d

Under HIPAA, "retrospective research" (a.k.a., data mining) on collections of PHI generally ... Does not meet the definition of research, and so requires no HIPAA authorization or meeting one of the criteria for waiving authorization. Must meet HIPAA requirements only if the data collection is in a different jurisdiction (state) than the researcher accessing it. Is research, and so requires either an authorization or meeting one of the criteria for a waiver of authorization. Is covered by Common Rule/FDA requirements, but not HIPAA's