Letting Your Personal Health Information

Be Used and Shared for Research

U.S. DEPARTMENT OF
HEALTH & HUMAN SERVICES

REGIONS
SEATTLE I
X
BOSTON

V II The Privacy Rule Authorization Form and People who work for "covered entities" also may
VIII PHILADELPHIA
NEW YORK
Clinical Research: What You Should Know have to follow the Privacy Rule. This usually means
IX VII
CHICAGO
Medical research helps us learn new information that research teams (such as scientists, nurses, and
III
DC
SAN FRANCISCO
DENVER
about health, illness, and disease and how we can other hospital staff) that work for "covered entities"
KANSAS CITY

improve health for everyone. You have been asked can use and share your personal health information
for this study only after getting your okay. This also
IV to join a clinical research study. If you agree to be in
usually means that your doctor can't share your
this study after learning about it, the research team
ATLANTA

VI DALLAS
will ask you to sign certain important forms. One of personal health information with the research team
these may be an authorization form. This form may for this study unless you
Examples of
ask you to let your doctors or other health care give your okay. You give Covered Entities
providers give your personal health information to your okay by signing the
• Many hospitals
Region I - CT, ME, MA, NH, RI, VT Region VI - AR, LA, NM, OK, TX the research team. The authorization form could authorization form.
• Many doctors or nurses
Office for Civil Rights Office for Civil Rights
U.S. Department of Health and Human Services U.S. Department of Health and Human Services also ask you to let the research team use or share • Some researchers
your personal health information with others for the The research team may • Health insurers
JFK Federal Building - Room 1875 1301 Young Street - Suite 1169
Boston, MA 02203 Dallas, TX 75202 research study. The research team might need to need information in your • Medicare and Medicaid
(617) 565-1340 (214) 767-4056 medical records for the plans
(617) 565-1343 (TDD) (214) 767-8940 (TDD)
use and share different types of personal health
information, such as: research study. For
(617) 565-3809 FAX (214) 767-0432 FAX
example, they may need to know your medical
Region II - NJ, NY, PR, VI Region VII - IA, KS, MO, NE • Your name and address • Your ethnic origin diagnosis or know about allergies you may have. The
Office for Civil Rights Office for Civil Rights • Your health background • Your lab test results research team may also need to collect health
U.S. Department of Health and Human Services U.S. Department of Health and Human Services • Your health care and X-rays information about you from other health care
26 Federal Plaza - Suite 3313 601 East 12th Street - Room 248
New York, NY 10278 Kansas City, MO 64106 provider's name • Notes taken by a providers because the information may be
(212) 264-3313 (816) 426-7278 • Your birthday doctor or nurse important to the study. For example, the research
(212) 264-2355 (TDD) (816) 426-7065 (TDD) • Your Social Security • Your medical team may need to get your lab test results from your
(212) 264-3039 FAX (816) 426-3686 FAX number diagnosis doctor.
Region III - DE, DC, MD, PA, VA, WV Region VIII - CO, MT, ND, SD, UT, WY • Your medical records
Office for Civil Rights Office for Civil Rights What information will be in the authorization
U.S. Department of Health and Human Services U.S. Department of Health and Human Services Why am I being asked to sign an authorization form?
150 S. Independence Mall West - Suite 372 1961 Stout Street - Room 1426 form?
Philadelphia, PA 19106-3499 Denver, CO 80294 The authorization form will tell you:
(215) 861-4441 (303) 844-2024 Many people have concerns
(215) 861-4440 (TDD) (303) 844-3439 (TDD) • Who will use, share, and receive your personal
(215) 861-4431 FAX (303) 844-2025 FAX about who can see and use
health information. This could be your doctor,
information about them,
Region IV - AL, FL, GA, KY, MS, NC, SC, TN Region IX - AZ, CA, HI, NV, AS, GU, The other doctors and nurses taking care of you, or the
particularly information
Office for Civil Rights U.S. Affiliated Pacific Island Jurisdictions researchers and other members of the research
U.S. Department of Health and Human Services
about their health. The U.S.
Office for Civil Rights team. This could also be other institutions or
61 Forsyth Street, SW - Suite 3B70 U.S. Department of Health and Human Services Government created a rule,
Atlanta, GA 30323 companies that pay for the research.
50 United Nations Plaza - Room 322 called the Privacy Rule,
(404) 562-7886 San Francisco, CA 94102 under the Health Insurance • What personal health information is needed for
(404) 331-2867 (TDD) (415) 437-8310
(404) 562-7881 FAX (415) 437-8311 (TDD) Portability and Accountability Act (HIPAA) to help the research study. This may include some or all
(415) 437-8329 FAX protect your personal health information from being of your medical records, information about the
Region V - IL, IN, MI, MN, OH, WI used or shared when it shouldn't be. medicines you take, the results of blood tests or
Office for Civil Rights Region X - AK, ID, OR, WA X-rays, and other health information.
U.S. Department of Health and Human Services Office for Civil Rights
