HIPAA Research Authorization

HIPAA RESEARCH AUTHORIZATION

Purpose of This Form

This authorization form permits the use and disclosure of your Protected Health Information ("PHI") for research purposes as required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Privacy Rule, codified at 45 C.F.R. § 164.508. This authorization is separate from, and in addition to, any informed consent form you may sign for participation in a research study. Signing this authorization is voluntary.

IMPORTANT NOTICE: Federal privacy regulations (45 C.F.R. § 164.508) require your written authorization before your Protected Health Information may be used or disclosed for research purposes. You have the right to refuse to sign this authorization, and your refusal will not affect your treatment, payment, enrollment in a health plan, or eligibility for benefits.

SECTION 1: PARTICIPANT INFORMATION

Full Legal Name: [________________________________]

Date of Birth: [__/__/____]

Address: [________________________________]

City/State/ZIP: [________________________________]

Telephone: [________________________________]

Email: [________________________________]

Medical Record Number (if applicable): [________________________________]

SECTION 2: STUDY INFORMATION

Study Title: [________________________________]

Study Protocol Number: [________________________________]

Principal Investigator ("PI"): [________________________________]

PI Contact Information: [________________________________]

Research Institution/Sponsor: [________________________________]

Institution Address: [________________________________]

IRB Name and Protocol Approval Number: [________________________________]

IRB Approval Date: [__/__/____]

Covered Entity (Provider/Facility disclosing PHI): [________________________________]

Covered Entity Address: [________________________________]

SECTION 3: DESCRIPTION OF PROTECTED HEALTH INFORMATION

Pursuant to 45 C.F.R. § 164.508(c)(1)(i), the following is a specific and meaningful description of the PHI to be used or disclosed for this research study. Check all categories of PHI authorized for use or disclosure:

3.1 Medical Records and Clinical Data

☐ Complete medical records for the date range: [__/__/____] through [__/__/____]

☐ Medical history and physical examination records

☐ Diagnosis and treatment records (including ICD and CPT codes)

☐ Laboratory test results (specify types): [________________________________]

☐ Diagnostic imaging results (X-ray, MRI, CT, ultrasound, PET)

☐ Pathology and biopsy reports

☐ Operative and procedural notes

☐ Discharge summaries

☐ Progress notes and clinical assessments

☐ Medication records and prescription history

☐ Immunization records

☐ Vital signs and nursing records

☐ Emergency department records

3.2 Sensitive Health Information Categories

Special Notice: The following categories of information receive heightened protection under federal and/or state law and require your specific authorization.

☐ Mental Health/Behavioral Health Records — Treatment records from mental health or behavioral health providers. Note: Psychotherapy notes (as defined in 45 C.F.R. § 164.501) require a separate authorization under 45 C.F.R. § 164.508(a)(2) and are NOT included in this authorization unless the separate psychotherapy notes authorization below is also executed.

☐ Psychotherapy Notes — Notes recorded by a mental health professional documenting or analyzing the contents of conversation during a private counseling session (see separate authorization in Section 11 below).

☐ Substance Use Disorder Records — Records from a federally assisted substance use disorder program protected under 42 C.F.R. Part 2. Note: As of the February 2024 Final Rule (effective February 16, 2026), a single consent for treatment, payment, and healthcare operations is permitted. Research disclosures still require specific patient consent under 42 C.F.R. Part 2.

