The guidance from the Department of Health and Human Services (HHS) emphasizes that the use or disclosure of Protected Health Information (PHI) for retrospective research studies typically requires patient authorization. However, there are certain circumstances under which this requirement can be waived, altered, or exceptions made by an Institutional Review Board (IRB) or a Privacy Board. Here are the key points to understand from this guidance:

1. Patient Authorization: Normally, researchers must obtain explicit permission from patients to use or disclose their PHI for retrospective research.
2. Waiver, Alteration, or Exception:
   • IRB or Privacy Board Approval: Researchers can proceed without patient authorization if they receive a waiver, alteration, or exception determination from an IRB or a Privacy Board. This means the board has reviewed the study and determined that it meets specific criteria allowing for the use of PHI without patient consent.
   • Criteria for Waiver: The IRB or Privacy Board will consider factors such as the minimal risk to privacy, the impracticality of obtaining consent, and adequate plans to protect the identifiers from improper use and disclosure.
3. Approval Requirement: Researchers generally cannot move forward with their retrospective studies involving PHI without obtaining some form of approval or determination from an IRB, Privacy Board, or another designated governing entity. This ensures that the research complies with privacy and ethical standards.