HIPAA Research Uses and Disclosures (45 CFR 164.512(i))
Research uses of PHI without individual authorization require either IRB or Privacy Board waiver, a limited data set with data use agreement, or reviews preparatory to research and decedent research with specific safeguards.
Primary source
45 CFR 164.512(i) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512#p-164.512(i)
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.512(i)) permits use or disclosure of PHI for research without individual authorization under three pathways: (1) a waiver of authorization documented by an IRB or Privacy Board; (2) reviews preparatory to research, certified by the researcher and limited to the minimum necessary; or (3) research on decedents' PHI with similar certification.
A waiver requires the IRB or Privacy Board to find that the research could not practicably be conducted without the waiver or without access to PHI, that the privacy risks are minimal given the protections proposed, and that the research is of sufficient importance.
The limited data set pathway at 164.514(e)) supports research disclosures with a data use agreement; the recipient may not re-identify and must use it solely for the agreed purpose. De-identified data per 164.514(b) is outside HIPAA entirely. Many research disclosures from clinical practices use one of the latter two pathways to avoid IRB administrative load.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA De-Identification Standard (45 CFR 164.514(a)-(b))Two methods for de-identifying PHI so that it is no longer subject to the Privacy Rule: the Safe Harbor method removing 18 identifier categories, and the Expert Determination method.
- RegulationHIPAA Limited Data Set (45 CFR 164.514(e))A limited data set excludes most direct identifiers but retains dates and geographic data; disclosure requires a written data use agreement.
- RegulationHIPAA Authorization Requirements (45 CFR 164.508)Required elements and statements for a valid HIPAA authorization, plus the prohibition on combining authorizations with other documents in most circumstances.
- GlossaryLimited Data SetPHI that excludes direct identifiers but may include city, state, ZIP, dates, and other quasi-identifiers; may be disclosed for research, public health, or healthcare operations under a Data Use Agreement.
- RegulationHIPAA Disclosures Required by Law and Public Health (45 CFR 164.512)Disclosures permitted without authorization or opportunity to agree, including public health, judicial proceedings, law enforcement, and serious threats to health or safety.
- ComplianceHIPAA Subpoena Response: Court Order vs Administrative Subpoena (45 CFR § 164.512)Court order, civil subpoena, grand-jury subpoena, DEA administrative demand — each triggers a different HIPAA response path. Identify the type before you produce a single record.
- SRAHIPAA Risk Analysis for a Physical Therapy PracticeWhat an outpatient physical therapy clinic owes under 45 CFR 164.308(a)(1)(ii)(A), with the ePHI workflows specific to PT, OT, and rehab settings.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.