☐ HIV/AIDS Testing and Status Information

☐ Sexually Transmitted Infection (STI) Records

☐ Genetic Testing Results and Genetic Information (subject to GINA protections)

☐ Reproductive Health Records (including pregnancy, fertility treatments, and contraception)

☐ Communicable Disease Records

3.3 Demographic and Administrative Data

☐ Demographic information (name, date of birth, address, Social Security number, contact information)

☐ Health insurance and billing records

☐ Enrollment and eligibility information

☐ Claims and payment data

3.4 Biological Specimens and Related Data

☐ Results derived from biological specimens (blood, tissue, urine, saliva, DNA)

☐ Biobank or biorepository records linked to identifiable information

☐ Genomic and proteomic data

3.5 Other

☐ Other (describe with specificity): [________________________________]

SECTION 4: PERSONS AUTHORIZED TO USE OR DISCLOSE PHI

Pursuant to 45 C.F.R. § 164.508(c)(1)(ii), the following persons or classes of persons are authorized to use or disclose your PHI:

☐ [________________________________] (Covered Entity / Healthcare Provider)

☐ [________________________________] (Research Institution)

☐ [________________________________] (Principal Investigator and named research staff)

☐ [________________________________] (Other — specify)

SECTION 5: PERSONS AUTHORIZED TO RECEIVE PHI

Pursuant to 45 C.F.R. § 164.508(c)(1)(iii), your PHI may be disclosed to the following persons or classes of persons:

☐ The Principal Investigator and research team members listed in the IRB-approved protocol

☐ Research sponsor: [________________________________]

☐ Contract research organization (CRO): [________________________________]

☐ Data safety monitoring board (DSMB) or data monitoring committee

☐ Institutional Review Board (IRB) or Ethics Committee

☐ Federal regulatory agencies, including the U.S. Department of Health and Human Services (HHS), Office for Human Research Protections (OHRP), and the Food and Drug Administration (FDA)

☐ Collaborating research institutions: [________________________________]

☐ Study auditors and monitors

☐ Authorized representatives of the research sponsor

☐ Other: [________________________________]

RE-DISCLOSURE WARNING (45 C.F.R. § 164.508(c)(2)(iii)): Once your PHI is disclosed to persons or entities outside the Covered Entity, it may no longer be protected by the HIPAA Privacy Rule and may be subject to re-disclosure by the recipient. However, the research team will use reasonable safeguards to protect the confidentiality of your information. Additionally, if the recipient is also a Covered Entity or Business Associate, re-disclosed information may retain HIPAA protections.

SECTION 6: PURPOSE OF USE AND DISCLOSURE

Pursuant to 45 C.F.R. § 164.508(c)(1)(iv), the specific purpose(s) of the requested use or disclosure are:

Primary Research Purpose: [________________________________]

Description of Research (in plain language):

[________________________________]

[________________________________]

[________________________________]

☐ The PHI will be used to create information that is not individually identifiable (de-identified) pursuant to 45 C.F.R. § 164.514(a)-(c). Once de-identified, the information is no longer subject to this authorization or to the HIPAA Privacy Rule.

☐ The PHI may be used for future research studies related to: [________________________________]. Such future studies must receive separate IRB approval.

SECTION 7: EXPIRATION DATE OR EVENT

Pursuant to 45 C.F.R. § 164.508(c)(1)(v), this authorization expires:

☐ On the following date: [__/__/____]

☐ Upon occurrence of the following event: [________________________________]

☐ At the end of the research study (permissible for research authorizations per 45 C.F.R. § 164.508(c)(1)(v))

☐ None — this authorization has no expiration date (permissible for research authorizations, including the creation and maintenance of a research database or research repository, per 45 C.F.R. § 164.508(c)(1)(v))

SECTION 8: RIGHT TO REVOKE AUTHORIZATION

8.1 Revocation Rights

Pursuant to 45 C.F.R. § 164.508(c)(2)(i), you have the right to revoke this authorization in writing at any time. To revoke, you must submit a written revocation to:

Name/Office: [________________________________]

Address: [________________________________]

Email: [________________________________]

Fax: [________________________________]

8.2 Exceptions to Revocation

Your revocation will be effective upon receipt, except to the extent that:

(a) The Covered Entity or research team has already taken action in reliance on this authorization prior to receiving your written revocation (45 C.F.R. § 164.508(b)(5)(i)); or

(b) The authorization was obtained as a condition of obtaining insurance coverage, and the insurer has a legal right to contest a claim or the policy itself (45 C.F.R. § 164.508(b)(5)(ii)).

