Who is a Researcher?

For the purposes of the Privacy Rule, researchers include University of Wisconsin-Madison (UW) or University Hospitals and Clinics (UWHC) employees, trainees, or students who do research involving human subjects. Researchers include investigators, research staff, postdocs, fellows, residents, graduate students, undergraduate students, i.e., anyone who uses protected health information (PHI) for research purposes.

What is a Covered entity, health care component, and affiliated covered entity?

The Privacy Rule applies only to some units within the UW, which are known as UW’s health care component (HCC).

In addition, some units of the University have joined with the University of Wisconsin Hospitals and Clinics and the University of Wisconsin Medical Foundation to form an affiliated covered entity (ACE).

In general, a researcher’s status either within or outside of the HCC or ACE determines whether the Privacy Rule applies to the use of PHI in that researcher’s projects.

How the Privacy Rule applies to researchers at UW and UWHC:

1. The Privacy Rule applies to researchers in a unit within the HCC or ACE;
2. The Privacy Rule applies to researchers in a unit outside of the HCC or ACE who:
1. collaborate with researchers within the HCC or ACE;
2. use PHI from medical records within the HCC or ACE; or
3. use PHI from databases that contain PHI from medical records.