OVERVIEW

The Marquette University Health Information Privacy Policy explains the University's implementation of the regulation and the procedures to be followed by the seven "Health Care Provider Units" on our campus. This addendum provides specific guidance for faculty doing research that may be subject to the regulation.

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides standards to protect the privacy of individually identifiable health information created or received in a health care setting. These regulations can be found under the Standards for Privacy of Individually Identifiable Health Information, Title 45 Code of Federal Regulations Parts 160 and 164. The regulations apply to health care providers, health plans, and health care clearinghouses. Organizations and units subject to the regulation are called "covered entities." The Privacy Rule describes the measures that these covered entities must take to protect health information that they gather from individuals and their duty to inform these individuals of certain uses or disclosures of the information.

Compliance with the HIPAA Privacy Rule is the responsibility of the covered entity. As a researcher working in or with a covered entity, compliance is your responsibility as well.

Researchers who work with human subjects are already acquainted with the requirements of the Common Rule (45 CFR 46). Marquette University's Federalwide Assurance to the Department of Health and Human Services (DHHS) applies the requirements to all covered human subjects research regardless of sponsorship. The Common Rule contains provisions to ensure the privacy and confidentiality of subject information.

The Privacy Rule supplements the Common Rule in the following ways:

• The HIPAA Privacy Rule covers all research activities that use individually identifiable health information that is created or received in a setting related to patient care. The Common Rule applies to research involving humans in any setting.
  
• The HIPAA Privacy Rule covers information about patients whether they are living or dead. The Common Rule applies only to living humans.
  
• HIPAA's requirements for patient authorization and the Common Rule's requirements for informed consent differ. Informed consent under the Common Rule is the subject's consent to participate in the research study. The patient authorization required by HIPAA is specifically for the use and disclosure of protected health information for research purposes.