Clinical Research Resources

Privacy, Confidentiality and Access to Protected Health Information (PHI)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.

The Privacy Rule standards address the use and disclosure of individuals’ health information (known as “protected health information [PHI]”) by entities subject to the Privacy Rule. These individuals and organizations are called “covered entities.” The Privacy Rule also contains standards for individuals’ rights to understand and control how their health information is used. A major goal of the Privacy Rule is to ensure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well-being.

Title 45 Code of Federal Regulations Part 46 (45 CFR 46), also known as The Common Rule, requires that the Institutional Review Board (IRB) ensure that there are adequate provisions to protect the privacy of human subjects and to maintain the confidentiality of their data.

The Ohio State University Wexner Medical Center (OSUWMC), Office of University Compliance and Integrity (OUCI) Privacy has guides and policies regarding access to information for human subjects research (HSR) and other activities that include:

  • General information
  • Access to PHI for HSR
  • Use of patient information to identify and/or contact potential human subjects
  • Request for access to data on decedents
  • Request for access to clinical information of human subjects enrolled in a clinical trial
  • Access to health system data for retrospective data review

Use of Patient Information by Hospitals and Medical Staff applies to all departments and units and addresses access, use and security of patient information.

Protected Health Information and HIPAA, applies to all university faculty, staff, students, suppliers/contractors, and volunteers. This policy describes the university’s process for complying with HIPAA laws and corresponding regulations, including research activities that use protected health information (PHI).

Patient Information must be protected when sending emails to non-OSUWMC email addresses. Secure Mail is a system that securely transmits emails in a HIPAA-compliant manner. Refer to OSUWMC Guidance on Emailing Patients to learn more about how to use Secure Mail. For additional information or if you do not have an OSUWMC login and cannot access the OUCI Privacy/HIPAA website, please contact the Privacy Office at 614-293-4477.

For more information about the authorized use of PHI for research purposes, contact the Ohio State University Office of Responsible Research Practices (ORRP).

Obtaining IHIS access for research

The College of Medicine Department of Research Information Technology (COMRIT), in collaboration with The Ohio State University Health System, has established a formal, standardized process for granting research access to the electronic health record, IHIS (Integrated Healthcare Information System). This process ensures consistent evaluation and approval of access to protected health information (PHI), while maintaining compliance with applicable regulations and institutional policies.

The Health Information System Access Review Committee (HISARC) is responsible for reviewing and approving requests for IHIS access for research purposes for individuals who do not obtain access through medical center employment. HISARC determines and authorizes the minimum level of access necessary for researchers to fulfill their job responsibilities.

Requirements for access to IHIS for research

  • OSU Wexner Medical Center (OSUWMC) Credentials
    • Active OSUWMC MedCenter credentials (name#) are required.
    • Individuals without an OSUWMC user ID and password must obtain an OSUWMC Guest Account via the OSU Identity Management portal.
    • Guest account requests must be submitted by an OSUWMC employee.
  • Fingerprint Background Check (FBI/BCI) must be done through OSUWMC.
    • Contact departmental HR representative to schedule with ID Processing.
  • Drug Screening
    • Contact departmental HR representative to schedule appointment with University Health Services.
    • Requests must come from a supervisor.
    • Employee health will not accept self-requests for drug screenings.
    • Cost may be associated for certain roles/titles.
  • Annual HIPAA and Institutional Data Compliance eLearning Completion
  • Listed as Key Personnel on IRB Approved Protocol (some job title/role exemptions)
  • Vaccination (for individuals who will have face-to-face contact with patients)
  • (Access-specific) IHIS training is required before access is granted.
    • IHIS access request can be submitted prior to IHIS training completion.

Additional requirements for students, visiting scholars, unpaid research contributors

Clinicians and Ohio State University medical students

These individuals already have clinical access by nature of their role and may use their clinical access for research once they meet the following requirements:

  • Register in the IHIS Researcher Registry
  • Listed as key personnel on the IRB approved protocol
  • Annual HIPAA and Institutional Data Compliance eLearning Completion
  • Complete appropriate IHIS research training if at least 50% of efforts on research

Overview of approval process

Once an eServices ticket to request IHIS for research is submitted by an OSUWMC employee (see submission instructions below), the approval process proceeds as follows:

  1. Verification by COMRIT: The College of Medicine Research IT (COMRIT) verifies the new user’s employment status, HIPAA training, background check, drug screening, IRB, and access needs prior to the next Health Information System Access Review Committee (HISARC) meeting, held on the second and fourth Thursdays of each month.
  2. HISARC review: HISARC reviews the request, determines the minimum necessary access level, and approves the request in eServices (typically within 2-4 business days). The ticket is then assigned to the IHIS Training Team.
  3. Training verification by IHIS training team: The IHIS Training Team verifies whether the user has completed all required training. If training is complete, the eServices ticket is approved and assigned to the IHIS Accounts Team (1-3 business days). If training is incomplete, the user is notified; tickets unresolved after 60 days are closed as incomplete.
  4. Account creation by IHIS accounts team: The IHIS Accounts Team creates the user account and provisions the approved access level within 1-5 business days. If filtering for In-basket plus SlicerDicer access is required, the ticket is assigned to the IT Team; otherwise, the ticket is marked as closed/complete.
  5. Configuration of SlicerDicer by IT team: The IT Team configures SlicerDicer access based on the user provided list of MRNs, providers, or department codes. This process typically takes 5-10 business days for MRNs filters and 3-7 business days for department or provider filters.

This process ensures that all requirements have been fulfilled before granting access to IHIS for research purposes.

IHIS for research request for HISARC approval flowchart:

IHIS Flow Chart

How to request IHIS access for research purposes

To submit an eServices request, go to Service Portal - Self-Service Portal