regulations as part of the Health Insurance Portability

and Accountability Act of 1996 (HIPAA), providing more protection for individually identifiable information and data. These changes to HIPAA resulted in the first national standards for the protection of health information. Shortly after these new regulations were accepted, RTI International began a program evaluation to be conducted with health employees at hospitals and state and local health departments. This paper briefly describes how we adapted our data collection procedures to comply with the HIPAA regulations and how those changes impacted our data collection processes and results. 1. Brief Overview of HIPAA HIPAA was created and designed to protect individual health information by limiting the release of medical records and medical information to the general public. Medical records and information could still be made available to researchers and government agencies; however, the onus was on medical providers (referred to as “covered entities ” in HIPAA) to ensure that the requests for such information were legitimate. In April 2003 the new regulations were developed under the Privacy Rule, which further limited access to medical records and medical information. The Privacy Rule states that no personal identifiable medical information can be released without the patient’s written authorization. The rule does allow release of an individual’s personal medical information to legitimate research organizations and government agencies conducting certain types of research (e.g., public safety research). However, because of the new Privacy Rule, some medical providers have decided not to release medical records at all without the patient’s written authorization, no matter who is requesting the information. In other words, some providers tend to err on the side of caution to avoid potential liability in the event of inappropriate release of records. In addition, one might expect medical professionals to be less likely to participate in research due to th