HIPAA and research: authorizations, waivers, and the §164.508 path

In a clinic conference room, a research coordinator slides two documents across the table. The first is the informed-consent form: the study explained — what will happen, what might go wrong, what is hoped for. The second is denser, more bureaucratic, and easy to mistake for a formality. It is the HIPAA authorization. The first document asks, may we study you? The second asks something different: may your records leave the building?

US law separates those questions on purpose. The Privacy Rule never forbids research. It defines a short list of lawful routes a record may travel, and demands that every research disclosure take one of them. Three routes carry nearly all the traffic: ask the patient, ask a board, or remove the patient from the data.

Route one: ask the patient — §164.508

The most direct path is a written authorization meeting the requirements of §164.508: the patient personally permits a specific use of specific information.

A valid authorization is not a vibe of agreement; it has an anatomy. It must describe the information to be used or disclosed in a specific and meaningful way; name who may disclose it and who may receive it; state the purpose; carry an expiration date or event — research is the notable case where "end of the research study" or even no expiration is permitted, so long as that is said plainly; and bear the patient's signature and date. It must also tell the patient, in writing, that the authorization can be revoked, whether treatment is conditioned on signing — a trial may lawfully condition research-related treatment on it — and that information, once disclosed, may be redisclosed beyond HIPAA's reach. HHS maintains a research-specific guidance page that walks through the details.

Two features make this route distinctive. It is study-specific: the purpose must be described, which is why one signature cannot quietly cover futures nobody has imagined yet. And it is revocable in writing: revocation stops future uses and disclosures, though it cannot reach back to actions already taken in reliance on it. Note what the authorization is not — it is not informed consent. Consent to participate is governed by the Common Rule and reviewed by an ethics board; the two documents answer different questions, and a study often needs both. We unpack the board's half in what an IRB actually does.

Route two: ask a board — waivers under §164.512(i)

When asking each patient is genuinely impracticable, an IRB or Privacy Board may waive the authorization requirement — and the criteria are stricter than their reputation suggests.

The board must find three things. First, that the use involves no more than minimal risk to privacy, backed by an adequate plan to protect identifiers, a plan to destroy them at the earliest opportunity consistent with the research, and written assurances that the PHI will not be improperly reused or disclosed. Second, that the research could not practicably be conducted without the waiver. Third, that it could not practicably be conducted without the PHI at all. The word practicably does real work: inconvenient is not impracticable. The textbook case is the one the rule was written for — half a million records spanning twenty years, most of those patients unreachable or deceased. Partial waivers exist too, most commonly to screen records for recruitment, after which the patients identified are asked properly. The Office for Human Research Protections oversees the neighboring Common Rule machinery that usually reviews the same study.

Route three: remove the person — §164.514

Data de-identified under §164.514 is no longer protected health information at all, and HIPAA stops applying to it.

There are two recognized methods. Safe Harbor strips eighteen enumerated classes of identifiers — names, geographic units smaller than a state (with a narrow three-digit-ZIP allowance), dates more precise than a year, and so on. Expert Determination instead has a qualified statistician certify that the re-identification risk is very small, documenting the methods. The trade-offs between them are the subject of Safe Harbor vs. Expert Determination, and the HHS de-identification guidance is the canonical reference. The honest caveat belongs in the same breath: de-identified is a legal status, not a property of nature. Combinations of ordinary fields can still point at individuals, which is the entire subject of re-identification attacks. Between full identification and de-identification sits the limited data set — dates and some geography retained, direct identifiers removed — released only under a signed data-use agreement.

Three routes, one table

What the authorization route gets right

Only one of the three routes treats the patient as a party to the research rather than a substrate for it — and that difference is worth building around.

A §164.508 authorization has the shape of a real agreement: a described scope, named recipients, a purpose, an end, a signature, and an exit. The other routes exist because asking does not always scale — half a million archived charts cannot be re-consented, and the waiver pathway honestly acknowledges it. But for prospective research, treating per-study authorization as friction to engineer around gets the problem backwards. The interesting problem is making asking scale.

That is the problem Mithras Health is built on. Every study a patient joins carries its own scope-limited authorization, granted as one decision over two documents — a plain-language summary and the formal authorization — and revocable at any time, with revocation enforced by the platform rather than by promise; the pattern is unpacked in two documents, one decision. Participation fees post only on IRB-approved research-use events, and every grant, use, and revocation lands on an append-only audit trail retained for six years — the same documentation horizon HIPAA itself expects of covered entities.

HIPAA's research provisions are old enough to show their fax-era origins. But the anatomy of §164.508 — a description, a recipient, a purpose, an end date, a signature — is not bureaucracy. It is the minimum vocabulary of being asked. The routes that bypass the patient were built for a world where asking was the expensive part. That world is ending.