SOP-400

Participant Privacy and HIPAA in Research

Number: SOP-400
Category: Data, Privacy and Systems
Edition: Reference Edition 1.3
Approx. pages: 11

Download Word All Reference Edition documents

[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.

On this page

1. Purpose
2. Scope
3. Responsibilities
4. Definitions
5. Procedure
6. Related Forms and SOPs
7. References

1. Purpose

This SOP describes how [SITE NAME] protects the privacy and confidentiality of prospective and enrolled participants' information, how it applies the HIPAA Privacy, Security and Breach Notification Rules to research, and how it handles privacy incidents. It covers the permitted paths for using and disclosing protected health information (PHI) in research: authorization, IRB or privacy board waiver, preparatory to research, decedent research, de-identified data and limited data sets.

2. Scope

This SOP applies to all identifiable information about prospective participants, participants and their family members held or handled by [SITE NAME] staff, in any form (paper, electronic, verbal, images), at any location including home and remote work. It applies to the site's own records and to access the site grants to sponsors, monitors, auditors, vendors and regulators.

Out of scope: IT security controls in detail (SOP-401), record retention periods (SOP-402) and the consent process (SOP-301). Where the protocol, sponsor, IRB, clinical trial agreement or state law is stricter than this SOP, the site follows the stricter requirement. This SOP is not legal advice; the site obtains legal review of its HIPAA status and of any breach determination.

3. Responsibilities

Role	Responsibilities
Principal Investigator (PI)	Accountable for protecting participant confidentiality in their studies. Approves the minimum necessary data set for recruitment and feasibility. Signs HIPAA representations for preparatory to research and decedent research.
Site Director	Determines and documents the site's HIPAA status. Appoints the Privacy Officer and Security Officer. Signs business associate agreements and data use agreements. Makes final breach notification decisions with legal advice.
Privacy Officer ([PRIVACY OFFICER NAME])	Maintains privacy policies, training content and the privacy incident log. Investigates privacy incidents, performs the breach risk assessment, and coordinates notifications. May be the Quality Lead or Site Director at small sites.
Security Officer ([SECURITY OFFICER NAME])	Owns technical and physical safeguards for electronic PHI (SOP-401). May be the same person as the Privacy Officer.
Regulatory Coordinator	Confirms the IRB-approved consent form includes the HIPAA authorization or that a separate authorization or IRB waiver is on file. Files waivers, DUAs and representations.
Clinical Research Coordinator (CRC)	Obtains authorization with consent. Applies minimum necessary in daily work. Controls monitor access. Reports privacy incidents immediately.
All Research Staff	Complete privacy training at hire and annually. Access only the information needed for their role. Report suspected incidents immediately.

4. Definitions

Term	Definition
Covered entity	A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a HIPAA standard transaction (for example electronic insurance claims or eligibility checks).
Privacy Officer	The person the Site Director designates to develop and run the site's privacy policies and to receive and handle privacy complaints and incidents. A covered entity must designate a privacy official (45 CFR 164.530(a)); a non-covered site designates one under this SOP.
Security Officer	The person the Site Director designates to develop and run the site's safeguards for electronic PHI and other electronic participant information. A covered entity must designate a security official (45 CFR 164.308(a)(2)); a non-covered site designates one under this SOP. May be the Privacy Officer.
Protected health information (PHI)	Individually identifiable health information held or transmitted by a covered entity or its business associate, in any form.
Business associate (BA)	A person or entity that creates, receives, maintains or transmits PHI on behalf of a covered entity for a function regulated by HIPAA (for example an EHR host, billing company, shredding vendor, cloud storage provider). Sponsors and CROs receiving data under an authorization are generally not business associates.
Authorization	A participant's signed permission for use and disclosure of PHI for research, containing the elements in 45 CFR 164.508(c).
Waiver or alteration of authorization	Approval by an IRB or privacy board, under 45 CFR 164.512(i), to use or disclose PHI for research without authorization or with an altered authorization.
Preparatory to research	Review of PHI to prepare a protocol or assess feasibility, under representations in 45 CFR 164.512(i)(1)(ii), with no PHI removed from the covered entity.
Minimum necessary	The standard requiring reasonable efforts to limit use, disclosure and requests of PHI to the minimum needed for the purpose (45 CFR 164.502(b) and 164.514(d)). It does not apply to disclosures made under an authorization.
De-identified information	Information that meets 45 CFR 164.514(b) by removal of the 18 listed identifiers with no actual knowledge that the remainder could identify the person (safe harbor), or by expert determination. It is not PHI.
Limited data set (LDS)	PHI with direct identifiers removed but which may include dates, city, state, ZIP code and ages, disclosed for research only under a data use agreement (45 CFR 164.514(e)).
Data use agreement (DUA)	The agreement required for a limited data set, limiting use, prohibiting re-identification and requiring safeguards.
Breach	Acquisition, access, use or disclosure of unsecured PHI in a manner not permitted by the Privacy Rule which compromises its security or privacy. It is presumed to be a breach unless a documented risk assessment shows a low probability of compromise (45 CFR 164.402).
Unsecured PHI	PHI not rendered unusable, unreadable or indecipherable to unauthorized persons through encryption or destruction meeting HHS guidance.
Part 2 record	A record of substance use disorder diagnosis, treatment or referral from a federally assisted Part 2 program, protected by 42 CFR Part 2.

