Direct comparison
HIPAA Authorization vs. Informed Consent
Informed consent (45 CFR 46) vs. HIPAA authorization (45 CFR 164.508): different rules, different content, and independent waiver criteria.
Side-by-side comparison
| Dimension | Informed Consent | HIPAA Authorization |
|---|---|---|
| What it grants permission for | Participation in the research study | Use/disclosure of protected health information for research |
| Governing regulation | Common Rule, 45 CFR 46.116 (plus 21 CFR 50 for FDA-regulated research) | HIPAA Privacy Rule, 45 CFR 164.508 |
| Reviewing body | Institutional Review Board (IRB) | IRB or a separately constituted Privacy Board |
| Triggered by | Enrolling a human subject in research | A HIPAA-covered entity using/disclosing PHI for research |
| Core required content | Purpose, procedures, risks/benefits, alternatives, voluntariness, withdrawal rights, contacts | Description of PHI, who discloses/receives it, purpose, expiration event, right to revoke |
| Waiver provision | 45 CFR 46.116(f) | 45 CFR 164.512(i) |
| Waiver criteria focus | Minimal risk; no adverse effect on rights/welfare; not practicable without waiver | Minimal privacy risk (identifier protection/destruction plan); not practicable without waiver; not practicable without PHI access |
| Can apply without the other? | Yes — e.g., research with no PHI/covered entity involved | Yes — e.g., retrospective PHI-only chart review with no new enrollment |
| Can be combined into one document? | Yes, explicitly permitted | Yes, explicitly permitted |
Common questions
FAQ
Does obtaining informed consent automatically satisfy HIPAA authorization?+
No. Even when combined into one signed form, the authorization section must independently contain the elements required by 45 CFR 164.508 (description of the PHI, recipients, expiration event, right to revoke, etc.). A generic consent-to-participate statement, without those specific elements, does not function as a valid HIPAA authorization.
Can HIPAA authorization be waived while informed consent is still required, or vice versa?+
Yes. The two waiver pathways are evaluated against different criteria under different regulations (45 CFR 46.116(f) for consent, 45 CFR 164.512(i) for authorization), and an IRB or Privacy Board can grant one without the other applying, depending on what the study actually does with PHI versus how it involves participants.
Who can waive HIPAA authorization for research?+
An IRB or a separately constituted Privacy Board, applying the criteria at 45 CFR 164.512(i)(2). Some institutions route this through the same IRB that reviews the study's human-subjects protocol; others use a distinct Privacy Board for the HIPAA-specific determination.
Does de-identified data need either document?+
Data that meets the HIPAA de-identification standard (Safe Harbor or Expert Determination, 45 CFR 164.514(a)-(b)) falls outside HIPAA's scope entirely, so no authorization or authorization waiver is needed for that data. Whether informed consent is still required is a separate Common Rule question that depends on whether the data or specimens are individually identifiable under that regulation's own definitions.
What happens if a covered entity discloses PHI for research under a waiver instead of authorization?+
Waiver-based disclosures are not exempt from HIPAA's accounting-of-disclosures requirement (45 CFR 164.528) — unlike authorization-based disclosures, which are exempt. Covered entities generally need to be able to produce an accounting of research disclosures made under an IRB/Privacy Board waiver.
Going deeper
