VA investigators may use individually-identifiable health information to prepare a research protocol prior to submission of the protocol to the IRB for approval without obtaining a HIPAA authorization or waiver of authorization.

• VA investigators must not arbitrarily review PHI based on their employee access to PHI until the investigator documents the following required information as “Preparatory to Research” in a designated file that is readily accessible for those required to audit such information (e.g., Health Information Manager or PO):
  • Access to PHI is only to prepare a protocol;
  • No PHI will be removed from the covered entity (i.e., VHA); and
  • Access to PHI is necessary for preparation of the research protocol.
• Non-VA researchers may not obtain VA information for preparatory to research activities without appropriate VA approvals (see VHA Directive 1605.01).
• During the preparatory to research activities the VA investigator:
  • Must only record aggregate data. The aggregate data may only be used for background information to justify the research or to show that there are adequate numbers of potential subjects to allow the investigator to meet enrollment requirements for the research study;
  • Must not record any individually identifiable health information; and
  • Must not use any individually identifiable information to recruit research subjects.
  • Preparatory activities can include reviewing database output (computer file or printout) containing identifiable health information generated by the database owner, if the investigator returns the database output to the database owner when finished aggregating the information.
• Contacting potential research subjects and conducting pilot or feasibility studies are not considered activities preparatory to research.
• Activities preparatory to research only encompass the time to prepare the protocol and ends when the protocol is submitted to the IRB.