree: UCB PHI
- PHI: List of 18 Identifiers and Definition of PHI
- HIPAA Glossary
- What is and is not Protected Health Information (PHI) in Research Settings - position paper of the UC Systemwide HIPAA Implementation Taskforce (PDF)
- HIPAA Security Training: Berkeley Campus HIPAA Security Training Module
- HIPAA Training for Research Investigators
- UCOP Module targeted for research staff, coordinators, and administrators, as well as research investigators who need to know CPHS procedures. (PowerPoint)
- Online Tutorial Assessment on Research Aspects of HIPAA
- This tutorial was developed by the UC San Diego Human Subjects Protection Program and has been made available to the UC research community.
- It is targeted to research investigators though anyone interested may complete this module - just fill in the requested information to begin.
- You will be able to download a certificate of completion after you complete the module (CPHS does not need a copy of the certificate).
- Tutorial Assessment Program on Research Aspects of HIPAA - Word version of the UC San Diego tutorial
- UC Research Authorization for Release and Use of Personal Health Information and Personally Unidentified Study Data (for individual subjects) - PDF or Word
- UCB Waiver of Authorization - PDF or Word