# HIPAA (45 CFR Part 164) 164.512(i)(2) — Uses and disclosures for research purposes - Documentation of Waiver Approval

- Source: https://support.icompaas.com/compliance/hipaa/164-512-i-2-uses-and-disclosures-for-research-purposes-documentation-of-waiver-approval
- Section: [Compliance](https://support.icompaas.com/compliance) › [HIPAA Security, Privacy & Breach-Notification Rules](https://support.icompaas.com/compliance/hipaa) › Privacy Rule — §164.512
- Last updated: 2026-06-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**HIPAA (45 CFR Part 164)**·§ `164.512(i)(2)`·medium·Component: **Privacy Rule**

## What this control requires

> Standard: Uses and disclosures for research purposes (2) Documentation of waiver approval. For a use or disclosure to be permitted based on documentation of approval of an alteration or waiver, under paragraph (i)(1)(i) of this section, the documentation must include all of the following: (i) Identification of IRB or date of action - A statement identifying the institutional review board or privacy board and the date on which the alteration or waiver of authorization was approved; (ii) Waiver criteria - A statement that the institutional review board or privacy board has determined that the alteration or waiver, in whole or in part, of authorization satisfies the following criteria: (A) The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements; (1) An adequate plan to protect the Identifiers from improper use and disclosure; (2) An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and (3) Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by this subpart; (B) The research could not practicably be conducted without the waiver or alteration; and (C) The research could not practicably be conducted without access to and use of the protected health information. (iii) Protected health information needed - A brief description of the protected health information for which use or access has been determined to be necessary by the institutional review board or privacy board, pursuant to paragraph (i)(2)(ii)(C) of this section; (iv) Review and approval procedures - A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures, as follows: (A) An institutional review board must follow the requirements of the Common Rule, including the normal review procedures or the expedited review procedures: 7 CFR 1c.108(b), 10 CFR 745.108(b), 14 CFR 1230.108(b), 15 CFR 27.108(b), 16 CFR 1028.108(b), 21 CFR 56.108(b22 CFR 225.108(b), 24 CFR 60.108(b), 28 CFR 46.108(b), 32 CFR 219.108(b), 34 CFR 97.108(b),38 CFR 16.108(b), 40 CFR 26.108(b), 45 CFR 46.108(b), 45 CFR 690.108(b), or 49 CFR 11.108(b)) or the expedited review procedures (7 CFR 1c.110, 10 CFR 745.110, 14 CFR 1230.110, 15 CFR27.110, 16 CFR 1028.110, 21 CFR 56.110, 22 CFR 225.110, 24 CFR 60.110, 28 CFR 46.110, 32 CFR 219.110, 34 CFR 97.110, 38 CFR 16.110, 40 CFR 26.110, 45 CFR 46.110, 45; (B) A privacy board must review the proposed research at convened meetings at which a majority of the privacy board members are present, including at least one member who satisfies the criterion stated in paragraph (i)(1)(i)(b)(2) of this section, and the alteration or waiver of authorization must be approved by the majority of the privacy board members present at the meeting, unless the privacy board elects to use an expedited review procedures in accordance with paragraph (i)(2)(iv)(C) of this section; (C) A privacy board may use an expedited review procedure if the research involves no more than minimal risk to the privacy of the individuals who are the subject of the protected health information for which use or disclosure is being sought. If the privacy board elects to use an expedited review procedure, the review and approval of the alteration or waiver of authorization may be carried out by the chair of the privacy board, or by one or more members of the privacy board as designated by the chair; and (v) Required signature - The documentation of the alteration or waiver of authorization must be signed by the chair or other member, as designated by the chair, of the institutional review board or the privacy board, as applicable.
> 
> — HIPAA (45 CFR Part 164), § 164.512(i)(2)

### In plain English

Standard: Uses and disclosures for research purposes (2) Documentation of waiver approval. In practice, this means you can prove you information requirements-level controls on a defined cadence.

## Why it matters

HIPAA non-compliance is a strict-liability matter: OCR civil monetary penalties are assessed per-record per-violation (up to USD 1.9 million per identical-violation calendar year as of 2024), and willful neglect can trigger criminal referral.

## What an auditor looks for

HHS OCR investigators and SOC-2+HIPAA auditors look for the specific 45 CFR § citation, whether the safeguard is required vs addressable (and if addressable, the documented decision), the implementation specification, the workforce member responsible, and the records that show it runs.

Within **Privacy Rule**, the assessor will trace your implementation back to the catalogue reference (§ 164.512(i)(2)) and look for objective evidence on the latest two assessment cycles.

## How to implement

#### Policy Management

**Docs.** Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

### Operational checklist

-   **Information.** Document the trigger, the owner and the cadence.
-   **Person.** Document the trigger, the owner and the cadence.
-   **Other.** Document the trigger, the owner and the cadence.
-   **Requirements.** Document the trigger, the owner and the cadence.
-   **Policy.** Document the trigger, the owner and the cadence.
-   **Scope:** requirements, management, procedures, individuals, policy, i, accordance, section.

## Evidence to collect

-   **Policy Document.** A signed and version-controlled policy / standard / procedure document.

Signed policy or standard documents the safeguard. Focus: Uses and disclosures for research purposes - Documentation of Waiver Approval.

## Common pitfalls

-   Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

## How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

-   [**NIST SP 800-53 Rev. 5 PS-1** — Policy And Procedures](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/ps-1-policy-and-procedures)

## Related controls in HIPAA (45 CFR Part 164)

-   [**§ 164.512(i)(1)** — Uses and disclosures for research purposes - Permitted Uses and Disclosures](https://support.icompaas.com/compliance/hipaa/164-512-i-1-uses-and-disclosures-for-research-purposes-permitted-uses-and-disclosures)
-   [**§ 164.514(d)(1)** — Minimum necessary requirements - standard](https://support.icompaas.com/compliance/hipaa/164-514-d-1-minimum-necessary-requirements-standard)
-   [**§ 164.514(d)(2)** — Minimum necessary requirements - implementation specifications](https://support.icompaas.com/compliance/hipaa/164-514-d-2-minimum-necessary-requirements-implementation-specifications)
-   [**§ 164.502(h)** — Confidential communications](https://support.icompaas.com/compliance/hipaa/164-502-h-confidential-communications)
-   [**§ 164.514(d)(3)** — Minimum Necessary - Disclosures of PHI](https://support.icompaas.com/compliance/hipaa/164-514-d-3-minimum-necessary-disclosures-of-phi)
-   [**§ 164.520(c)(2)** — Provisions of Notice - Certain Covered Health Care Providers](https://support.icompaas.com/compliance/hipaa/164-520-c-2-provisions-of-notice-certain-covered-health-care-providers)

## References

-   [U.S. HHS Office for Civil Rights — HIPAA (45 CFR Part 164)](https://www.hhs.gov/hipaa/for-professionals/index.html)
-   Catalogue identifier: `§ 164.512(i)(2)`

Topics: governance riskpolicy management

## Related compliance guidance

- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): Start with the full HIPAA implementation guide — scope, roadmap, evidence and how the assessment runs.
- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most covered-entity customers accept a SOC 2 Type II report as the independent evidence that your HIPAA controls operate, since no HIPAA attestation exists.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): NIST publishes mappings of the Security Rule standards and implementation specifications to SP 800-53 Rev. 5 controls alongside SP 800-66 Rev. 2, so an 800-53 control set doubles as a HIPAA crosswalk.