8.3 Effect of Revocation on Research Data

If you revoke this authorization:

• The research team will stop collecting new PHI about you as soon as practicable.
• PHI already collected prior to revocation may continue to be used and disclosed to the extent necessary to:
• Maintain the integrity of the research study
• Account for your withdrawal from the study
• Meet regulatory reporting requirements (e.g., FDA adverse event reporting under 21 C.F.R. Part 312)
• Comply with legally mandated activities
• De-identified information created from your PHI prior to revocation may continue to be used without restriction.

SECTION 9: CONDITIONING STATEMENT

9.1 Treatment Conditioning

Pursuant to 45 C.F.R. § 164.508(b)(4), a Covered Entity may not condition treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of this authorization, except:

☐ Research-Related Treatment Exception: If the research study involves treatment of the participant, the Covered Entity may condition the provision of research-related treatment on the participant's authorization to use or disclose PHI created for such research (45 C.F.R. § 164.508(b)(4)(i)).

☐ This authorization is not a condition of treatment, payment, enrollment, or eligibility for benefits.

9.2 Consequences of Refusing to Sign

If you choose not to sign this authorization:

• Your decision will not affect your current or future medical care or treatment (unless research-related treatment exception applies as noted above)
• You will not be able to participate in the research study described in Section 2
• Your health insurance coverage and benefits will not be affected

SECTION 10: COMPOUND AUTHORIZATION PROHIBITION AND EXCEPTIONS

Pursuant to 45 C.F.R. § 164.508(b)(3), this authorization:

☐ Is a standalone research authorization (not combined with any other document)

☐ Is combined with an informed consent document for the same research study, which is permissible under 45 C.F.R. § 164.508(b)(3)(i) (research exception to compound authorization prohibition). The informed consent provisions under the Common Rule (45 C.F.R. Part 46) or FDA regulations (21 C.F.R. Part 50) are incorporated into or accompany this document.

Note on Compound Authorizations: An authorization for the use or disclosure of PHI may not be combined with any other document to create a compound authorization, except: (i) an authorization for the use or disclosure of PHI for a research study may be combined with any other type of written permission for the same research study, including another authorization or informed consent; (ii) an authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes; and (iii) an authorization may be combined with other types of authorizations under the Privacy Rule, except for psychotherapy notes (45 C.F.R. § 164.508(b)(3)).

SECTION 11: SEPARATE AUTHORIZATION FOR PSYCHOTHERAPY NOTES

Complete this section only if psychotherapy notes (as defined in 45 C.F.R. § 164.501) are included in this research.

Psychotherapy notes are defined as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session that are separated from the rest of the individual's medical record. This separate authorization is required under 45 C.F.R. § 164.508(a)(2).

☐ I authorize the use and disclosure of my psychotherapy notes for the research study described in Section 2 of this authorization.

☐ I do NOT authorize the use or disclosure of psychotherapy notes.

Participant Signature (for psychotherapy notes): ______________________________

Date: [__/__/____]

SECTION 12: BIOBANK AND FUTURE UNSPECIFIED RESEARCH

Complete this section if the research involves creation or maintenance of a biobank, research repository, or database for future research.

☐ I authorize the storage of my PHI and/or biological specimens in a research biobank or repository maintained by: [________________________________]

☐ I understand that my PHI and/or specimens may be used for future research studies that have not yet been designed or approved at this time. Each future study must receive IRB or Ethics Committee approval before my information is used.

☐ I authorize use of my stored PHI and specimens for future research without additional authorization from me, provided:

• The future research receives IRB or Ethics Committee approval
• My PHI remains protected by appropriate safeguards
• This authorization does not have an expiration date

☐ I require that I be re-contacted and provide a new authorization before my PHI or specimens are used for any future research study.