233 N. Michigan Avenue - Suite 240 U.S. Department of Health and Human Services Since 2003, most hospitals, doctors, and health • Why your personal health information will be
Chicago, IL 60601 2201 Sixth Avenue - Mail Stop RX-11 plans that have your personal health information
(312) 886-2359 Seattle, WA 98121 used or shared. This part will describe the
(312) 353-5693 (TDD) (206) 615-2290
must follow the Privacy Rule. These hospitals, research study. It also may tell you the title of the
(312) 886-1807 FAX (206) 615-2296 (TDD) doctors, and health plans are called "covered research study.
(206) 615-2297 FAX entities."
• Your Right to change your mind and cancel your regular treatment you receive from your regular limited cases. For example, they may need to use or "covered entity" (such as the doctor or hospital you
authorization at any time. doctors, nurses, or other professionals normally share this information to make sure the research visit for the research study). You may also complain
• Information on what happens if you do not sign involved in your health care. study is still reliable, to report when you cancelled to the Office for Civil Rights (OCR). Your complaint
the authorization form, how to cancel your your authorization, or to report any unexpected must be in writing. To complain to OCR:
authorization, and how long your information will I want to let the research team have my health problems that started before you cancelled
personal health information so I can join the • Send the complaint electronically by email to
be used or shared. your authorization.
study. How do I give my authorization? OCRComplaint@hhs.gov, or as a letter or fax to
Will I still be able to stay in the study if I cancel the OCR regional office where the possible
Will everyone who sees my personal health To give your authorization, you need to sign and violation happened. These regional offices are on
information have to protect it under the date the authorization form. Signing the form means my authorization?
the map and chart shown on the back cover, or you
Privacy Rule? that you give your okay for the research team to use It's up to the research team to decide if you may stay can find them on the OCR website at
Not always. There may be times or share your personal health in the research study if you cancel your http://www.hhs.gov/ocr/privacyhowtofile.htm.
when your personal health information for the research study. authorization. Many times a research study can only
Authorization form checklist: • Print and fill out the form found on the above
information is shared with Signing the authorization form be helpful if all of the people stay in the study and all
may also mean that you will give of their information can be used and studied for the website or send the same information to the OCR
someone who doesn't have to follow • I have read the authorization form
completely, either on my own or with your doctor or hospital your okay entire time of the study. regional office. Name the person or organization
the Privacy Rule. Examples of you are complaining about, and describe how you
someone from the research team. to share your health information
people and organizations that may think they didn't follow the Privacy Rule.
not have to follow the Privacy Rule • I understand what the authorization with the research team. Can my doctor use my authorization for the
are:
form is saying. research study as my okay to share my • Send in your complaint within 180 days of when
• I understand who may be using my The authorization form might be information for marketing? you learned about the possible violation.
• Sponsors of the research study personal health information as part of given to you as a separate form, or No. The Privacy Rule does not allow a doctor or • Make sure that any possible violation happened on
• Makers of drugs for the study the research study. it may be included with the another "covered entity" to use your authorization to or after April 14, 2003, which is when the Privacy
• Some researchers informed consent form you must
• I have asked a member of the research use or share your information for research as an Rule protection started.
team any questions I have, and I sign to become part of the study. authorization for marketing.
Even though some doctors, understand the answers. In either case, the form will tell you
researchers, or organizations aren't • I have received a signed copy of my For more information on the Privacy Rule and for
how the research team or your What can I do if I think someone has not
covered entities under the Privacy filing complaints go to the OCR website:
authorization form for the research doctor or hospital may use or share protected my personal health information?
Rule, many of them know it's study I am joining.
http://www.hhs.gov/ocr/hipaa. You can also call
your personal health information
important to keep your information If you think your privacy rights under the Privacy OCR for free at 1 (800) 368-1019.
for the study.
private. They also may have to Rule were violated, you may complain to the
follow state or other national laws that protect your Once I have signed the authorization, can I
information. change my mind and cancel it?

