The HIPAA Privacy rule establishes the conditions under which PHI may be used or disclosed by a covered entity for research purposes.

Research using patient records, both paper and electronic format, or excess human tissues, must be

• conducted by a full time member of the Medical Attending Staff or his/her designee

• approved by the Chair of the clinical department involved and

• approved by the Committee on the Protection of the Rights of Human Subjects (IRB).