☐ I authorize the creation of de-identified data or a limited data set from my PHI for future research, with de-identification performed in accordance with 45 C.F.R. § 164.514(a)-(c) (Safe Harbor or Expert Determination method).

SECTION 13: GENETIC INFORMATION PROVISIONS

Complete this section if the research involves genetic testing, genomic analysis, or the collection of genetic information.

13.1 GINA Protections

The Genetic Information Nondiscrimination Act of 2008 ("GINA") prohibits health insurers and employers from discriminating against individuals on the basis of genetic information. Your genetic information obtained through this research:

☐ Will be used solely for the research purposes described in this authorization

☐ Will not be shared with your health insurer or employer without a separate, specific authorization

☐ Will be stored in a manner that limits the potential for unauthorized access or re-identification

13.2 State Genetic Privacy Protections

In addition to GINA, the following state-specific genetic privacy protections apply:

• California: Cal. Civ. Code § 56.17 — Genetic test results are subject to CMIA confidentiality protections. Written informed consent specifically addressing genetic testing is required.
• Texas: Tex. Ins. Code § 546.002 — Prohibits use of genetic information by insurers for underwriting decisions. Tex. Lab. Code § 21.402 — Prohibits employer discrimination based on genetic information.
• Florida: Fla. Stat. § 760.40 — DNA analysis may be performed only with informed consent of the person to be tested and results are confidential.
• New York: N.Y. Civ. Rights Law § 79-l — Genetic testing requires written informed consent; results may not be disclosed without authorization.

SECTION 14: MINOR/CHILD RESEARCH PARTICIPANT PROVISIONS

Complete this section if the research participant is a minor (under 18) or lacks capacity.

14.1 Parental/Guardian Permission

Under the Common Rule (45 C.F.R. § 46.408) and applicable state law, the following parental/guardian permission is provided:

Minor Participant's Full Legal Name: [________________________________]

Date of Birth: [__/__/____]

Age at Enrollment: [____]

Parent/Guardian Name: [________________________________]

Relationship to Minor: [________________________________]

☐ One parent/guardian signature is sufficient (research involves no more than minimal risk, or involves greater than minimal risk with prospect of direct benefit — 45 C.F.R. § 46.408(b))

☐ Both parents/guardians must sign (research involves greater than minimal risk with no prospect of direct benefit — 45 C.F.R. § 46.408(b))

14.2 Minor's Assent

Under 45 C.F.R. § 46.408(a), the IRB has determined that the following assent provisions apply:

☐ The minor is capable of providing assent and has done so (assent form attached or incorporated)

☐ The IRB has waived the requirement for assent because:
☐ The minor is too young or lacks capacity to provide meaningful assent
☐ The research holds the prospect of direct benefit not available outside the research context (45 C.F.R. § 46.408(a))

14.3 Emancipated and Mature Minors

☐ The minor participant is an emancipated minor under applicable state law and may authorize their own PHI disclosure.

☐ The minor participant is a "mature minor" under applicable state law and may consent to the research and authorize PHI disclosure for certain categories of care.

State-Specific Minor Consent Notes:
- California: Minors age 12+ may consent to mental health treatment (Cal. Fam. Code § 6924) and certain reproductive health services (Cal. Fam. Code § 6925). Minors age 15+ may consent to medical care if living separately from parents (Cal. Fam. Code § 6922).
- Texas: Minors age 16+ may consent to their own treatment in certain circumstances (Tex. Fam. Code § 32.003). Consent of a minor to treatment for STDs, pregnancy, and substance abuse does not require parental consent (Tex. Fam. Code § 32.003(a)).
- Florida: Minors may consent to STD treatment (Fla. Stat. § 384.30) and substance abuse treatment (Fla. Stat. § 397.601).
- New York: Minors may consent to STD treatment (N.Y. Pub. Health Law § 2305), mental health treatment in certain circumstances, and reproductive health services.