I don't understand why the authorization form Yes, you may change your mind and cancel your
says that the Privacy Rule may not protect my authorization at any time.
personal health information if it's shared. Why
does the authorization form say this? How do I cancel my authorization?
There may be times when your personal health You must cancel your authorization in writing. The
information is shared with some doctors, authorization form will give you instructions on
researchers, or organizations (such as makers of where to send the written notice or will direct you to
drugs for the study or study sponsors) that don't another place to find this information. Once the
have to follow the Privacy Rule. The authorization research study team receives your written
form tells you that the Privacy Rule may not protect cancellation,
your personal health information when it is shared it won't be
with others so that you are aware of this before you allowed to
decide to sign the form. collect, use,
or share
I am not sure if I should sign the authorization. more
What happens if I don't sign? personal
health
If you don't sign the form, you may not be able to information
join the research study. However, your decision to about you
not sign the authorization form won't affect the except in NIH Publication Number 05-5613
• Your Right to change your mind and cancel your regular treatment you receive from your regular limited cases. For example, they may need to use or "covered entity" (such as the doctor or hospital you
authorization at any time. doctors, nurses, or other professionals normally share this information to make sure the research visit for the research study). You may also complain
• Information on what happens if you do not sign involved in your health care. study is still reliable, to report when you cancelled to the Office for Civil Rights (OCR). Your complaint
the authorization form, how to cancel your your authorization, or to report any unexpected must be in writing. To complain to OCR:
authorization, and how long your information will I want to let the research team have my health problems that started before you cancelled
personal health information so I can join the • Send the complaint electronically by email to
be used or shared. your authorization.
study. How do I give my authorization? OCRComplaint@hhs.gov, or as a letter or fax to
Will I still be able to stay in the study if I cancel the OCR regional office where the possible
Will everyone who sees my personal health To give your authorization, you need to sign and violation happened. These regional offices are on
information have to protect it under the date the authorization form. Signing the form means my authorization?
the map and chart shown on the back cover, or you
Privacy Rule? that you give your okay for the research team to use It's up to the research team to decide if you may stay can find them on the OCR website at
Not always. There may be times or share your personal health in the research study if you cancel your http://www.hhs.gov/ocr/privacyhowtofile.htm.
when your personal health information for the research study. authorization. Many times a research study can only
Authorization form checklist: • Print and fill out the form found on the above
information is shared with Signing the authorization form be helpful if all of the people stay in the study and all
may also mean that you will give of their information can be used and studied for the website or send the same information to the OCR
someone who doesn't have to follow • I have read the authorization form
completely, either on my own or with your doctor or hospital your okay entire time of the study. regional office. Name the person or organization
the Privacy Rule. Examples of you are complaining about, and describe how you
someone from the research team. to share your health information
people and organizations that may think they didn't follow the Privacy Rule.
not have to follow the Privacy Rule • I understand what the authorization with the research team. Can my doctor use my authorization for the
are:
form is saying. research study as my okay to share my • Send in your complaint within 180 days of when
• I understand who may be using my The authorization form might be information for marketing? you learned about the possible violation.
• Sponsors of the research study personal health information as part of given to you as a separate form, or No. The Privacy Rule does not allow a doctor or • Make sure that any possible violation happened on
• Makers of drugs for the study the research study. it may be included with the another "covered entity" to use your authorization to or after April 14, 2003, which is when the Privacy
• Some researchers informed consent form you must
• I have asked a member of the research use or share your information for research as an Rule protection started.
team any questions I have, and I sign to become part of the study. authorization for marketing.
Even though some doctors, understand the answers. In either case, the form will tell you
researchers, or organizations aren't • I have received a signed copy of my For more information on the Privacy Rule and for
how the research team or your What can I do if I think someone has not
covered entities under the Privacy filing complaints go to the OCR website:
authorization form for the research doctor or hospital may use or share protected my personal health information?
Rule, many of them know it's study I am joining.
http://www.hhs.gov/ocr/hipaa. You can also call
your personal health information
important to keep your information If you think your privacy rights under the Privacy OCR for free at 1 (800) 368-1019.
for the study.
private. They also may have to Rule were violated, you may complain to the
follow state or other national laws that protect your Once I have signed the authorization, can I
information. change my mind and cancel it?

