DHA Home About DHA Human Resources Contact Us FOIA Site Map
Skip Navigation LinksDHA Home > Clinical Operations and Patient Care > TMA Privacy Office > The Difference Between the HIPAA Privacy Rule and Common Rule
Infinite Menus, Copyright 2006, OpenCube Inc. All Rights Reserved.

The Difference Between the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, also known as the “Privacy Rule,” and the Federal Policy for the Protection of Human Subjects, also known as the “Common Rule”

Researchers seeking to access and/or obtain Military Health System data for research purposes must adhere to the separate and distinct requirements within the Common Rule and the Privacy Rule. The chart and narrative below set forth the primary differences between the two applicable regulations.

  The Common RuleThe HIPAA Privacy Rule
Federal Regulation Protection for Human Subjects (45 CFR 46) HIPAA Privacy Rule(45 CFR 160 and 164)
Department of Defense (DoD) Implementing Regulation Protection of Human Subjects (32 CFR 219); Protection of Human Subjects and Adherence to Ethical Standards in DoD-Supported Research (DoDI 3216.02) DoD Health Information Privacy Regulation (DoD 6025.18-R)
Primary Purpose Protect individuals who are the subject of research projects. Consideration is given to how various aspects of the research project, including privacy, confidentiality, data collection, data maintenance and data retention, impact physical, emotional, financial, and informational harms Protect individuals against information harm while allowing the necessary flow of health information with specific rules pertaining to the privacy and security of protected health information (PHI)
Threshold Requirement Informed consent from each research participant (oral and/or written) HIPAA Authorization from each research participant (must be written and signed)
Enforcement Office for Human Research Protections, United States Department of Health and Human Service (HHS), and DoD Assistant Secretary of Defense for Research and Engineering Office for Civil Rights, HHS
Administration Institutional Review Boards (IRBs) IRBs or HIPAA Privacy Boards
Exemptions Human Research Protection Officials (HRPOs) and/or IRBs can exempt certain research projects from IRB review in accordance with 32 CFR 219.101(b) None. All research projects seeking PHI from a HIPAA covered entity, including TRICARE Management Activity (TMA), must comply with the HIPAA Privacy Rule

Despite common misconceptions, research studies must comply with both the Common Rule and the HIPAA Privacy Rule when PHI is sought from a HIPAA covered entity, such as TMA. Although the Common Rule enables certain research projects to be exempt from IRB review, HIPAA Privacy Rule review and documentation is still required, even of exempt projects, before PHI can be used and/or disclosed. Furthermore, the requirements of informed consent are separate and distinct from those of a HIPAA Authorization. An informed consent can be joined with a HIPAA Authorization for research purposes, known as a “Compound Authorization” under the Privacy Rule. HIPAA Authorizations or Compound Authorizations are required to be reviewed for compliance with the HIPAA Privacy Rule.

“On October 1, 2013, the Department of Defense established the Defense Health Agency (DHA) to manage the activities of the Military Health System. These activities include those previously managed by TRICARE Management Activity (TMA), which was disestablished on the same date. During the next several months, all TMA websites will change to reflect the new DHA. We appreciate your patience during this transition."
DoD Seal
7700 Arlington Boulevard, Suite 5101, Falls Church, VA 22042-5101
The appearance of hyperlinks to external Web sites does not constitute endorsement by the TRICARE Management Activity of these Web sites or the information, products or services contained therein. For other than authorized government activities, TRICARE Management Activity does not exercise any editorial control over the information you may find at other locations. Such links are provided consistent with the stated purpose of this DoD Web site. Accessibility/Section 508