1. HIPAA Authorization
  2. HIPAA Authorization (Spanish)
  3. HIPAA Child Authorization
  4. HIPAA Child Authorization (Spanish)
  5. HIPAA Waiver


All investigators must use the HIPAA authorization form. The study HIPAA form requires IRB review and must be stamped by the IRB. Please submit the study HIPAA form along with your PSF and other study materials in PRISM.

Along with the study consent form, research participants must sign a HIPAA authorization and receive a Notice of Privacy Practices (NPP), or the researcher will obtain a HIPAA Waiver of Authorization from the IRB.  All of these forms are available below.

PLEASE NOTE, a fillable HIPAA form is available on the NSYPI Intranet. To access the NYSPI Intranet, please go to the NYPSI.org site, then For Employees and Staff. The left column menu bar offers NYSPI Intranet. Once you are on the NYSPI Intranet site, the right column Quick Links offers HIPAA. On the HIPAA page the right column the third bullet point under HIPAA/Privacy Rescources links to the fillable form.

Protected Health Information (PHI) - 18 HIPAA Identifiers

1. Name

2. Geographic subdivisions - smaller than a state (e.g., street address, city, county, etc.)

3. All elements of dates - (except year) for any date directly related to an individual, including dates for birth, admission, discharge, and death, and all ages over 89.

4. Telephone numbers

5. Fax numbers

6. Electronic email addresses

7. Social Security number

8. Medical record numbers

9. Health plan beneficiary numbers

10. Account numbers

11. Certificate/license numbers

12. Vehicle identifiers - license plates and serial numbers

13. Device identifiers and serial numbers

14. Web URLs

15. Biometric identifiers - including genetic information, finger, or voice prints

16. Full face photographic images and any comparable images

17. Internet Protocol (IP) address numbers

18. Any other unique identifying number - characteristic or code that is derived from or related to the individual (e.g., initials, etc.)

Considerations for Phone Screens

   Persons who are participating in a telephone screening must also receive HIPAA information.

  • Describe what Personal Health Information (PHI) is being asked for during the telephone screening
  • Describe how information will be used by the researchers
  • Describe who else will receive the information (sponsor, government agency, etc.)
  • Tell the persons whether their PHI will be kept if they choose not to enroll in the study or if they do not qualify to be in the study.  If applicable, ask permission to retain the information that you collect (e.g., in a database)
  • For those participants who will not be seen in person - Tell the person that they can change their mind about participating in the research, even after they have agreed to do so, and tell them who to call if they want to drop out.  Otherwise, any information that has been collected may be used.
  • For participants who will be seen in person after the telephone screening - Tell the person that they will be given a consent form and a HIPAA Authorization form which will allow you to use or disclose their PHI.

NYSPI Intranet

   Additional information about the HIPAA regulations and a fillable HIPAA form are available on the NYSPI Intranet only available within NYSPI.


   The Institutional Privacy Officer at Kimberly.Leitch@nyspi.columbia.edu if you have any questions.