Prescreening before consent is permitted: the HIPAA and IRB rules for chart review

Federal rules allow research sites to review medical records for potential trial participants before a patient signs a consent form or HIPAA authorization. The HIPAA Privacy Rule offers two routes: a review preparatory to research, which rests on three representations from the researcher, and a waiver of authorization by an IRB or privacy board, which may be partial and limited to recruitment (45 CFR 164.512(i)). The revised Common Rule separately lets an IRB approve screening through record access without informed consent (45 CFR 46.116(g)). FDA has no equivalent provision and requires consent before any clinical procedure performed solely to determine eligibility (FDA).

Each route sets conditions on who reviews records, what leaves the covered entity and who contacts the patient, and software adds a business associate agreement. Because these conditions can be settled in advance, uncertainty about the rules need not leave eligible patients unscreened.

HIPAA offers two pathways for review before authorization

The Privacy Rule, which binds covered entities such as hospitals and practices, permits research uses and disclosures without authorization in defined circumstances (45 CFR 164.512(i)). In a review preparatory to research, the covered entity obtains representations from the researcher, “either in writing or orally” (HHS OCR), that the review is solely to prepare a protocol or for similar preparatory purposes, that no protected health information (PHI) will be removed from the covered entity, and that the PHI is necessary for the research. OCR has said remote access is not itself a removal of PHI, whereas printing, copying, saving or data scraping by an outside researcher would be (HHS OCR).

Alternatively, an IRB or privacy board may approve an alteration or waiver of authorization “in whole or in part.” The board must find that the use poses no more than minimal risk to privacy, backed by plans to protect and destroy identifiers and written assurances against reuse, and that the research could not practicably be conducted without the waiver or without the PHI. Its signed documentation must briefly describe the PHI found necessary (45 CFR 164.512(i)(2)). OCR describes the partial waiver as a recruitment tool: an IRB that does not waive authorization for the study itself may still waive it “as necessary for the researcher to be able to contact and recruit individuals into the study” (HHS OCR FAQ).

Who may contact patients depends on who did the review

Under OCR’s guidance, a researcher who is an employee or other workforce member may use PHI from a preparatory review to identify prospective participants and contact them to seek their authorization. An outside researcher may not use that provision to contact patients and “could obtain contact information through a partial waiver” instead. Treating clinicians may discuss trial enrollment with their own patients without authorization or a waiver (HHS OCR FAQ). In workflow terms, a staff coordinator who reviews charts and calls patients fits the preparatory provision, whereas contact by an outside party calls for a partial waiver.

The minimum necessary standard limits what each review touches

Covered entities must make “reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose” (45 CFR 164.502(b)). None of the listed exceptions covers research conducted without an authorization. Internally, the covered entity must define which workforce members need access to which categories of PHI, and it may not use an entire medical record unless that is specifically justified; for disclosures, it may reasonably rely on compliant research documentation or representations as defining the minimum necessary (45 CFR 164.514(d)). For prescreening, this becomes a design question: which records, data elements and patients the review needs to apply a protocol’s criteria.

The Common Rule and FDA regulations address consent separately

The Common Rule and FDA regulations govern human subject protections, including consent, and OCR calls their provisions “similar to, but separate from” the Privacy Rule’s (HHS OCR), so each applicable framework must be satisfied.

For research conducted, supported or otherwise regulated by a federal department or agency (45 CFR 46.101), the revised Common Rule lets an IRB approve research in which an investigator obtains information “for the purpose of screening, recruiting, or determining the eligibility of prospective subjects” without informed consent, either by communicating with the prospective subject or by accessing records or stored identifiable biospecimens (45 CFR 46.116(g)). Unlike the general waiver in 46.116(f), paragraph (g) does not require findings on minimal risk and practicability.

FDA’s regulations have no counterpart, and in a 2022 proposal to harmonize its rules with the Common Rule, FDA declined to add one “at this time.” It cited a longstanding policy that some preparatory activities, such as “a survey of patient records at a site” to judge feasibility, have generally not required consent or IRB review, whereas consent and IRB review must precede “any clinical screening procedure that is performed solely for the purpose of determining eligibility” (FDA). FDA guidance adds that a medication wash-out in preparation for research is part of the research, that results of routine-care procedures may be used for eligibility without consent, and that screening procedures and recruitment methods are subject to IRB review (FDA; FDA). The proposal remains unfinalized; the regulatory agenda lists final action for July 2027 (OIRA).

Software adds a business associate to the data flow

A vendor that creates, receives, maintains or transmits PHI on a covered entity’s behalf, for functions such as “data analysis,” generally meets HIPAA’s definition of a business associate (45 CFR 160.103). The covered entity must document its assurances in a written agreement (45 CFR 164.502(e)) that sets permitted uses, requires safeguards, Security Rule compliance and breach reporting, binds subcontractors and provides for return or destruction of PHI. The agreement may not authorize a use that would violate the Privacy Rule if the covered entity made it (45 CFR 164.504(e)), so a vendor can do no more than the covered entity’s research pathway allows. Business associates are directly liable for Security Rule compliance and for limiting PHI to the minimum necessary (HHS OCR). Whether a vendor-hosted review meets the preparatory provision’s no-removal condition, or a waiver fits better, is a question for the privacy office.

The Security Rule amendments HHS proposed in January 2025 (Federal Register), including annual verification of business associates’ safeguards, remain proposals; HHS states that the current rule remains in effect (HHS OCR), and the regulatory agenda lists final action for July 2027 (OIRA). A 2021 Privacy Rule proposal on care coordination, listed for final action in August 2026 (OIRA), had not appeared as a final rule by early November 2026 (Federal Register).