I don't understand why the authorization form Yes, you may change your mind and cancel your
says that the Privacy Rule may not protect my authorization at any time.
personal health information if it's shared. Why
does the authorization form say this? How do I cancel my authorization?
There may be times when your personal health You must cancel your authorization in writing. The
information is shared with some doctors, authorization form will give you instructions on
researchers, or organizations (such as makers of where to send the written notice or will direct you to
drugs for the study or study sponsors) that don't another place to find this information. Once the
have to follow the Privacy Rule. The authorization research study team receives your written
form tells you that the Privacy Rule may not protect cancellation,
your personal health information when it is shared it won't be
with others so that you are aware of this before you allowed to
decide to sign the form. collect, use,
or share
I am not sure if I should sign the authorization. more
What happens if I don't sign? personal
health
If you don't sign the form, you may not be able to information
join the research study. However, your decision to about you
not sign the authorization form won't affect the except in NIH Publication Number 05-5613
 Letting Your Personal Health Information
Be Used and Shared for Research
U.S. DEPARTMENT OF
HEALTH & HUMAN SERVICES

REGIONS
SEATTLE I
X
BOSTON

V II The Privacy Rule Authorization Form and People who work for "covered entities" also may
VIII PHILADELPHIA
NEW YORK
Clinical Research: What You Should Know have to follow the Privacy Rule. This usually means
IX VII
CHICAGO
Medical research helps us learn new information that research teams (such as scientists, nurses, and
III
DC
SAN FRANCISCO
DENVER
about health, illness, and disease and how we can other hospital staff) that work for "covered entities"
KANSAS CITY

improve health for everyone. You have been asked can use and share your personal health information
for this study only after getting your okay. This also
IV to join a clinical research study. If you agree to be in
usually means that your doctor can't share your
this study after learning about it, the research team
ATLANTA

