□ □
[□] □
□? □
For any site that is required to meet HIPAA guidelines , the contract should be updated to reflect any changes in responsibility by the school or the site . To the extent investigators are treated as members of an institution 's " workforce " for HIPAA purposes , the sharing of information with such investigators pursuant to an IRB waiver or subject to the investigator 's representations required for a review preparatory to research is a " use , " not a " disclosure , " and therefore the accounting requirements do not apply . Specifically , SACHRP recommends that the existing distinction be removed between , on the one hand , all researchers who are affiliated with the Covered Entity , through membership in the Covered Entity = s Aworkforce , @ making them Ainternal @ to the Covered Entity for HIPAA purposes , and on the other hand , those who otherwise are subject to the Covered Entity = s policies and procedures , for example , by virtue of being a member of the Covered Entity = s faculty or medical staff or by being in an organized health care arrangement with the Covered Entity . In order to meet HIPAA guidelines , individual fieldwork sites will require students to be trained , according to HIPAA standards , to follow privacy and confidentiality guidelines . This is still allowed under HIPAA guidelines , however this information must be locked in a file cabinet when not in use , and must be shredded when no longer needed .