Printer-friendly version
An institution providing health care must notify patients regarding how it will use and disclose the patients’ health information for treatment, payment, and health care operations. Patient permission is not required for the institution to carry out these activities. The privacy rule stipulates that research is not included in the definition of treatment, payment, and health care operations and patients must give their permission for the research use or disclosure of their health information, even if the researcher is the same individual who provides treatment to the patient outside of a research context.
When an authorization for the use or disclosure of protected health information is combined with another authorization, such as an Informed Consent Document for research, it is called a compound authorization. The IRB allows investigators to obtain informed consent and a HIPAA authorization using a compound authorization. However, for a few specific types of research scenarios, the HIPAA Privacy Rule requires an additional signature to be collected. The VAHCS does not allow the use of a compound authorization, all HIPAA authorizations are collected on a separate document from the informed consent.