Under the HIPAA privacy regulations, a CUNY investigator must obtain a written authorization (a ''HIPAA Research Authorization'' from his or her research subjects in order to use and/or disclose any individually identifiable protected health information (''PHI'') of these subjects that is created or maintained by, or obtained from, a person or entity covered under HIPAA.^* Examples of entities covered under HIPAA are hospitals; physicians, and practices in psychology, psychotherapy, or social work; health insurers, HMOs, and health plans; and certain community clinics and social service and mental health agencies.

          CUNY is not an entity directly covered by HIPAA. CUNY investigators are therefore not covered under the HIPAA privacy regulations unless, in order to conduct research, they are using or disclosing patient or client information that they (a) create or receive when acting as HIPAA--covered health care providers, (b) create or receive as members of the workforce of a HIPAA-covered entity, or (c) obtain from a HIPAA-covered entity. For example, CUNY faculty or students who conduct or assist with research may also be employees or trainees in hospital or social service settings that are covered by HIPAA and may be using data obtained from those settings in research. CUNY investigators may also be collaborating with co-investigators who are covered by HIPAA.

          When a study requires use or disclosure of health information from or by a covered entity or its employees or trainees, the CUNY Principal Investigator should complete this authorization form and submit it to the appropriate CUNY IRB for review prior to presenting the form to research subjects. The CUNY Principal Investigator should take care to ensure that all necessary uses and disclosures of health information are described accurately and completely in the authorization form.

          This HIPAA Research Authorization form is separate from, and does not replace, the informed consent form that CUNY Principal Investigators may be required to have participants in their human subjects research sign. Consult the CUNY Principal Investigator's Manual for an explanation of the informed consent requirements.

          Questions about this form should be directed to the CUNY Principal Investigator's campus IRB or the Privacy Officer of the covered entity (e.g., hospital, physician practice, social service agency, or managed care organization) whose protected health information will be used or disclosed for the research.