Transition Provisions

Under the Privacy Rule, a covered entity may use and disclose protected health information that was created or received for research, either before or after the compliance date, if the covered entity obtained any one of the following prior to the compliance date:

• An authorization or other express legal permission from an individual to use or disclose protected health information for the research;
• The informed consent of the individual to participate in the research; or
• A waiver of informed consent by an IRB in accordance with the Common Rule or an exception under FDA's human subject protection regulations at 21 CFR 50.24.

However, if a waiver of informed consent was obtained prior to the compliance date, but informed consent is subsequently sought after the compliance date, the covered entity must obtain the individual's authorization as required at 45 CFR 164.508. For example, if there was a temporary waiver of informed consent for emergency research under the FDA's human subject protection regulations, and informed consent was later sought after the compliance date, individual authorization would be required before the covered entity could use or disclose protected health information for the research after the waiver of informed consent was no longer valid. The Privacy Rule allows covered entities to rely on such express legal permission, informed consent, or IRB-approved waiver of informed consent, which they create or receive before the applicable compliance date, to use and disclose protected health information for specific research studies, as well as for future unspecified research that may be included in such permission.