Under HIPAA, "retrospective research" (a.k.a., data mining) on collections of PHI generally

Is research, and so requires either an authorization or meeting one of the criteria for a waiver of authorization.