In general, before any patient information can be used for a research purpose, the patient must sign and date a study-specific consent form that includes the HIPAA authorization elements or a separate HIPAA authorization form which recites the patient’s privacy rights. This is true whether or not the patient is seen by the researcher/physician for medical care. Patient information cannot be used for research-related purposes without a signed patient authorization. There are two limited exceptions: if the IRB has granted a Waiver of Authorization or if the IRB has granted a “Preparatory to Research Authorization.”
Important: Any study data obtained without the proper authorizations cited above may not be used for publication (i.e. journals, abstracts, etc.) or any other purpose and can be subject to notification requirements under state and/or federal laws.