HIPAA Privacy Rule: WHAT?
Planning a project (Preparatory to Research Activities)

The Privacy Rule applies to the use of protected health information (PHI) in those activities preparatory to research that are necessary to prepare a research protocol for a grant application or IRB review or for similar purposes preparatory to research. Preparatory to research activities are defined as:

  1. the development of research questions;
  2. the determination of study feasibility (in terms of the available number and eligibility of potential study participants);
  3. the development of eligibility (inclusion and exclusion) criteria; and
  4. the determination of eligibility for study participation of individual potential subjects.

The Office of Civil Rights (OCR) in the U.S. Department of Health and Human Services has issued guidance for the application of the HIPAA Privacy Rule to research activities (http://www.hhs.gov/ocr). The OCR guidance permits a researcher to identify prospective research participants for purposes of seeking their authorization to use or disclose protected health information (PHI) for a research study. (FAQ answer #317) The PHI used to identify prospective research participants could include contact information, diagnosis or condition, and other information necessary to determine study eligibility.

Although OCR considers the use and disclosure of PHI to determine study eligibility a preparatory to research activity, the actual process used to recruit subjects remains a research activity and requires IRB approval.


A researcher may use PHI for preparatory to research activities, only if, before such use, the researcher makes certain representations about the use of PHI by signing a Preparatory to Research Certification.

In addition, researchers who are database custodians may not use their own databases for preparatory to research activities unless they have made the required certification.

Instructions on where to file the certification are on the form.

Return to HIPAA Research Guide main page

Questions or comments? Contact us.
Last updated: August 26, 2003