SECTION 15: IRB/PRIVACY BOARD WAIVER PROVISIONS

This section is for institutional use. It documents the basis for any IRB or Privacy Board waiver or alteration of authorization under 45 C.F.R. § 164.512(i).

15.1 Waiver of Individual Authorization (45 C.F.R. § 164.512(i)(1)(i))

A Covered Entity may use or disclose PHI for research without individual authorization if the Covered Entity obtains documentation that an IRB or Privacy Board has approved a waiver or alteration of authorization meeting all of the following criteria (45 C.F.R. § 164.512(i)(2)(ii)):

☐ (A) The use or disclosure of PHI involves no more than a minimal risk to the privacy of individuals, based on at least the following elements:

• ☐ (1) An adequate plan to protect PHI identifiers from improper use and disclosure
• ☐ (2) An adequate plan to destroy identifiers at the earliest opportunity consistent with the research, absent a health or research justification for retaining them or a legal requirement to do so
• ☐ (3) Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research permitted by the Privacy Rule

☐ (B) The research could not practicably be conducted without the waiver or alteration

☐ (C) The research could not practicably be conducted without access to and use of the PHI

15.2 Limited Data Set Alternative (45 C.F.R. § 164.514(e))

As an alternative to a full authorization or waiver, a Covered Entity may disclose a Limited Data Set for research purposes under a Data Use Agreement that:

☐ Establishes the permitted uses and disclosures of the limited data set

☐ Establishes who is permitted to use or receive the limited data set

☐ Provides that the recipient will not use or further disclose the information other than as permitted by the agreement or as otherwise required by law

☐ Requires the recipient to use appropriate safeguards to prevent unauthorized use or disclosure

☐ Requires the recipient to report to the Covered Entity any use or disclosure in violation of the agreement

☐ Requires the recipient to ensure that any agents agree to the same restrictions

☐ Prohibits the recipient from identifying or contacting the individuals

15.3 De-Identification Standards

PHI that has been de-identified in accordance with 45 C.F.R. § 164.514(a)-(c) is not subject to the HIPAA Privacy Rule. Two methods are available:

(a) Safe Harbor Method (§ 164.514(b)): Removal of 18 specified identifiers and the Covered Entity has no actual knowledge that the remaining information could be used alone or in combination to identify the individual.

(b) Expert Determination Method (§ 164.514(b)(1)): A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable applies such principles and methods and determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, to identify an individual.

SECTION 16: FDA-REGULATED RESEARCH PROVISIONS

Complete this section if the research involves an investigational drug, device, or biologic regulated by the FDA.

☐ This research involves an Investigational New Drug (IND) application (21 C.F.R. Part 312)

☐ This research involves an Investigational Device Exemption (IDE) (21 C.F.R. Part 812)

☐ This research involves a biologics license application (21 C.F.R. Part 600)

IND/IDE/BLA Number: [________________________________]

Under FDA regulations, the following additional provisions apply:

• The FDA may inspect and copy records that identify research participants (21 C.F.R. § 312.68; 21 C.F.R. § 812.145)
• Informed consent requirements under 21 C.F.R. Part 50 apply in addition to the Common Rule
• IRB oversight under 21 C.F.R. Part 56 is required
• Adverse event reporting may require disclosure of PHI to the FDA, the study sponsor, and other regulatory authorities (21 C.F.R. § 312.32)

SECTION 17: STATE-SPECIFIC REQUIREMENTS

17.1 California

• Protection of Human Subjects in Medical Experimentation Act (Cal. Health & Safety Code §§ 24170–24179.5): Requires informed consent for any medical experiment, separate from HIPAA authorization. The consent must include a description of the procedures, reasonably foreseeable risks and discomforts, expected benefits, alternative treatments, offer to answer questions, and a statement that participation is voluntary.
• CMIA (Cal. Civ. Code §§ 56–56.37): Authorization for release of medical information must be handwritten by the patient or printed in no less than 14-point type, clearly separate from other language. Must identify specific recipients and uses. (Cal. Civ. Code § 56.11)
• Lanterman-Petris-Short Act (Cal. Welf. & Inst. Code § 5328): Additional protections for mental health treatment records.
• Cal. Health & Safety Code § 121025 — Special protections for HIV test results.

