The “preparatory to research” provisions of HIPAA permit researchers to access PHI, without patient authorization, for some limited activities to plan research, as follows:

• The development of research questions;
• The determination of study feasibility (in terms of the available number and eligibility of potential study participants);
• The development of eligibility criteria (inclusion and exclusion); and
• The determination of eligibility for study participation for specific individuals.

Researchers who are employees of the HIPAA covered institution or members of its workforce for purposes of research may also use PHI as a preparatory to research activity to contact potential participants for recruitment.

• E.g., members of the UW/UW Health Affiliated Covered Entity may use PHI from Health Link to recruit participants as a preparatory to research activity.

No PHI may leave the covered institution.

Researchers who are not employees of the HIPAA covered institution or its workforce for research purposes – even if on the medical staff for clinical care purposes – should request a partial waiver of authorization from the IRB to use PHI for recruitment. See Partial and Full Waivers of Authorization and Accounting for Disclosures in this manual for more information.

All researchers must complete the Preparatory to Research Certification as part of their annual HIPAA training.

See Conducting VA Research for special requirements on the use of preparatory to research activities at the VA.