If you're unsure about the particulars of HIPAA research requirements at your organization, whom could you consult?

If you're unsure about the particulars of HIPAA research requirements at your organization, whom could you consult?

• A. An organizational IRB or Privacy Board, privacy official ('Privacy Officer'), or security official ('Security Officer'), depending on the issue.
• B. A compliance manual from the vendor.
• C. The patient.
• D. A local lawyer.

Answer: (A)

When you’re unsure about HIPAA research requirements at your organization, the people who set and enforce privacy and security rules should be your go-to. The best path is to consult the organizational IRB or Privacy Board, the Privacy Officer, or the Security Officer, depending on the issue. They have the authority and expertise to interpret privacy protections for research, determine when patient authorization or waivers are needed, review data handling and access plans, and ensure alignment with both HIPAA and institutional policies. A vendor’s compliance manual may be generic or outdated and not reflect your organization’s current procedures. The patient is the data subject, not a resource for determining internal protocols. A local lawyer could advise on legal risks, but they won’t substitute for the organization’s own policies and procedures for protecting PHI in research.

When you’re unsure about HIPAA research requirements at your organization, the people who set and enforce privacy and security rules should be your go-to. The best path is to consult the organizational IRB or Privacy Board, the Privacy Officer, or the Security Officer, depending on the issue. They have the authority and expertise to interpret privacy protections for research, determine when patient authorization or waivers are needed, review data handling and access plans, and ensure alignment with both HIPAA and institutional policies. A vendor’s compliance manual may be generic or outdated and not reflect your organization’s current procedures. The patient is the data subject, not a resource for determining internal protocols. A local lawyer could advise on legal risks, but they won’t substitute for the organization’s own policies and procedures for protecting PHI in research.