HRPP Manual 7-6-C

Review Preparatory to Research

The Health Insurance Portability and Accountability Act, as amended, (HIPAA) provides requirements of when protected health information (PHI) may be disclosed for reviews preparatory to research. Preparatory to research activities may include preparing a research protocol, assisting in development of a research hypothesis, or aiding in study subject recruitment.

A covered entity may use or disclose protected health information for reviews preparatory to research, regardless of the source of funding, if the covered entity obtains from the researcher representations that:

  1. Use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;
  2. No PHI is to be removed from the covered entity by the researcher in the course of the review; and
  3. The PHI for which use or access is sought is necessary for the research purposes.

In some instances, reviews preparatory to research may require Michigan State University Institutional Review Board (IRB) review if the activity meets the definition of “research” and/or a “clinical investigation” and involves “human subjects.” See HRPP Manual Section 4-3, Determination of Human Subject.

For example, if a researcher obtains and records identifiable private information to contact prospective subjects as part of a research study, MSU IRB review would be required and informed consent would need to obtained, altered, or waived.

Contacting Prospective Subjects

Under the HIPAA requirements, no protected health information can be removed from the covered entity. Therefore, a determination of whether the researcher is a member of the covered entity’s workforce must be made to determine whether a prospective subject can be contacted through the preparatory to research provision.  The covered entity and the individual accessing the protected health information are responsible for complying with the requirements under HIPAA for reviews preparatory to research. The MSU Heath Team is the responsible entity at MSU for preparatory to research provisions that involve MSU HealthTeam as a component of the MSU covered entity. 

  • A researcher who is not part of the covered entity may not contact a potential research subject. However, the researcher could access the contact information through a partial waiver of authorization.
  • A researcher who is part of the covered entity may contact a potential research subject under the preparatory to research provision.
  • A business associate who has contracted with the covered entity may contact a prospective subject.

The potential subject may be contacted by the researcher to discuss the research if he or she is a member of the covered entity or if the covered entity has contracted with the researcher as a business associate to seek authorization or if an alteration or waiver of authorization has been granted for recruitment purposes.

However, the researcher is responsible for complying with HRPP ManualSection 4-3, and contacting the MSU IRB if there is any question about whether the activity involves research and requires MSU IRB review. The researcher must contact the appropriate covered entity with any questions regarding the requirements under HIPAA for reviews preparatory to research.

This policy and procedure supersedes those previously drafted.

Approved By: Vice President of Research and Graduate Studies on 2-25-2015.

Related HRPP Manual Sections