When required, the information provided to the data subject in a HIPAA disclosure accounting

The HIPAA “minimum necessary” standard applies

HIPAA includes in its definition of “research,” activities related to:

Under HIPAA, a “disclosure accounting” is required

HIPAA’s protections for health information used for research purposes

If you’re unsure about the particulars of HIPAA research requirements at your organization or have questions, you can usually consult with:

A covered entity may use or disclose PHI without an authorization, or documentation of a waiver or an alteration of authorization, for all of the following EXCEPT:

HHS has reiterated in its guidance that use or disclosure of PHI for retrospective research studies may be done only with patient authorization — or with a waiver, alteration, or exception determination from an IRB or Privacy Board. However, remember that ...

Under HIPAA, “retrospective research” (a.k.a., data mining) on collections of PHI generally