5. Procedure

5.1 Determining the site's HIPAA status

5.1.1

The Site Director determines, with legal advice, whether [SITE NAME] is a covered entity and records the determination in the privacy policy. A site that bills insurers electronically for any clinical service, or is part of a medical practice that does, is a covered entity. A research-only site that never conducts HIPAA standard transactions may not be a covered entity.

5.1.2

If the site is part of a larger entity that also provides non-research care, the Site Director records whether the entity is a single covered entity, a hybrid entity with designated health care components, or an affiliated covered entity.

Network note: In Model N, the Network Office records the HIPAA status of the network, each Site Director records it for their site, and Appendix B records who holds each privacy role (Appendix B, SOP-400 rows). N-Integrated: if one legal entity owns all sites, the sites are one covered entity (or one hybrid entity). N-Integrated defaults apply only where the member site and the network entity are the same legal entity. A separate subsidiary, or a professional corporation under a management services arrangement, follows the N-Affiliated rows for PHI, direction of staff, contract signature, records custody and payments unless counsel confirms otherwise (SOP-900, 5.2.1). If the sites are legally separate covered entities under common ownership or control, they may designate themselves a single affiliated covered entity (45 CFR 164.105(b)); the designation is written and kept for six years. Sites that only take part in an organized health care arrangement (45 CFR 160.103) remain separate covered entities: the arrangement lets them share PHI for its joint health care operations (45 CFR 164.506(c)(5)), not for research. N-Affiliated: each member site is its own covered entity (or non-covered site) and makes its own determination under 5.1.1.

5.1.3

Whether or not the site is a covered entity, it applies the procedures in this SOP as site policy. Sponsors, IRBs and clinical trial agreements expect HIPAA-equivalent protections, ICH E6(R3) expects protection of participant privacy and confidentiality (Annex 1, 2.12.7), and state privacy laws may apply to entities HIPAA does not reach. In this SOP, "PHI" means identifiable participant health information held by the site, whether or not HIPAA applies to it.

5.1.4

The Site Director keeps a list of business associates with signed BAAs, managed through SOP-105.

5.1.5

If [SITE NAME] is not a covered entity, these differences apply, and the Privacy Officer records them in the privacy policy:

HIPAA authorization language is still used in the consent form, because participants' records usually come from covered entities (their physicians, hospitals and laboratories), which may release them to the site only under an authorization or another HIPAA pathway
waivers of authorization, preparatory-to-research representations and decedent representations (5.3) are given to the covered entity that holds the records, on that entity's form where it has one
vendors handling participant information sign a confidentiality and data security agreement under SOP-105 in place of a BAA, unless the vendor also serves a covered entity function for the site
the HIPAA breach notification deadlines in 5.10.5 do not apply by law; the site follows state breach notification law, the clinical trial agreement and IRB policy (5.10.7 and 5.10.8), and uses the same risk assessment on F-400-01
the accounting of disclosures in 5.3.6 does not apply by law; the Privacy Officer still logs disclosures made without authorization

5.2 Authorization for research

5.2.1

For each study, the Regulatory Coordinator confirms before first use that the IRB has approved a HIPAA authorization, either combined with the consent form or as a separate document, or has granted a waiver or alteration.

