Lesson 14 · IRB and HRPP Administration: From Coordinator to CIP

14. HIPAA in Research, Certificates of Confidentiality, FERPA, and GINA

60 min

After this lesson you can

  • Distinguish privacy from confidentiality and identify the IRB criterion governing each
  • Explain how the HIPAA Privacy Rule applies to research: covered entities, PHI, authorization, waiver, limited data sets, de-identification, preparatory to research, and decedents
  • Explain Certificates of Confidentiality, what they protect, and their exceptions
  • Apply FERPA and PPRA to research with education records and students
  • Explain GINA and the data security expectations the IRB evaluates

Video coming soon

Scheduled for release on September 30, 2026.

HIPAA in Research, Certificates of Confidentiality, and FERPA explains the privacy rulebooks that sit on top of the Common Rule. Privacy is about people and confidentiality is about data, and this lesson covers authorization, waivers, limited data sets, de-identification, Certificates of Confidentiality, FERPA, PPRA, and GINA.

5 Key Facts from This Lesson

  1. A HIPAA waiver of authorization has three criteria, while the Common Rule waiver of consent has five, and the waiver may be approved by an IRB or a Privacy Board.
  2. A limited data set may keep dates and ZIP codes, while Safe Harbor de-identification removes 18 identifiers.
  3. Expert Determination and Safe Harbor are the only two HIPAA de-identification methods.
  4. A Certificate of Confidentiality does not block disclosures required by law, such as mandatory child abuse reporting, and does not stop subjects from sharing their own information.
  5. HIPAA documentation must be kept for six years, compared with three years for IRB records.

Exam traps

The distinctions exam questions on this topic are most often built to test. Know them cold.

  • HIPAA waiver has three criteria; the Common Rule consent waiver has five; different lists

  • A limited data set may keep dates and ZIP codes; Safe Harbor removes them except the year and the first three ZIP digits in populous areas

  • Expert Determination and Safe Harbor are the only two HIPAA de-identification methods

  • A CoC does not prevent mandatory reporting required by law and does not stop subjects from disclosing their own information

  • FERPA rights transfer to the student at 18 or postsecondary enrollment; PPRA is about surveys and parental consent

  • HIPAA documentation retention is six years; IRB records are three years

Practice quiz

  1. Question 1
    Under 45 CFR 164.512(i), a waiver of HIPAA authorization for research may be approved by:
  2. Question 2
    A HIPAA limited data set may retain which of the following?
  3. Question 3
    A Certificate of Confidentiality does NOT protect against:
  4. Question 4
    The two HIPAA methods for de-identifying PHI are:
  5. Question 5
    FERPA rights transfer from the parent to the student when the student:

Recap

  • Privacy is about people and confidentiality is about data; both under 46.111(a)(7), with the consent statement at 46.116(b)(5)
  • HIPAA: covered entities, PHI, six research pathways, three waiver criteria, sixteen and eighteen identifiers, six-year retention
  • Certificates of Confidentiality: automatic for NIH-funded sensitive research, protection from compelled disclosure, exceptions for legal requirements and the subject's own consent
  • FERPA education records and the transfer at 18; PPRA's eight topics and parental consent
  • GINA's protections and gaps; GDPR recognition; the data lifecycle security plan

Coming next

Lesson 15, Subparts B and C.

Saved in your browser only: no account, no server.

This course is for educational purposes only and is not legal, regulatory, or compliance advice. Regulations and guidance change, so confirm every requirement against the current eCFR text, OHRP and FDA guidance, and your institution's IRB policies before relying on it. CIP® is a registered certification mark of Public Responsibility in Medicine and Research (PRIM&R). This course is produced independently by Subthesis and is not affiliated with, endorsed by, or reviewed by PRIM&R or the CIP Council. The instructor is not a Certified IRB Professional. Completing this course does not confer CIP certification, satisfy CIP eligibility requirements, or count as CIP recertification continuing education.