# Understanding HIPAA Waiver of Authorization: Key for Health Data Use

> **Definition**
>
> A HIPAA Waiver of Authorization is a legal document that permits the use or disclosure of an individual's health information to third parties, as outlined in the Health Insurance Portability and Accountability Act of 1996.

A legal document that allows an individual’s health information to be used or disclosed to a third party. The waiver is part of a series of patient-privacy measures set forth in the [Health Insurance Portability and Accountability Act (HIPAA) of 1996](https://www.investopedia.com/terms/h/hipaa.asp). An individual's health information is considered to be [personally identifiable information (PII)](https://www.investopedia.com/terms/p/personally-identifiable-information-pii.asp).

### Key Takeaways

*   A HIPAA waiver of authorization is a legal document allowing a patient's health information to be shared with third parties, such as researchers or family members, while maintaining compliance with HIPAA regulations.
*   Protected health information (PHI) includes any information that can be linked to an individual and is covered by HIPAA when held by a healthcare provider, insurer, or clearinghouse.
*   To use PHI for research, investigators must satisfy three conditions: ensure minimal risk to privacy, prove that the research cannot proceed without the information, and demonstrate that the study cannot be conducted practicably without the waiver.
*   Studies using PHI may involve reviewing existing records or creating new medical information, such as diagnosing conditions or testing new drugs and devices, which are then entered into the medical record.
*   Privacy protections in HIPAA include measures to prevent personal data re-identification, like using codes not derived from individual-related information, ensuring that the method for creating such codes remains undisclosed.

## Understanding the Importance of HIPAA Waiver of Authorization

The HIPAA waiver of authorization allows doctors to provide information on a patient’s health to third parties, such as researchers, attorneys, other doctors or family members. It became necessary because healthcare privacy has come into increased focus in the digital age; it is much easier for doctors to transmit patient health information via the Internet than it was when records had to be mailed or faxed.

Patient information covered under HIPAA, called protected health information (PHI), is information that can be linked to a specific individual and is held by a covered entity, such as a health insurer, healthcare provider or healthcare clearinghouse. HIPAA defines 18 specific identifiers that create PHI when linked to health information. HIPAA regulations allow researchers to obtain approval to access and use PHI when necessary to conduct research.

## Research Scenarios Utilizing Protected Health Information (PHI)

Examples of studies that involve the use of PHI include:

*   Studies that involve the review of existing health records, such as retrospective chart review or other studies that involve the abstraction of data from the subject’s health record for research purposes.
*   Studies that create new medical information because a healthcare service is being performed as part of the research. For example, most studies that diagnose a health condition or involve new drugs or devices create PHI that will be entered into the medical record.

There are some additional standards and criteria designed to protect an individual's privacy from re-identification. For example, any code used to replace the identifiers in datasets cannot be derived from any information related to the individual and the master codes, nor can the method for deriving the codes be disclosed. 

## Criteria for Approving a HIPAA Waiver of Authorization

In order for a HIPAA waiver to be approved for research purposes, three criteria for the use of private health information must be met: the health information to be disclosed must present a minimal risk to the privacy of the disclosing party; the researchers must ensure that research activities could not be undertaken without the information; and the research could not be practicably conducted without the waiver.

Should a family member attempt to bypass HIPAA rules through the use of an attorney, usually in the event of a medical emergency, the patient must have already outlined in his/her [power of attorney for healthcare](https://www.investopedia.com/terms/h/hcpa.asp) that he/she expressly waives the protection offered by HIPAA and allows the specifically designated "personal representative" to know his/her otherwise private health information.

> **Article Sources**
>
> 1.  U.S. Department for Health and Human Services. "[Health Information Privacy: Research](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/research/index.html)."