Provides HIPAA Privacy Rule guidance for research uses of PHI under 45 CFR §164.512(i), covering IRB/Privacy Board waivers, authorizations, limited data sets, preparatory research, and decedents.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
The HIPAA Privacy Rule permits covered entities to use and disclose PHI for research purposes through several pathways. The primary mechanisms are: (1) individual authorization under §164.508, (2) waiver or alteration of authorization by an IRB or Privacy Board under §164.512(i), (3) use of a limited data set with a data use agreement under §164.514(e), (4) use of de-identified data under §164....
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
The HIPAA Privacy Rule permits covered entities to use and disclose PHI for research purposes through several pathways. The primary mechanisms are: (1) individual authorization under §164.508, (2) waiver or alteration of authorization by an IRB or Privacy Board under §164.512(i), (3) use of a limited data set with a data use agreement under §164.514(e), (4) use of de-identified data under §164.514(a)-(b), (5) preparatory to research reviews under §164.512(i)(1)(ii), and (6) research on decedent information under §164.512(i)(1)(iii). Researchers and covered entities must understand the interplay between HIPAA and the Common Rule (45 CFR Part 46) which governs human subjects research independently.
A covered entity may use or disclose PHI for research without authorization if the covered entity obtains documentation that an IRB or Privacy Board has approved a waiver (or alteration) of authorization meeting ALL of the following criteria:
The use or disclosure involves no more than a minimal risk to the privacy of individuals based on:
The research could not practicably be conducted without the waiver or alteration
The research could not practicably be conducted without access to and use of the PHI
A limited data set excludes the 16 direct identifiers listed in §164.514(e)(2) but may include:
A data use agreement (DUA) is required specifying:
A covered entity may use or disclose PHI for reviews preparatory to research if the covered entity obtains representations that:
A covered entity may use or disclose PHI of a decedent for research if:
| Requirement | HIPAA Privacy Rule | Common Rule (45 CFR Part 46) |
|---|---|---|
| Governs | Uses/disclosures of PHI by covered entities and BAs | Protection of human research subjects |
| Enforced by | OCR (HHS) | OHRP (HHS) and institutional IRBs |
| Authorization/Consent | HIPAA authorization (§164.508) | Informed consent (§46.116) |
| Waiver | IRB/Privacy Board waiver of authorization (§164.512(i)) | IRB waiver of informed consent (§46.116(f)) |
| De-identification | 18-identifier Safe Harbor or Expert Determination | Not a substitute for IRB review |
| Applies to | PHI held by covered entities and BAs | All human subjects research at institutions receiving federal funding |
| Overlap | Both may apply to same study — dual compliance required | Both may apply to same study — dual compliance required |