Which action may allow use or disclosure of PHI in research without patient authorization?

• A. Written authorization for human subject research
• B. Waiver of authorization approved by IRB (use de-identified or limited data sets)
• C. Database registration
• D. Preparatory to research certifications

Answer: (B)

PHI can be used or disclosed for research without patient authorization only under specific protections. The most direct way this occurs is with an IRB-approved waiver of authorization. If the IRB or Privacy Board determines that the four criteria are met—there is minimal risk to privacy, safeguards are in place to protect the information, the research could not practicably be conducted without the waiver, and the waiver will not adversely affect individuals’ privacy rights—the study may proceed using PHI without obtaining individual authorization. De-identifying the data removes PHI entirely, so authorization isn’t needed; using a limited data set is allowed but requires a data use agreement rather than a blanket waiver. Written authorization is the standard requirement, while database registration or preparatory-to-research certifications do not by themselves grant permission to use PHI without consent.