17.2 Texas

• Texas Medical Privacy Act (Tex. Health & Safety Code Ch. 181, as amended by HB 300): Requires covered entities to provide a training program on state and federal health privacy laws. Authorization must comply with both HIPAA and Chapter 181 requirements.
• Mental Health Records (Tex. Health & Safety Code Ch. 611): Confidential communications between a patient and mental health professional require specific consent for disclosure. Access must be made available within 15 days of written request.
• HIV Records (Tex. Health & Safety Code § 81.103): Specific authorization required for disclosure of HIV test results. The authorization must be separate from any general release.
• Physician-Patient Privilege (Tex. Occ. Code § 159.002): Additional confidentiality protections for physician communications.

17.3 Florida

• Patient Records (Fla. Stat. § 456.057): Requires furnishing copies of records upon request without delays for legal review. Records must be furnished within a reasonable time.
• Hospital Patient Rights (Fla. Stat. § 395.3025): Patients have the right to access their medical records and must be informed of their rights upon admission.
• HIV Records (Fla. Stat. § 381.004): Results of HIV testing are confidential and may not be disclosed without specific written consent.
• Genetic Testing (Fla. Stat. § 760.40): DNA analysis may only be performed with informed consent; results are the exclusive property of the person tested.
• Information Security (Fla. Stat. § 501.171): Requires notification of security breaches affecting personal information including medical information.

17.4 New York

• Protection of Human Subjects (N.Y. Pub. Health Law § 2442): Research involving human subjects must comply with state requirements in addition to federal regulations.
• Medical Records Access (N.Y. Pub. Health Law § 18): Patients have the right to access their medical records. Reasonable fees may be charged.
• Mental Health Records (N.Y. Mental Hygiene Law § 33.13): Clinical records maintained at a mental health facility are confidential and may not be released without the consent of the patient or a court order.
• HIV Records (N.Y. Pub. Health Law § 2782): Confidential HIV-related information may not be disclosed without a specific written release, and the release must be limited to the information necessary for the purpose of disclosure.
• NY SHIELD Act (N.Y. Gen. Bus. Law § 899-aa): Expanded data security requirements apply to entities holding private information, including medical information, of New York residents.

SECTION 18: PARTICIPANT ACKNOWLEDGMENTS

By signing below, I acknowledge and confirm the following:

☐ I have read this authorization form (or it has been read to me) and I understand its contents.

☐ I understand that my PHI will be used or disclosed for the research study described in Section 2.

☐ I understand that I may refuse to sign this authorization and that my refusal will not affect my treatment, payment, enrollment, or eligibility for benefits (except as noted in Section 9).

☐ I understand that I may revoke this authorization at any time by submitting a written revocation to the contact listed in Section 8.

☐ I understand that once my PHI is disclosed to persons or entities outside the Covered Entity, it may be subject to re-disclosure and may no longer be protected by HIPAA.

☐ I have been given a copy of this signed authorization form.

☐ I have had the opportunity to ask questions and my questions have been answered to my satisfaction.

☐ I was not coerced or unduly influenced to sign this authorization.

SECTION 19: SIGNATURES

19.1 Research Participant (or Personal Representative)

Printed Name of Participant: [________________________________]

Signature: ______________________________

Date: [__/__/____]

Time: [____]

19.2 Personal Representative (if applicable)

If this authorization is signed by a personal representative of the individual, the following must be completed pursuant to 45 C.F.R. § 164.508(c)(1)(vi):

Printed Name of Personal Representative: [________________________________]

Signature: ______________________________

Date: [__/__/____]

Description of Representative's Authority to Act for the Individual:

☐ Parent of minor participant

☐ Legal guardian (attach documentation of guardianship)

☐ Healthcare power of attorney (attach copy)

☐ Executor/administrator of estate (for deceased individual)

☐ Other legal authority: [________________________________]

19.3 Witness

Printed Name of Witness: [________________________________]

Signature: ______________________________

Date: [__/__/____]

19.4 Principal Investigator or Designee

I confirm that the participant (or their personal representative) was provided an adequate explanation of this authorization, had the opportunity to ask questions, and signed this form voluntarily.

