Separate research consent from HIPAA authorization

Informed consent addresses whether you agree to participate in the research. A HIPAA authorization addresses how a covered entity may use or disclose protected health information for research. The permissions can appear in one combined document, yet they answer different questions.

HHS explains (opens in a new tab) that research use or disclosure of protected health information can occur with participant authorization and, in defined circumstances, under an IRB or Privacy Board waiver. Ask the site which path applies to your information.

Ask for the minimum useful record

Request the scope, date range, purpose, recipient, and reason each record is needed. A medication list, pathology report, procedure note, imaging report, or specific laboratory result may answer a question that does not require a complete chart.

Some protocols need broad history to evaluate safety. Ask why the scope is necessary. Do not redact or alter a requested record without discussing it with the site; an incomplete record can affect safety and eligibility.

Identify who receives your information

Look for the research site, sponsor, contract research organization, monitors, central laboratories, imaging readers, electronic-data systems, device vendors, home-health services, couriers, regulators, and ethics reviewers. Ask which recipients see identifiers and which receive coded or de-identified information.

Ask where data are stored, whether they leave the country, how long they are retained, and how access is logged. For apps and wearables, check permissions, background collection, location data, contacts, microphone, camera, and data gathered outside study tasks.

Read the specimen and genetic-data choices

Identify required specimens and optional future-use specimens. Ask whether samples are coded, whether identifiers can be reconnected, whether genetic or whole-genome analysis is planned, whether commercial products may result, whether you will share in profits, and whether researchers may contact you again.

Ask whether you can join the main study while declining optional storage or future use. Record the destruction or withdrawal process and the point after which a shared sample cannot be retrieved.

Understand the limits of revocation and withdrawal

Withdrawing from a study can stop future intervention and some future collection. Data already collected may remain to protect study integrity, meet legal duties, or support safety analysis. Information already shared or de-identified may be impossible to retrieve. Ask the site to describe these limits before signing.

HIPAA authorizations may describe revocation, exceptions, and continued use of information already obtained. Ask where to send a revocation and how it differs from notifying the study team that you are stopping participation.

Ask what you can access and what you will receive

Research records and clinical records may be handled differently. HHS describes access rights (opens in a new tab) for health information a covered entity holds in a designated record set. Under the treatment-research exception (opens in a new tab), access to information created or obtained for that research may be suspended during the trial if you agreed when consenting and were told access would return at the trial’s conclusion. Ask which records the exception covers and how to request other medical records.

Ask which individual results, incidental findings, and aggregate results are returned; how urgent findings are communicated; and whether results can be sent to your clinician. Research-only tests may require confirmation in a clinical laboratory.

Sources for this guide

References for the definitions, rules, and findings discussed above. The dates below record source checks; they are separate from the article’s edit date.

  1. U.S. Department of Health and Human Services. HIPAA Privacy Rule and Research (opens in a new tab). Checked September 5, 2026.
  2. U.S. Department of Health and Human Services. Research Participants’ Access to Research Records or Results (opens in a new tab). Checked September 6, 2026.
  3. U.S. Department of Health and Human Services. HIPAA Audit Protocol: access exceptions under §164.524(a)(2) (opens in a new tab). Checked September 6, 2026.
  4. Office for Human Research Protections. Questions to Ask About Volunteering for a Research Study (opens in a new tab). Checked September 5, 2026.
  5. HHS Office for Human Research Protections and FDA. Use of Electronic Informed Consent: Questions and Answers (opens in a new tab). Checked September 5, 2026.
  6. ClinicalTrials.gov. How to Read a Study Record (opens in a new tab). Checked September 5, 2026.