The HIPAA privacy rule: practical advice for academic and research institutions.

The Final Standards for Privacy of Individually Identifiable Health Information (privacy rule) of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 holds particular importance for academic and research organizations because they use patient information in the provision of experimental healthcare services. In developing a strategy to comply with the final privacy rule, these organizations require an understanding of certain standards that hold significance for them. Specifically, organizations should establish patient privacy guidelines for non-employee researchers the organization should consider partners in business with whom the organization should share its researcher guidelines. These organizations also should understand the difference between consent and authorization, how requirements of the final privacy rule build upon those of the Federal Policy for the Protection of Human Subjects, and the differing roles of privacy boards and institutional review boards.