Yes. Under the Privacy Rule, an individual’s authorization is for the use and disclosure of PHI for research purposes. In contrast, an individual’s informed consent, as required by the Common Rule, is a consent to participate in the research study as a whole, not simply a consent for the research use or disclosure of his or her PHI.
For this reason, there are important differences between the Privacy Rule’s requirements for individual authorization, and the Common Rule’s requirements for informed consent. However, the Privacy Rule’s authorization elements are compatible with the Common Rule’s informed consent elements. Thus, both sets of requirements can be met by use of a single, combined form, which is permitted by the Privacy Rule. For example, the Privacy Rule allows the research authorization to state that the authorization will be valid until the conclusion of the research study, or to state that the authorization will not have an expiration date or event. This is compatible with the Common Rule’s requirement for an explanation of the expected duration of the research subject’s participation in the study. It should be noted that where the Privacy Rule, and/or the Common Rule human subjects regulations are applicable, each of the applicable regulations would need to be followed.