5.2.2

A research authorization may be combined with the consent form for the same study (45 CFR 164.508(b)(3)(i)). It must contain the core elements and required statements of 45 CFR 164.508(c):

a specific description of the information to be used or disclosed
who may use or disclose it (the site, the investigators)
who may receive it (sponsor, its agents, IRB, FDA and other regulators, named vendors)
the purpose of the use or disclosure
an expiration date or event, or a statement that there is none (permitted for research)
signature and date of the individual, or of the personal representative with a description of their authority
the right to revoke in writing, how to revoke, and the exceptions
whether treatment, payment, enrollment or eligibility may be conditioned on signing (research-related treatment may be conditioned on authorization)
that information disclosed may be redisclosed by the recipient and no longer protected by HIPAA

5.2.3

Central IRBs usually review authorization language with the consent form. The site does not add, delete or edit authorization language after IRB approval.

5.2.4

The CRC obtains the authorization at the consent visit, before any research-only use or disclosure of PHI, and gives the participant a copy. Where the authorization is a separate document, it is tracked with the consent form on F-301-02.

5.2.5

Optional research (future use, genetic testing, data sharing for other studies) requires authorization covering that use. The CRC checks the participant's choices before any disclosure.

5.2.6

If a participant revokes authorization in writing, the CRC records the revocation, notifies the PI and sponsor, and stops new disclosures except as the authorization permits (information already obtained may continue to be used and disclosed to the extent needed to protect the integrity of the research). Withdrawal of consent is handled under SOP-309.

5.3 Uses and disclosures without authorization

5.3.1

Waiver or alteration by an IRB or privacy board (45 CFR 164.512(i)(1)(i)): used for activities such as recruitment record reviews or chart reviews where authorization is impracticable. The Regulatory Coordinator files the IRB's waiver documentation, which must include the IRB's statement that the waiver criteria are met, a description of the PHI approved, the review procedure used, and the signature of the chair or designee. Staff use only the PHI the waiver describes.

5.3.2

Preparatory to research (45 CFR 164.512(i)(1)(ii)): used for feasibility and protocol planning (SOP-200). Before review, the PI signs a representation on file that the use is solely to prepare a protocol or similar purpose, no PHI will be removed from the covered entity, and the PHI is necessary for the purpose. For feasibility (SOP-200), staff record counts only and do not contact patients. Contacting patients identified through records review is recruitment and follows SOP-300, section 5.3: only workforce members of the covered entity that holds the records may contact patients under this provision; anyone else needs the treating provider to make the first contact or an IRB waiver.

5.3.3

Research on decedents (45 CFR 164.512(i)(1)(iii)): the PI signs representations that the use is solely for research on decedents' PHI and is necessary, and gives documentation of death if the covered entity requests it.

5.3.4

De-identified data: data sets meeting 45 CFR 164.514(b) may be shared without authorization. The site may assign a re-identification code (for example a participant ID) and keep the key, and the data can still be de-identified, provided the code is not derived from or related to information about the individual and cannot be translated to identify them, is not used or disclosed for any other purpose, and the key is not disclosed (45 CFR 164.514(c)). Data carrying such a code is de-identified only if no other identifier listed in 164.514(b)(2), including dates, is included. The Privacy Officer confirms de-identification before release.

5.3.5

Limited data sets: disclosed only for research, public health or health care operations under a signed DUA meeting 45 CFR 164.514(e)(4). The Site Director signs the DUA; the Regulatory Coordinator files it.

5.3.6

Accounting of disclosures: disclosures made under an IRB waiver, preparatory to research or decedent provisions, and other non-authorized disclosures such as to FDA outside an authorization, must be available for accounting on request (45 CFR 164.528). The Privacy Officer keeps a log of such disclosures or, for disclosures involving 50 or more individuals, the protocol list permitted by 164.528(b)(4).

Network note: In Model N, PHI moves between member sites, or between a site and the Network Office, only by a permitted pathway recorded on F-905-01 (SOP-905). N-Integrated (one covered entity or affiliated covered entity, subject to the same-legal-entity rule in the Network note to section 5.1): this is a use inside the entity and minimum necessary applies. N-Affiliated: it is a disclosure between entities and needs the participant's authorization naming the recipient, an IRB or privacy board waiver, a limited data set under a DUA, de-identified data, or a BAA for a service the Network Office performs for the site. Central feasibility and recruitment searches follow 5.3.2: a preparatory-to-research review leaves no PHI outside the covered entity that holds the records, so only counts go back to the Network Office.

