Welcome to the AcademyHealth Privacy Rule Web page. This section of our Web site is designed to assist health services researchers sort through some of the issues raised by the Privacy Rule.

When Congress passes the Health Insurance Portability and Accountability Act of 1996 (HIPAA), it included a provision allowing the executive branch to adopt a regulation to protect the confidentiality of identifiable health information collected and held by health plans, providers, and healthcare clearinghouses – covered entities. The Privacy Rule, which went into effect in 2003, restricts how these covered entities can release data including to researchers.

Included in this section are:

• An interactive guide to help researchers determine when the Privacy Rule and Common Rule apply
• Four case studies that addresses many of the questions raised by researchers at our workshops on the Privacy Rule. The case study topics are:
  • Using abstracted data from medical records;
• Linking administrative data to chart reviews;
• Ethnographic research in a medical setting; and
• Collaboration among multiple hospitals.

Also included from the workshops are:

• A background paper that includes
  • A history of the regulation;
  • Definitions
  • Obtaining protected health information; and
  • Issues of importance for health services researchers.
• Tools for health services researchers including information on:
  • Data use agreements;
  • Individual authorizations; and
  • Institutional Review Boards and Privacy Boards.
• Faculty presentations.

While every effort has been made to make this information as accurate as possible, it is not intended to, nor does it constitute legal advise.