State law can add conditions, because HIPAA does not preempt a more stringent state privacy law (45 CFR 160.203). California’s Confidentiality of Medical Information Act, for example, permits disclosure to clinical investigators for bona fide research but bars recipients from further disclosing it in a way that would identify a patient (Cal. Civ. Code 56.10(c)(7)).

What to confirm with the IRB and privacy office

Before software prescreening begins, a site should have written answers to six questions:

1. Which HIPAA pathway applies (a preparatory review, a full or partial waiver, or both), whether the IRB has approved screening under 46.116(g) for Common Rule studies, and whether state law adds conditions.
2. Who will contact identified patients, how, and whether that person’s relationship to the covered entity fits the chosen pathway.
3. Which records, data elements and patients the review will touch, consistent with the minimum necessary standard.
4. Where PHI is processed and stored, and whether any leaves the covered entity’s environment.
5. Whether a business associate agreement covers prescreening, subcontractors and return or destruction of data.
6. What audit trail the system keeps, beyond the Security Rule’s requirement to “record and examine activity” in systems containing electronic PHI (45 CFR 164.312(b)), including who reviewed each candidate and what was decided.

Where Centrova’s platform fits

Centrova’s platform reviews the clinical notes and documents a site already holds and checks each patient against the inclusion and exclusion criteria of open trials. It works across disease areas and with multiple EHR systems. Coordinators and investigators review the candidates and make the final eligibility determination, and the platform includes patient tracking, communication and site coordination tools. Testing is free during development, and sites can contact us.

This post is general information, not legal or regulatory advice.

Sources

1. U.S. Department of Health and Human Services. 45 CFR 164.512, Uses and disclosures for which an authorization or opportunity to agree or object is not required (paragraph (i), research). Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512
2. U.S. Department of Health and Human Services. 45 CFR 164.502, Uses and disclosures of protected health information: general rules. Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
3. U.S. Department of Health and Human Services. 45 CFR 164.504, Uses and disclosures: organizational requirements. Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504
4. U.S. Department of Health and Human Services. 45 CFR 164.514, Other requirements relating to uses and disclosures of protected health information. Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
5. U.S. Department of Health and Human Services. 45 CFR 164.312, Technical safeguards. Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312
6. U.S. Department of Health and Human Services. 45 CFR 160.103, Definitions. Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
7. U.S. Department of Health and Human Services. 45 CFR 160.203, General rule and exceptions (preemption of state law). Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-B/section-160.203
8. U.S. Department of Health and Human Services. 45 CFR 46.101, To what does this policy apply? Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46/subpart-A/section-46.101
9. U.S. Department of Health and Human Services. 45 CFR 46.116, General requirements for informed consent. Electronic Code of Federal Regulations. Accessed November 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46/subpart-A/section-46.116
10. HHS Office for Civil Rights. Research. Content last reviewed September 30, 2026. https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
11. HHS Office for Civil Rights. 21st Century Cures Act Guidance: Remote Access to PHI for Activities Preparatory to Research. https://www.hhs.gov/sites/default/files/remote-access-research-12-15-17.pdf
12. HHS Office for Civil Rights. FAQ: Can the preparatory research provision of the HIPAA Privacy Rule at 45 CFR 164.512(i)(1)(ii) be used to recruit individuals into a research study? Last updated March 14, 2006; content last reviewed December 28, 2022. https://www.hhs.gov/hipaa/for-professionals/faq/317/can-the-prepatory-research-provision-be-used-to-recruit-individuals-to-a-research-study/index.html
13. HHS Office for Civil Rights. Direct Liability of Business Associates (fact sheet). Content last reviewed July 16, 2021. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/factsheet/index.html
14. HHS Office for Civil Rights. HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information (fact sheet). December 27, 2024. https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html
15. HHS Office for Civil Rights. HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule). Federal Register. January 6, 2025;90 FR 898. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
16. Office of Information and Regulatory Affairs. Unified Agenda, RIN 0945-AA22: HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information. 2026 edition. https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22
17. Office of Information and Regulatory Affairs. Unified Agenda, RIN 0945-AA00: HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens. 2026 edition. https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA00
18. Office of Information and Regulatory Affairs. Unified Agenda, RIN 0910-AI07: Protection of Human Subjects and Institutional Review Boards. 2026 edition. https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0910-AI07
19. Federal Register. Documents affecting 45 CFR part 164, newest first (API search results). Accessed November 2026. https://www.federalregister.gov/api/v1/documents.json?conditions[cfr][title]=45&conditions[cfr][part]=164&order=newest
20. Food and Drug Administration. Protection of Human Subjects and Institutional Review Boards (proposed rule). Federal Register. September 28, 2022;87 FR 58733. https://www.federalregister.gov/documents/2022/09/28/2022-21088/protection-of-human-subjects-and-institutional-review-boards
21. Food and Drug Administration. Screening Tests Prior to Study Enrollment: Information Sheet, Guidance for Institutional Review Boards and Clinical Investigators. January 1998. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/screening-tests-prior-study-enrollment-information-sheet
22. Food and Drug Administration. Recruiting Study Subjects: Information Sheet, Guidance for Institutional Review Boards and Clinical Investigators. January 1998. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/recruiting-study-subjects
23. State of California. Civil Code section 56.10 (Confidentiality of Medical Information Act), as amended by Stats. 2025, Ch. 123. Reproduced in Justia, 2025 California Code. https://law.justia.com/codes/california/code-civ/division-1/part-2-6/chapter-2/section-56-10