For the past 5 years, the regulatory environment for research involving humans has been turbulent, with criticism coming from the federal government, the academic community, and the press. The purpose of this series of articles is to explain the ethical and legal bases for responsible conduct of radiology research and the rules that an investigator must follow. The purpose of this fifth part of the series is to explain the requirements of the Privacy Rule, which is a component of the Health Insurance Portability and Accountability Act (HIPAA), as they relate to human research. Under the HIPAA Privacy Rule, researchers within covered entities must follow appropriate methods as they use or disclose protected health information (PHI). Investigators should know the conditions under which PHI may be accessed for research purposes (ie, with authorization or waiver of authorization, when only a limited data set is evaluated, if data have been de-identified, or in reviews preparatory to research). Furthermore, researchers should know which information, such as the Notice of Privacy Practices and the Accounting of Disclosures, must be provided to potential subjects, when appropriate. At the conclusion of this article, several scenarios related to various types of radiology research and related regulatory requirements are presented.
RSNA, 2005