Researchers should note that there are no restrictions under HIPAA for the use or disclosure of de-identified health information. De-identified health information neither identifies nor provides a reasonable basis to identify an individual. HIPAA provides only two ways to de-identify information, either:

• a formal determination by a qualified statistician; or
• the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.

Researchers who require access to individually identifiable health information must either have each participant whose PHI is being gathered sign a HIPAA Authorization form or request that the IRB/HIPAA Privacy Board waive the authorization requirement.