VI DALLAS
will ask you to sign certain important forms. One of personal health information with the research team
these may be an authorization form. This form may for this study unless you
Examples of
ask you to let your doctors or other health care give your okay. You give Covered Entities
providers give your personal health information to your okay by signing the
• Many hospitals
Region I - CT, ME, MA, NH, RI, VT Region VI - AR, LA, NM, OK, TX the research team. The authorization form could authorization form.
• Many doctors or nurses
Office for Civil Rights Office for Civil Rights
U.S. Department of Health and Human Services U.S. Department of Health and Human Services also ask you to let the research team use or share • Some researchers
your personal health information with others for the The research team may • Health insurers
JFK Federal Building - Room 1875 1301 Young Street - Suite 1169
Boston, MA 02203 Dallas, TX 75202 research study. The research team might need to need information in your • Medicare and Medicaid
(617) 565-1340 (214) 767-4056 medical records for the plans
(617) 565-1343 (TDD) (214) 767-8940 (TDD)
use and share different types of personal health
information, such as: research study. For
(617) 565-3809 FAX (214) 767-0432 FAX
example, they may need to know your medical
Region II - NJ, NY, PR, VI Region VII - IA, KS, MO, NE • Your name and address • Your ethnic origin diagnosis or know about allergies you may have. The
Office for Civil Rights Office for Civil Rights • Your health background • Your lab test results research team may also need to collect health
U.S. Department of Health and Human Services U.S. Department of Health and Human Services • Your health care and X-rays information about you from other health care
26 Federal Plaza - Suite 3313 601 East 12th Street - Room 248
New York, NY 10278 Kansas City, MO 64106 provider's name • Notes taken by a providers because the information may be
(212) 264-3313 (816) 426-7278 • Your birthday doctor or nurse important to the study. For example, the research
(212) 264-2355 (TDD) (816) 426-7065 (TDD) • Your Social Security • Your medical team may need to get your lab test results from your
(212) 264-3039 FAX (816) 426-3686 FAX number diagnosis doctor.
Region III - DE, DC, MD, PA, VA, WV Region VIII - CO, MT, ND, SD, UT, WY • Your medical records
Office for Civil Rights Office for Civil Rights What information will be in the authorization
U.S. Department of Health and Human Services U.S. Department of Health and Human Services Why am I being asked to sign an authorization form?
150 S. Independence Mall West - Suite 372 1961 Stout Street - Room 1426 form?
Philadelphia, PA 19106-3499 Denver, CO 80294 The authorization form will tell you:
(215) 861-4441 (303) 844-2024 Many people have concerns
(215) 861-4440 (TDD) (303) 844-3439 (TDD) • Who will use, share, and receive your personal
(215) 861-4431 FAX (303) 844-2025 FAX about who can see and use
health information. This could be your doctor,
information about them,
Region IV - AL, FL, GA, KY, MS, NC, SC, TN Region IX - AZ, CA, HI, NV, AS, GU, The other doctors and nurses taking care of you, or the
particularly information
Office for Civil Rights U.S. Affiliated Pacific Island Jurisdictions researchers and other members of the research
U.S. Department of Health and Human Services
about their health. The U.S.
Office for Civil Rights team. This could also be other institutions or
61 Forsyth Street, SW - Suite 3B70 U.S. Department of Health and Human Services Government created a rule,
Atlanta, GA 30323 companies that pay for the research.
50 United Nations Plaza - Room 322 called the Privacy Rule,
(404) 562-7886 San Francisco, CA 94102 under the Health Insurance • What personal health information is needed for
(404) 331-2867 (TDD) (415) 437-8310
(404) 562-7881 FAX (415) 437-8311 (TDD) Portability and Accountability Act (HIPAA) to help the research study. This may include some or all
(415) 437-8329 FAX protect your personal health information from being of your medical records, information about the
Region V - IL, IN, MI, MN, OH, WI used or shared when it shouldn't be. medicines you take, the results of blood tests or
Office for Civil Rights Region X - AK, ID, OR, WA X-rays, and other health information.
U.S. Department of Health and Human Services Office for Civil Rights
233 N. Michigan Avenue - Suite 240 U.S. Department of Health and Human Services Since 2003, most hospitals, doctors, and health • Why your personal health information will be
Chicago, IL 60601 2201 Sixth Avenue - Mail Stop RX-11 plans that have your personal health information
(312) 886-2359 Seattle, WA 98121 used or shared. This part will describe the
(312) 353-5693 (TDD) (206) 615-2290
must follow the Privacy Rule. These hospitals, research study. It also may tell you the title of the
(312) 886-1807 FAX (206) 615-2296 (TDD) doctors, and health plans are called "covered research study.
(206) 615-2297 FAX entities."