They are often printed in the same packet and signed in the same minute, which is why people treat them as one thing. They come from different rules, answer different questions and can be handled differently, for example when a participant withdraws.
Free sandbox · No credit card · 21 CFR Part 11 aligned
| HIPAA authorization | Informed consent | |
|---|---|---|
| Answers | May my health information be used or disclosed for this? | Do I agree to take part, knowing the risks? |
| Rule | HIPAA Privacy Rule, 45 CFR 164.508 | Common Rule 45 CFR 46 and/or FDA 21 CFR 50 |
| Applies to | Covered entities and their PHI | The research participation itself |
| Withdrawal | Written revocation; past use stays | Participant may stop at any time |
The short answer
The core difference
Informed consent is about participation. The participant is told what the study is for, what will be done, the risks, the benefits, alternatives and that taking part is voluntary, and then decides. It protects autonomy and safety, and it is overseen by an IRB.
A HIPAA authorization is about information. It governs whether a covered entity, such as a hospital or clinic, may use or disclose a person’s identifiable health information for a stated purpose. It protects privacy, and the compliance responsibility sits with the covered entity.
A study can need one, the other or both. Consent without authorization can leave a hospital unable to release records to the study team. Authorization without consent says nothing about whether the person agreed to be in the study. They also behave differently when someone withdraws, covered below.
What each document must contain
Element lists below summarize 45 CFR 164.508(c) and 21 CFR 50.25 as commonly described. Check the current regulation text; the Common Rule list at 45 CFR 46.116 is similar to the FDA list but not identical.
| Topic | HIPAA authorization (164.508) | FDA informed consent (21 CFR 50.25) |
|---|---|---|
| What it describes | A specific, meaningful description of the information to be used or disclosed | That the study involves research, its purposes, the duration and the procedures, including which are experimental |
| Who | Who may use or disclose it, and who may receive it | Contact people for questions, rights and injury |
| Purpose | The purpose of the use or disclosure | Purposes of the research |
| Time limit | An expiration date or event; for research, commonly stated as "end of the research study" or "none" (check 164.508(c)(1)(v)) | Expected duration of participation |
| Signature | Signature and date; authority statement if signed by a representative | Signature and date under 50.27 (documentation) |
| Right to withdraw | Statement of the right to revoke in writing, and how | Participation is voluntary; the subject may discontinue at any time without penalty |
| Conditioning | Whether treatment, payment, enrolment or eligibility can be conditioned on signing | Not applicable in the same way |
| Redisclosure | Warning that disclosed information may be redisclosed and no longer protected by HIPAA | Confidentiality statement, including that FDA may inspect records |
| Risks and benefits | Not required | Reasonably foreseeable risks, expected benefits, alternatives |
| Compensation for injury | Not required | For more than minimal risk, whether compensation or treatment is available |
| Plain language and copy | Written in plain language; a copy goes to the individual | Understandable language; a copy goes to the person signing |
Element lists were summarized from secondary sources and general knowledge; confirm exact wording and current numbering in the eCFR before using it.
Combining the documents
The Privacy Rule generally prohibits combining an authorization with other documents, but it has an exception for research. A research authorization may be combined with another written permission for the same or another research study, including the consent to participate. This is why many consent forms include a HIPAA section.
Combining has a practical advantage: one document, one signature. It also has risks. If a research-related treatment is conditioned on the authorization, the Privacy Rule requires a compound authorization to differentiate the conditioned parts from optional ones, for example a separate optional repository. And if the consent form changes (a new risk, a new site), the authorization section may need a fresh look as well.
Many institutions keep the documents separate for exactly these reasons, or use a standard institutional template. Ask your IRB and privacy office which approach they require; do not decide it from a blog post, including this one.
A participant who withdraws from a study can usually stop taking part at any time. A participant who revokes a HIPAA authorization must do so in writing, and the revocation does not undo uses that already took place in reliance on the authorization. Study teams commonly keep data already collected, subject to the consent form and IRB rules. A compound form should say clearly whether a revocation applies to both components or only one.
