NRPM: Standards for Privacy of Individually Identifiable Health Information. g. Obtaining the individual’s authorization for research use or disclosure of protected health information.


If a covered entity chooses to obtain individual authorization for use or disclosure of information for research, the requirements applicable to individual authorizations for release of protected health information would apply. These protections are described in § 164.508.

For research projects to which both the Common Rule and this proposed rule would apply, both sets of requirements for obtaining the authorization of the subject for research would apply. As with criteria for waiver of authorization, this proposed rule would impose requirements for obtaining authorization that are different from Common Rule requirements for obtaining consent. In particular, the regulation would require more information to be given to individuals regarding who could see their information and how it would be used. For the reasons explained above, we are proposing that both sets of requirements apply, rather than allow federally-funded research to operate with fewer privacy protections than privately-funded research.