HIPAA for Researchers

In your research, will you be collecting, mining, storing, sharing or transferring any protected health information (PHI)? Then follow the steps below.

Assess the population.

Do I have the population to do the study?


Look at the data available, or at trends, in order to decide on research project purpose and protocols.

Begin writing your grant.

Write the grant, proposal and protocols.

Submit the study to IRB.


IRB will review, approve and require consent for research and authorization for HIPAA data usage; in most institutions, including UCD, the IRB acts as the Privacy Board; or


The IRB will ​waive Consent and Authorization as part of their review.

Begin research.

Commence Research

Will you be sharing data with an external entity or affiliate? Learn about Data Sharing.

HIPAA Contacts

CMS Login