5.4 Minimum necessary in daily work

5.4.1

Staff access, use and disclose only the PHI needed for the task. Examples:

sponsor-facing documents (CRFs, SAE reports, specimen requisitions, queries) use participant ID, not name, medical record number or full date of birth unless the protocol requires it
copies of medical records sent to a sponsor are prepared under section 5.4.1.1
screening logs sent to sponsors carry no direct identifiers
the participant identification log linking participant IDs to names stays at the site

5.4.1.1

This step is the single redaction rule for copies of participant records sent to sponsors, monitors, IRBs or auditors (paper, scanned, uploaded or certified copies, for example for SAE support, adjudication or remote review). SOP-501 5.5.2, SOP-600 5.3.4 and SOP-701 5.4.4 point to it and do not restate it.

the sender redacts name, address, telephone, email, Social Security number, medical record number, health plan and account numbers and any other direct identifier, unless the participant's consent and HIPAA authorization permit identified copies and the recipient's documented process requires them
the sender labels each page with the participant ID
a second staff member checks the redaction before sending [DEFAULT: required; where only one person is available, the sender re-checks against a printed checklist and records that]
the sender records what was sent, to whom, the date, the method and who checked it, in the study file (for example on F-501-01 for safety reports)
unredacted PHI sent in error is a privacy incident under section 5.10 (F-400-01)

5.4.2

Staff do not discuss participants in public areas, leave PHI visible on desks or screens, or take paper PHI off site except for home visits under SOP-313.

5.4.3

Paper PHI is stored in locked cabinets in access-controlled rooms. Electronic PHI is stored only in approved systems (SOP-401).

5.4.4

PHI is disposed of by cross-cut shredding, locked shred bins serviced by a vendor under a BAA (or, at a non-covered site, a confidentiality agreement), or secure electronic destruction (SOP-402).

5.5 Monitor, auditor and inspector access to medical records

5.5.1

Sponsor monitors and auditors may review source records, including the EHR, to the extent the participant's authorization and consent allow (ICH E6(R3) Annex 1, 2.8.10(o)). FDA inspectors may review records under 21 CFR 312.68 and 812.145.

5.5.2

EHR access for monitors is provided by one of these methods, chosen by the Site Director:

site staff operate the EHR on screen for the monitor (shoulder-to-shoulder)
certified copies of relevant records printed or exported to the study file (SOP-401)
a monitor-specific EHR account that is read-only, restricted to the monitor's study participants, time-limited, and audit-logged

5.5.3

Monitor accounts are never shared and never give access to non-participant records. Remote monitoring access follows SOP-600 and SOP-401.

5.5.4

The System Owner records each monitor account grant and removal on F-401-01, and the CRC records each visit on F-600-01. Accounts are deactivated when the access period ends.

5.6 Substance use disorder records (42 CFR Part 2)

5.6.1

If the site, or a program it is part of, holds itself out as providing substance use disorder diagnosis, treatment or referral and is federally assisted, its SUD records are Part 2 records. The Site Director records whether the site is a Part 2 program.

5.6.2

Part 2 records received from another program (for example for eligibility in an SUD study) carry redisclosure restrictions. Staff keep them segregated or flagged as the Privacy Officer directs and do not redisclose them except as Part 2 and the participant's consent permit.

5.6.3

The 2024 Part 2 final rule (compliance date 16 February 2026) aligned many Part 2 requirements with HIPAA, including a single consent for treatment, payment and health care operations and breach notification. Research disclosures of Part 2 records still need Part 2-compliant consent, an IRB or privacy board waiver meeting Part 2, or another Part 2 pathway. The Privacy Officer confirms the path before Part 2 records are used in a study.

5.7 State law

5.7.1

State law may give more protection than HIPAA, for example for HIV status, genetic information, mental health records, reproductive health information, minors' records, or consumer health data held by entities HIPAA does not cover. These rules are recorded in Appendix A for each state where the site operates or has participants.

