​Release of Information (ROI) Guidelines for Research

Research studies in medical science and other health care fields often require that researchers review medical records. Researchers may request the release of records for their review to:


  • Determine whether specific patients are suitable subjects for a proposed or planned research study such as testing a new drug, device, or procedure;
  • Follow the course of a specific patient over a period of time, often many years; or
  • Study outcomes in large populations of patients with similar diagnoses, treatment, demographics, and/or other common traits.

Authorization for Release of Information in Research

Written authorization from the patient is not always required to release records for research. However, the PeaceHealth Institutional Review Board (IRB) must approve any research study in which patient information is to be released without patient authorization (see below).
Any authorization provided for release of records for research must meet all the requirements and include all the components listed in the Authorization Checklist to be considered valid. However, HIPAA Privacy regulations do permit the following regarding authorizations for release of information for research:
  • A specific expiration date or event is not required. However, an expiration statement must be included. Acceptable expiration statements include “none,” “end of research study,” or anything similar.
  • The authorization may be combined with any other type of written permission for the same research study, such as consent to participate in the study.

Institutional Review Board Approval Required

HIPAA Privacy regulations permit releases of information for a research study without patient authorization, but only for specific purposes and only with IRB approval. If the IRB has approved the research study, patient records may be released without patient (or personal representative) authorization only in the following circumstances:
  • The researcher is reviewing records to prepare a research study,
  • The research study is specific to patients who are deceased, or 
  • The PeaceHealth IRB has waived the necessity for obtaining patient authorization for the specific research study.
Important note: If the request is for the purpose of preparing a research study, the released records may not actually leave the premises. The IRB will provide guidance when this is the case. In addition to providing or printing records for the researcher’s review, you may need to provide the researcher with a work space to perform the review.
You may determine whether a given research study or protocol has been approved by the IRB by accessing the IRB website on Crossroads and selecting “Approved Protocols” from the menu.

Approval or Certification from an IRB other than PeaceHealth’s

Occasionally, researchers submit requests for patient records for a research study approved by an Institutional Review Board other than PeaceHealth’s IRB. Although HIPAA Privacy regulations permit a release of patient information in this situation, PeaceHealth policy generally does not allow it.


On rare occasions for a specific research study, the PeaceHealth IRB may enter an agreement with another IRB to approve the study protocols. This is done on a study-by-study basis only – an agreement with an outside IRB for a specific study does not carry over to a different study. Therefore, “IRB certification” from an outside IRB in most cases will not permit us to release patient information to the requesting researcher.  Check the IRB website or contact the IRB Coordinator for clarification.