HIPAA Tutorial 分析和总结分析和总结.docx

PAGE PAGE 1 HIPAA Tutorial (printable version) Instructions: If your application involves the use or disclosure of Protected Health Information by a Covered Entity or Covered Component of the University, all study personnel will be required to complete HIPAA training before project approval will be granted. What Is HIPAA? HIPAA is the acronym for the Health Insurance Portability and Accountability Act. HIPAA’s “Privacy Rule” regulates the way certain health care groups, organizations, or businesses, called covered entities under the Rule, handle the individually identifiable health information known as “protected health information” or PHI. The definition of PHI is discussed further below. Researchers should be aware of the Privacy Rule because it establishes the conditions under which covered entities (and covered components of Hybrid Entities) can use or disclose PHI for many purposes, including for research. Although not all researchers will have to comply with the Privacy Rule, the manner in which the Rule protects PHI could affect certain aspects of research. HIPAA and the Institutional Review Board (IRB) Readers should note that Institutional Review Boards have long been in the business of ensuring the confidentiality of information gathered from or about research subjects. However, HIPAA’s Privacy Rule may add a new layer of privacy protections involving use of an individual’s protected health information and may result in additional documentation by IRB’s and researchers when such information i s involved. What is Protected Health Information? The Privacy Rule defines “protected health information” or PHI as: individually identifiable health information held or maintained by a covered entity (or covered component of a Hybrid Entity) or its business associate acting for the covered entity, that is transmitted or maintained in any form or medium (including the individually identifiable health information of non-U.S. citizens). This includes identifiable dem