5.7.2

Where state law is more protective than HIPAA, the site follows state law. The Quality Lead owns Appendix A (SOP-100). The Privacy Officer reviews its privacy rows at each annual review and when the site starts work in a new state.

5.8 Communicating with participants by email and text

5.8.1

Staff communicate with participants by email or text message only through site-approved accounts and platforms. Personal accounts and personal phones are not used for participant communication unless the Site Director has approved a managed device.

5.8.2

Before using unencrypted email or standard text messages, the CRC tells the participant that these channels carry some risk of interception and records the participant's preference on F-309-01 or in the contact record. Participants may ask for a different channel at any time.

5.8.3

Messages contain the minimum information needed (for example appointment date and time, a call-back request). They do not include study name if it reveals a condition, test results or diagnosis unless the participant has requested this and the channel is secure.

5.8.4

Automated text or call programs, and recruitment texts to people who are not yet participants, may be subject to the Telephone Consumer Protection Act and state telemarketing rules. The Site Director confirms consent requirements before launching such a program, and recruitment messages are IRB-approved (SOP-300).

5.8.5

Text and email exchanges that contain trial information (for example a participant reporting a symptom) are source. The CRC transcribes or files them in the research record the same day.

5.9.1

Photos, video or audio of participants are taken only where the protocol requires them (for example lesion photographs) or the participant gives separate written authorization for another approved purpose. Images are taken on site-controlled devices and stored only in approved systems, never on personal phones or in personal cloud accounts.

5.9.2

Protocol photographs are cropped to the area needed and labeled with participant ID, and exclude the face and identifying marks unless the protocol requires them.

5.9.3

Staff do not post, comment on or confirm any information about participants, prospective participants or study visits on social media, including indirectly (for example "busy day with three screenings for the migraine study"). Staff do not accept or send social media connection requests to or from participants through personal accounts.

5.9.4

Participant testimonials, photos or stories used in advertising need IRB approval as recruitment material and the participant's written authorization for that specific use.

5.9.5

If a participant posts about the study publicly, staff do not respond with study information. Possible unblinding or safety information in a participant post is passed to the PI.

5.10 Privacy incidents and breach assessment

5.10.1

Any staff member who suspects a privacy incident reports it to the Privacy Officer immediately and no later than [DEFAULT: the same business day]. Examples: misdirected email or fax, lost laptop or phone, PHI sent to the wrong sponsor, unauthorized EHR access, a lost specimen box with names, papers left in a public area, a hacked account.

5.10.2

The Privacy Officer opens F-400-01, takes immediate steps to contain the incident (for example recall the email, ask the recipient to delete and confirm in writing, disable an account, remote-wipe a device), and records each step with date and time.

5.10.3

The Privacy Officer determines whether a breach of unsecured PHI occurred. An impermissible use or disclosure is presumed to be a breach unless one of the regulatory exceptions applies or a documented risk assessment shows a low probability that the PHI has been compromised, based on at least:

the nature and extent of the PHI involved, including types of identifiers and likelihood of re-identification
the unauthorized person who used the PHI or to whom it was disclosed
whether the PHI was actually acquired or viewed
the extent to which the risk has been mitigated

5.10.4

The risk assessment, conclusion and supporting evidence are recorded on F-400-01 and reviewed by the Site Director, with legal advice where a breach is possible.

5.10.5

If a breach of unsecured PHI is confirmed and the site is a covered entity (a non-covered site follows 5.1.5 and 5.10.7):

affected individuals are notified in writing without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404), with the content the rule requires
if the breach involves more than 500 residents of a state or jurisdiction, prominent media outlets serving that area are notified within the same time limit (45 CFR 164.406)
HHS is notified: for breaches affecting 500 or more individuals, at the same time as individual notice; for fewer than 500, through the HHS portal no later than 60 days after the end of the calendar year in which the breach was discovered (45 CFR 164.408)
a breach is treated as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to any workforce member other than the person who committed it

5.10.6

If the site is acting as a business associate of another covered entity for the affected PHI, it notifies that covered entity as the BAA requires and within the outer limit of 60 days after discovery (45 CFR 164.410).

5.10.7

State breach notification laws may impose shorter timelines, different content or notice to the state attorney general. The Privacy Officer checks Appendix A for every state where affected individuals live.

