All research using protected health information (PHI) is subject to the Privacy Rule, even research determined to be exempt under the Common Rule. Privacy Rule regulations apply to exempt research using PHI just as they do to any other research. Frequently, exempt research will satisfy Privacy Rule requirements for a waiver of authorization.