Other pathways
| Situation | What may apply | Who decides |
|---|---|---|
| Study cannot practicably be done with authorization (for example a large chart review) | A waiver or alteration of authorization (164.512(i)) | IRB or privacy board |
| Preparatory review to design a study | Reviews preparatory to research, with representations from the researcher | Covered entity |
| Data with direct identifiers removed | A limited data set with a data use agreement | Covered entity |
| Information de-identified under HIPAA standards | No longer PHI under the rule | Covered entity or expert determination |
| A researcher who is not part of a covered entity and collects data directly | HIPAA may not apply; other rules (Common Rule, FDA, state law, GDPR) still do | Counsel and IRB |
Whether HIPAA applies at all depends on whether a covered entity is involved. Outside the US, consent and data protection are governed by different rules; see [HIPAA vs GDPR for clinical trial data](/solutions/hipaa-vs-gdpr-clinical-trial-data).
In practice
Capture’s eConsent module lets participants sign on screen, with an email one-time-passcode check, countersignature by authorized site staff and a signed PDF that carries the timestamps and audit trail. Capture does not write HIPAA authorization language or decide whether an authorization is required. Use text approved by your IRB and privacy office, whether combined with the consent or a separate document.
Meaning of signature
I have reviewed this adverse event and confirm the assessment of seriousness, severity and causality.
Signer
Dr. A. Ozola, PI
Password
••••••••••
Start from a consent template, send yourself the link and sign as a participant in the free sandbox.
Before you submit
If sites are hospitals or clinics that hold PHI, HIPAA is likely in play.
Common Rule, FDA, or both. Ask your IRB.
The privacy office or IRB decides; document the decision.
Follow your institution’s template; ensure every required element is present.
State the event or "none" as the rule allows for research.
Repository or future-use choices separated from the required part.
In writing, to whom, and what happens to data already collected.
Both documents, in the version signed.
No. Informed consent is agreement to take part in research, from the Common Rule and/or FDA regulations. A HIPAA authorization is permission for a covered entity to use or disclose protected health information, from 45 CFR 164.508. They can be combined in one document but serve different purposes.
For research, generally yes: the Privacy Rule has an exception that allows a research authorization to be combined with other written permissions, including consent to participate. Conditioned and unconditioned components must be clearly differentiated. Check your institution’s policy.
No. It depends on whether a covered entity is disclosing PHI. An IRB or privacy board can waive or alter the requirement in defined circumstances, and de-identified data or a limited data set may follow other rules.
Yes, in writing. The revocation does not reverse uses already made in reliance on the authorization. Exceptions and procedures should be explained in the form.
It must have an expiration date or event. For research, the Privacy Rule allows an event such as the end of the research study, or in some cases none. Confirm the exact allowance in the current regulation text.
No. FDA’s Part 50 governs informed consent. HIPAA is a separate rule that applies to covered entities. A FDA-regulated study with a covered-entity site will usually deal with both.
No. Capture records signed consent electronically and keeps an audit trail. Authorization language should come from your IRB and privacy office. Consent templates in the library are starting points for IRB review, not legal documents.
No. It is a general explainer. Rules vary by institution, state and study. Confirm with your privacy officer, IRB and counsel.
Keep exploring
HIPAA-compliant clinical trial software
What HIPAA-ready tooling means.
HIPAA vs GDPR for clinical trial data
Two privacy regimes compared.
21 CFR Part 50 informed consent
The FDA consent rule.
eConsent software for clinical trials
Sign on screen with an audit trail.
Basic clinical trial consent template
A starting point for IRB review.
Informed consent form generator
Draft a consent form.
IRB submission checklist
What the board wants to see.
Free sandbox with every feature. No credit card, and you pay only when you go live with real participants.