5.10.8

The Privacy Officer notifies the sponsor of any incident involving trial data as the clinical trial agreement requires, and the Regulatory Coordinator reports to the IRB if the IRB's policy treats it as reportable (for example as an unanticipated problem or a breach of confidentiality) under SOP-502.

5.10.9

Incidents with a systemic cause are handled under SOP-703. The incident log is reviewed for trends at the quarterly quality review (SOP-700, 5.7.1).

5.11 Training and documentation

5.11.1

All staff complete HIPAA and privacy training at hire, before accessing PHI, and [DEFAULT: annually]. Training is recorded on F-103-01.

5.11.2

Privacy policies, authorizations, waivers, representations, DUAs, BAAs, incident reports, risk assessments and notifications are retained for at least six years from creation or last effective date (45 CFR 164.530(j)), or longer if SOP-402 requires.

5.11.3

Where [SITE NAME] is a covered entity, the Security Officer performs and documents a HIPAA Security Rule risk analysis of electronic PHI (45 CFR 164.308(a)(1)(ii)(A)) at adoption of this SOP and [DEFAULT: annually], and before a new site-deployed system holding electronic PHI goes live (SOP-401). The analysis and the resulting risk management plan are retained under section 5.11.2.

F-400-01 Privacy Incident Report
F-301-02 Consent Form Version Control Log
F-309-01 Participant Contact and Retention Log
F-401-01 Computerized System Inventory and Access Log
F-600-01 Monitoring Visit Log
F-103-01 Staff Training Log
F-105-01 Service Provider Qualification and Oversight Record
SOP-105 Oversight of Service Providers and Vendors
SOP-200 Study Feasibility and Selection
SOP-300 Participant Recruitment, Pre-Screening and Advertising
SOP-301 Informed Consent Process and Documentation
SOP-309 Participant Retention, Withdrawal and Lost to Follow-Up
SOP-313 Decentralized Trial Elements
SOP-401 Computerized Systems and Electronic Records
SOP-402 Record Retention, Archiving and Destruction
SOP-502 Unanticipated Problems and Reportable New Information
SOP-600 Sponsor Monitoring Visits
SOP-703 Corrective and Preventive Action (CAPA)
Appendix A State Law Worksheet
SOP-905 Network Data, Systems, Privacy and Records Across Sites (Model N only)
SOP-903 Network Oversight of Member Sites (Metrics, Central QA, Escalation) (Model N only)
Appendix B Central and Site Responsibility Matrix (Model N only)

7. References

Reference	Title
45 CFR 160 and 164	HIPAA Administrative Simplification (Privacy, Security and Breach Notification Rules)
45 CFR 164.502(b) and 164.514(d)	Minimum necessary
45 CFR 164.508	Uses and disclosures for which an authorization is required
45 CFR 164.512(i)	Uses and disclosures for research purposes (waiver, preparatory to research, decedents)
45 CFR 164.514(a), (b) and (e)	De-identification; limited data set and data use agreement
45 CFR 164.528	Accounting of disclosures
45 CFR 164.400 to 164.414	Notification in the case of breach of unsecured PHI
45 CFR 164.530(a) and 164.308(a)(2)	Designation of privacy official and security official
45 CFR 164.530(j)	Documentation retention (six years)
42 CFR Part 2	Confidentiality of Substance Use Disorder Patient Records (final rule Feb 2024; compliance 16 Feb 2026)
21 CFR 50.25(a)(5)	Consent element: confidentiality of records and FDA inspection
ICH E6(R3) Annex 1, 2.8.10(o) and (p)	Consent information on direct access and confidentiality
ICH E6(R3) Annex 1, 2.12.7	Protection of privacy and confidentiality of personal information
47 U.S.C. 227	Telephone Consumer Protection Act

Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.

1. Purpose

2. Scope

3. Responsibilities

4. Definitions

5. Procedure

5.1 Determining the site's HIPAA status

5.2 Authorization for research

5.3 Uses and disclosures without authorization

5.4 Minimum necessary in daily work

5.5 Monitor, auditor and inspector access to medical records

5.6 Substance use disorder records (42 CFR Part 2)

5.7 State law

5.8 Communicating with participants by email and text

5.9 Photographs, recordings and social media

5.10 Privacy incidents and breach assessment

5.11 Training and documentation

6. Related Forms and SOPs

7. References