Written and maintained by CASRAI Editorial Board
Last updated
The HIPAA Preparatory to Research provision, codified at 45 CFR § 164.512(i)(1)(ii) of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, is a regulatory pathway that permits a covered entity (such as an academic medical center, hospital system, or clinic) to allow investigators to review Protected Health Information (PHI) without individual patient HIPAA Authorization and without a formal Institutional Review Board (IRB) or Privacy Board Waiver of Authorization. Its specific purpose is to solve a classic clinical research chicken-and-egg dilemma: before an investigator can write a rigorous clinical trial protocol or submit a grant application, they must first determine whether the hospital actually treats enough patients meeting the proposed inclusion and exclusion criteria.
While the Preparatory to Research pathway streamlines cohort feasibility queries and study design, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforces strict boundaries around what data can be viewed, whether PHI can leave the covered entity, and when a review crosses into active human subjects recruitment requiring an IRB partial waiver and CITI Human Subjects Research training.
What Is the HIPAA Preparatory to Research Provision? The 3 Mandatory Representations
Under 45 CFR § 164.512(i)(1)(ii), a covered entity may use or disclose PHI for reviews preparatory to research only if the covered entity obtains from the researcher three explicit representations (which the Privacy Rule permits to be obtained orally or in writing, though virtually all academic medical centers require a signed electronic attestation form logged alongside HIPAA audit log requirements):
- Solely to Prepare a Research Protocol (
45 CFR § 164.512(i)(1)(ii)(A)): The use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research (such as assessing whether a sufficient number or type of clinical records exist to conduct a proposed study, or formulating a research hypothesis). - No Removal of PHI from the Covered Entity (
45 CFR § 164.512(i)(1)(ii)(B)): No Protected Health Information is to be removed from the covered entity by the researcher in the course of the review. - Necessary for the Research Purposes (
45 CFR § 164.512(i)(1)(ii)(C)): The PHI for which use or access is sought is necessary for the research purposes (aligning the feasibility review with the HIPAA Minimum Necessary standard at 45 CFR § 164.502(b) and § 164.514(d)).
Crucially, recording aggregate, completely de-identified summary counts—for example, noting in a grant application that “412 patients with Stage III non-small cell lung cancer and EGFR exon 19 deletions were treated at Institution X between 2022 and 2025”—does not violate the prohibition against removing PHI, because aggregate counts stripped of all 18 HIPAA identifiers under 45 CFR § 164.514(b) are not PHI.
Can Researchers Remove PHI from a Covered Entity Under Preparatory to Research?
No. Under 45 CFR § 164.512(i)(1)(ii)(B), a researcher is strictly prohibited from removing any identifiable PHI—whether on paper worksheets, USB drives, local laptop spreadsheets, or external cloud storage—from the covered entity during a preparatory review.
How does this rule apply to modern cloud Electronic Health Record (EHR) data warehouses and remote work? Following the enactment of Section 2063 of the 21st Century Cures Act, HHS OCR issued guidance clarifying that remote electronic access to view PHI stored inside a covered entity’s secure network does not constitute impermissible “removal” of PHI, provided that technical and administrative controls prevent the researcher from copying, downloading, printing, or retaining the PHI outside the covered entity’s information environment.
In practice, academic medical centers operationalize Preparatory to Research access through two informatics tiers:
- Self-Service De-Identified Cohort Discovery Tools: Systems such as i2b2, TriNetX, or OHDSI ATLAS allow investigators to query obfuscated aggregate patient counts (often rounded to the nearest ±3 or suppressed when cell counts fall below 10) without touching PHI at all.
- Chart Review Inside a VDI / EHR Sandbox: When aggregate ICD-10-CM and LOINC queries cannot verify complex clinical eligibility criteria (such as unstructured pathology margin descriptions or prior chemotherapy intolerance documented in narrative notes), the researcher submits a Preparatory to Research attestation to inspect a limited sample of EHR charts inside the hospital’s Virtual Desktop Infrastructure (VDI) with clipboard export and local file download disabled.
Can Investigators Contact Prospective Study Participants Under the Preparatory to Research Rule?
One of the most frequent compliance questions in clinical trials operations is whether an investigator can use 45 CFR § 164.512(i)(1)(ii) to compile a list of eligible patients from the EHR and contact them to ask if they want to enroll in a clinical trial. According to formal HHS OCR guidance, the answer depends on two separate regulatory frameworks—the HIPAA Privacy Rule (which distinguishes internal workforce members from external researchers) and the Common Rule / FDA Human Subjects Regulations (45 CFR 46 vs. 21 CFR 50):
- External Researchers (Not Workforce Members): An outside researcher who is not a member of the covered entity’s workforce cannot use the Preparatory to Research provision to obtain patient contact information or contact prospective participants, because extracting names, phone numbers, or addresses to contact patients constitutes removing PHI from the covered entity. An external researcher must obtain an IRB or Privacy Board Partial Waiver of Authorization under 45 CFR § 164.512(i)(1)(i).