Printed Name of PI/Designee: [________________________________]

Title: [________________________________]

Signature: ______________________________

Date: [__/__/____]

19.5 Interpreter (if applicable)

I have interpreted the contents of this authorization form for the participant in:

Language: [________________________________]

Interpreter Name: [________________________________]

Interpreter ID/Credentials: [________________________________]

Signature: ______________________________

Date: [__/__/____]

SECTION 20: INSTITUTIONAL USE — DOCUMENTATION CHECKLIST

For covered entity and research institution records management.

☐ Signed copy of this authorization provided to participant (45 C.F.R. § 164.508(c)(4))

☐ Signed original retained by covered entity for minimum 6 years (45 C.F.R. § 164.530(j))

☐ Copy provided to research team

☐ IRB approval documentation on file

☐ Data Use Agreement on file (if Limited Data Set — 45 C.F.R. § 164.514(e))

☐ Common Rule informed consent obtained separately (45 C.F.R. Part 46) or combined with this authorization

☐ State-specific authorization requirements verified and met

☐ GINA compliance verified (if genetic information is involved)

☐ 42 C.F.R. Part 2 consent obtained separately (if substance use disorder records are involved)

Sources and References

• 45 C.F.R. § 164.508 — Uses and Disclosures for Which an Authorization Is Required: https://www.law.cornell.edu/cfr/text/45/164.508
• 45 C.F.R. § 164.512(i) — Uses and Disclosures for Research: https://www.law.cornell.edu/cfr/text/45/164.512
• 45 C.F.R. § 164.514 — De-identification and Limited Data Sets: https://www.law.cornell.edu/cfr/text/45/164.514
• 45 C.F.R. Part 46 — Protection of Human Subjects (Common Rule): https://www.law.cornell.edu/cfr/text/45/part-46
• HHS Research Guidance: https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
• 42 C.F.R. Part 2 Final Rule (2024): https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
• 21 C.F.R. Part 50 — Protection of Human Subjects (FDA): https://www.law.cornell.edu/cfr/text/21/part-50
• 21 C.F.R. Part 56 — Institutional Review Boards (FDA): https://www.law.cornell.edu/cfr/text/21/part-56
• GINA (42 U.S.C. § 2000ff): https://www.law.cornell.edu/uscode/text/42/chapter-21F
• Cal. Civ. Code §§ 56–56.37 (CMIA): https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=1.&title=&part=2.6.&chapter=1.&article=
• Cal. Health & Safety Code §§ 24170–24179.5: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=24170&lawCode=HSC
• Tex. Health & Safety Code Ch. 181 (Medical Privacy Act): https://statutes.capitol.texas.gov/Docs/HS/htm/HS.181.htm
• Tex. Health & Safety Code Ch. 611 (Mental Health Records): https://statutes.capitol.texas.gov/Docs/HS/htm/HS.611.htm
• Fla. Stat. § 456.057 (Ownership and Control of Patient Records): https://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.057.html
• Fla. Stat. § 760.40 (Genetic Testing): https://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&URL=0700-0799/0760/Sections/0760.40.html
• N.Y. Pub. Health Law § 18 (Access to Patient Information): https://www.nysenate.gov/legislation/laws/PBH/18
• N.Y. Pub. Health Law § 2782 (HIV Confidentiality): https://www.nysenate.gov/legislation/laws/PBH/2782
• N.Y. Mental Hygiene Law § 33.13: https://www.nysenate.gov/legislation/laws/MHY/33.13