Outside researchers

Q: I'm involved in a study and would like to use an independent researcher to identify potential participants among my patients. Under HIPAA, is a nonstaff person permitted to use protected health information for this purpose?

A: Yes, as long as he fulfills one of two requirements: He could obtain individual patient authorization. But, of course, this option is probably too time-consuming and cumbersome for all but the most limited studies. Or, he could obtain a partial waiver of individual authorization by an Institutional Review Board (IRB) or a Privacy Board (a review body established by a covered entity expressly for this purpose). Keep in mind that if you use a staff member to identify potential research subjects, she won't be subject to either of these requirements.

The privacy rule doesn't require you to enter into a business associate agreement with the independent researcher.