- Internal Workforce Researchers (HIPAA vs. IRB Rule): Under HHS OCR’s interpretation of the HIPAA Privacy Rule alone, a researcher who is an employee or workforce member of the covered entity may use PHI under the Preparatory to Research provision to identify and contact prospective subjects to seek their HIPAA Authorization, because a workforce member operating within the covered entity is not “removing” PHI. However, under the Common Rule (45 CFR Part 46) and FDA regulations, contacting prospective human subjects to recruit them into a study is considered the initiation of human subjects research (recruitment), not merely “preparing a protocol.” Consequently, most academic medical center IRBs prohibit direct patient recruitment outreach under a Preparatory to Research attestation and require formal IRB protocol approval plus a Partial Waiver of HIPAA Authorization before any recruitment contact occurs.
Comparing HIPAA Research Pathways: Preparatory Review vs. IRB Waiver vs. Authorization
To prevent OCR audit findings (and keep research workflows distinct from patient-initiated requests governed by the OCR Right of Access Initiative and the ONC Information Blocking Rule), privacy officers map each stage of a clinical study to its exact 45 CFR Part 164 authority:
| HIPAA Privacy Rule Pathway | Regulatory Citation | Permitted Activity & Data Scope | Can PHI Be Recorded for Study Analysis or Removed? |
|---|---|---|---|
| Reviews Preparatory to Research | 45 CFR § 164.512(i)(1)(ii) |
Feasibility assessment, hypothesis generation, and protocol design via on-site or secure remote EHR review. | No. Only de-identified aggregate counts may be retained outside the review; no PHI may be removed. |
| IRB / Privacy Board Waiver (Full or Partial) | 45 CFR § 164.512(i)(1)(i) |
Screening/recruitment outreach (Partial Waiver) or retrospective chart review / registry studies where individual consent is impracticable (Full Waiver). | Yes, within the specific minimum-necessary data elements and privacy safeguards approved by the IRB/Privacy Board. |
| Research on Decedents’ Information | 45 CFR § 164.512(i)(1)(iii) |
Research solely on the PHI of deceased individuals (researcher represents data are sought solely for decedent research and are necessary). | Yes, for verified decedents (note: HIPAA protects decedent PHI for 50 years post-death under 45 CFR § 160.103). |
| Limited Data Set (LDS) + Data Use Agreement | 45 CFR § 164.514(e) |
Sharing research datasets stripped of direct facial/contact identifiers while retaining dates (birth, admission, discharge) and 5-digit ZIP codes. | Yes, under an executed Data Use Agreement (DUA) prohibiting re-identification or contact of individuals. |
| Individual HIPAA Authorization for Research | 45 CFR § 164.508 |
Prospective interventional trials and observational cohorts where participants sign a compliant HIPAA Authorization (often combined with informed consent). | Yes, for the specific recipients, purposes, and expiration date/event stated in the signed Authorization. |
Frequently Asked Questions
What is the HIPAA Preparatory to Research provision?
Under 45 CFR § 164.512(i)(1)(ii) of the HIPAA Privacy Rule, the Preparatory to Research provision allows a covered entity to permit researchers to review Protected Health Information (PHI) without individual patient authorization or an IRB waiver solely to prepare a research protocol (such as checking cohort feasibility), provided the researcher makes three mandatory representations.
Can researchers remove PHI from a covered entity under Preparatory to Research?
No. Under 45 CFR § 164.512(i)(1)(ii)(B), the researcher must represent that no Protected Health Information (PHI) will be removed from the covered entity during the review. Researchers may view PHI on-site or via a secure remote virtual desktop controlled by the covered entity, but they cannot download, print, copy, or export identifiable patient data.
Can investigators contact prospective study participants under the Preparatory to Research rule?
According to HHS Office for Civil Rights (OCR) guidance, it depends on whether the investigator is a member of the covered entity’s workforce. An internal workforce researcher may use the Preparatory to Research provision to identify and contact prospective subjects (if permitted by the institution’s IRB). However, an external researcher who is not part of the covered entity’s workforce cannot extract contact information or contact patients under this provision and must instead obtain an IRB Partial Waiver of Authorization under 45 CFR § 164.512(i)(1)(i).
