HIPAA and Retrospective Research

Retrospective research asks a question about health information that was already generated during routine clinical care, before the study existed — most commonly through a retrospective chart review, but the same logic applies to any study built on pre-existing records (registries, claims data, prior lab results). The defining HIPAA problem this creates is practical, not conceptual: HIPAA’s default mechanism for a covered entity to use or disclose an individual’s protected health information (PHI) for research is a signed Authorization (see HIPAA in Clinical Research) under 45 CFR 164.508, but Authorization is written for a study where the individual is available, identifiable, and being asked prospectively. In a retrospective study, many or most of the individuals whose records are needed were treated months or years earlier, may no longer be patients of the institution, and are frequently too numerous to practicably locate and ask. HIPAA anticipates this and provides a separate route.

The waiver of authorization is the operative mechanism

Instead of individual Authorization, retrospective research typically relies on a waiver of authorization granted by an Institutional Review Board (IRB) or a separately constituted Privacy Board, under 45 CFR 164.512(i)(1)(i). To grant a full or partial waiver, the reviewing body must document, per 164.512(i)(2)(ii), that all three of the following criteria are met:

• Minimal privacy risk, supported by (a) an adequate plan to protect identifiers from improper use/disclosure, (b) an adequate plan to destroy identifiers at the earliest opportunity consistent with the research, absent a health or research justification for retaining them, and (c) written assurances that the PHI will not be reused or redisclosed except as permitted by law, for authorized oversight of the research, or for other research for which Authorization or a waiver would be permitted.
• Not practicable without the waiver — typically because the size of the retrospective cohort, the time elapsed, or the loss to follow-up makes prospective re-contact and Authorization genuinely impracticable, not merely inconvenient.
• Not practicable without access to the PHI itself — the research question cannot be answered on de-identified or limited data alone (for example, because the analysis requires identifiers to link records across systems, or dates of service more precise than a limited data set permits).

These three criteria, and the full documentation content required, are covered in more regulatory depth at 45 CFR 164.512(i) (HIPAA Uses and Disclosures for Research Purposes) — this entry focuses specifically on how that provision is applied in the retrospective-research context.

Why authorization or consent is often impracticable here specifically

The impracticability finding is not automatic just because a study is retrospective — it has to be documented against the specific cohort. Common, IRB-recognized bases include: the cohort spans years and many individuals cannot be located with current contact information; the cohort is large enough that individual re-contact would be burdensome relative to the minimal-risk, records-only nature of the research; or re-contacting individuals about a past episode of care (including deceased patients’ next of kin) would itself risk causing distress disproportionate to the study’s minimal privacy risk. None of this waives the parallel Common Rule informed-consent analysis — an IRB separately considers a waiver of informed consent under 45 CFR 46.116(f) using its own, related-but-distinct criteria. The two waivers (HIPAA authorization waiver under 164.512(i)(2), and Common Rule consent waiver under 46.116(f)) are requested and documented separately, even though the same IRB often reviews both at once for the same protocol.

Alternatives and adjacent pathways

A waiver of authorization is not the only route into retrospective, records-based research, and it is worth distinguishing it from the pathways it is sometimes confused with:

• De-identification (45 CFR 164.514(a)-(b)): if the dataset can be fully de-identified — via Safe Harbor’s 18-identifier removal or a qualified statistician’s expert determination — before use, the information falls outside HIPAA’s scope entirely and no waiver, Authorization, or accounting obligation applies to the de-identified dataset.
• Limited data set + Data Use Agreement (164.514(e)): a middle ground that keeps some indirect identifiers (e.g., dates, geographic detail) for research use under a signed Data Use Agreement, without full Authorization or a waiver — see Limited Data Set (HIPAA).
• Review preparatory to research (164.512(i)(1)(ii)): used only to help design a study, formulate a hypothesis, or assess feasibility (e.g., checking whether enough eligible patients exist), with no PHI removed from the covered entity and no PHI recorded by the reviewer in any form. This is not retrospective research itself — it precedes it.

Because a waiver-based disclosure is not one of HIPAA’s exempt-from-accounting categories, retrospective research conducted under 164.512(i) also triggers accounting-of-disclosures obligations if a patient later requests one — see HIPAA Accounting of Disclosures, including the simplified per-protocol accounting method available at 164.528(b)(4) for studies disclosing 50 or more individuals’ PHI.

For how the waiver-of-authorization pathway compares directly against obtaining prospective, signed Authorization — including when each is actually required — see HIPAA Authorization vs. Informed Consent.

Checking this against the current guidance

Whether a Data Use Agreement is still required on top of an IRB waiver of authorization depends on where the data is going next, not on the waiver itself. The answer depends on which downstream destination of the disclosed data, and the page above states the general rule.

Ask CASRAI: For a retrospective chart-review study that qualifies for an IRB waiver of authorization under 45 CFR 164.512(i), does the researcher still need a separate Data Use Agreement if the data will be shared with a collaborating institution, and does 2 CFR 200 add any requirement if the underlying project is federally funded?

It searches CASRAI’s indexed corpus of research-administration guidance and cites the passage behind each claim, so you can open the source and check it rather than take its word — and it says so when the corpus does not cover something instead of guessing. Two questions a day are free while you are signed out, no account and no card. Everything CASRAI publishes stays free to read.

Frequently asked questions

Is a waiver of authorization the same thing as a waiver of informed consent?

No. A HIPAA waiver of authorization (45 CFR 164.512(i)) lets a covered entity disclose protected health information without the individual’s signed HIPAA authorization; a waiver of informed consent under the Common Rule (45 CFR 46.116(f)) is a separate determination about research ethics consent. A retrospective chart review often needs the HIPAA waiver specifically, and may or may not also need a consent waiver depending on the study design.

Does de-identifying the data avoid the need for a HIPAA waiver?

Yes, if the data is fully de-identified under HIPAA’s Safe Harbor or Expert Determination standard before disclosure, HIPAA’s authorization and waiver requirements don’t apply at all, since de-identified data isn’t protected health information. A limited data set retains some identifiers and still requires either an Authorization, a waiver, or a Data Use Agreement.

Who at the institution grants a waiver of authorization?

The IRB or a Privacy Board makes the waiver determination, applying the three criteria at 164.512(i)(2)(ii): minimal privacy risk, impracticability of the research without the waiver or without access to the identifiable information, and impracticability of conducting the research with only de-identified data.

Does a waiver of authorization expire?

The waiver itself doesn’t have a fixed expiration date the way an IRB approval period does, but it is tied to the specific protocol it was granted for; a substantive change to the protocol’s scope or data elements generally requires the IRB or Privacy Board to reconsider the waiver, not simply carry it forward.

Does research under a waiver still count toward a patient’s right to an accounting of disclosures?

Yes. A waiver-based disclosure is not one of HIPAA’s exempt-from-accounting categories, so it has to be logged and produced if the patient later requests an accounting, subject to the simplified per-protocol method available at 164.528(b)(4) for research disclosing 50 or more individuals’ PHI.