Clinical Research Associates (CRAs) play a frontline role in safeguarding the integrity of clinical trials. Beyond protocol adherence and data accuracy, CRAs must protect something equally important: patient privacy.

If you work on U.S.-based studies—or global studies that touch U.S. sites—two laws determine how patient information must be handled: HIPAA(Health Insurance Portability and Accountability Act) and HITECH(Health Information Technology for Economic and Clinical Health Act). Both set strict requirements for how Protected Health Information (PHI) is accessed, shared, stored, and secured.

Understanding PHI: What CRAs Need to Know

PHI is any patient information that can identify an individual. HIPAA lists 18 identifiers (e.g., name, address, DOB, MRN, full‑face photos). CRAs encounter PHI most during source data verification, EMR review, labs, clinic notes, and imaging.

Rule #1: If it identifies a patient, it’s PHI—and it must be protected.

Applying the Minimum Necessary Rule

HIPAA requires accessing only the information needed for the task at hand. For CRAs, that means:

• Review only records relevant to enrolled study subjects
• Avoid browsing unrelated chart sections
• Do not request extra PHI that isn’t required for monitoring

Using the Right Technology—Securely

HITECH strengthened HIPAA’s digital security expectations. CRAs should follow strict technology practices.

Always use:

• Sponsor‑approved EDC, CTMS, and eTMF systems
• Encrypted email and secure portals for file exchange
• Company‑issued devices with strong passwords and MFA
• VPN when accessing systems remotely

Never use:

• Personal email or messaging apps to view or share PHI
• Screenshots or photos of PHI
• Unencrypted USB drives
• Personal cloud storage for study materials

Remote & Onsite Monitoring: A Privacy Checklist

During onsite visits:

• Never take PHI offsite
• View PHI only in designated monitoring areas
• Keep screens/documents out of public view
• Make no handwritten notes with identifiers

During remote monitoring:

• Use sponsor‑approved remote SDV platforms
• Ensure screen shares exclude PHI unless explicitly permitted
• Do not accept PHI via unencrypted email
• Control your environment during screen share (close windows, prevent access)

Secure Your Workspace—Physical and Digital

Digital hygiene:

• Lock your screen whenever you step away
• Use strong, unique passwords and MFA
• Avoid public Wi‑Fi—or use a VPN
• Don’t store PHI locally on your device

Physical security:

• Keep materials in zipped/locked bags; never leave docs in cars or public areas
• Shred notes if they contain sensitive data
• Do not carry paper PHI from a site

Reporting Incidents: When in Doubt, Escalate

HITECH expanded breach‑notification requirements. CRAs must promptly report:

• Missing or stolen laptops/phones
• PHI emailed to the wrong recipient or sent unencrypted
• Viewing an incorrect subject’s chart
• Any suspected unauthorized PHI exposure

CRAs don’t investigate— they escalate. Fast reporting protects patients and the study.

Consent & Documentation: CRA Oversight Role

HIPAA requirements appear in the HIPAA Authorization or via IRB waivers. During monitoring, verify that:

• HIPAA authorizations are present, correctly completed, and signed
• Re‑consent covers any updated privacy language
• No PHI appears in monitoring reports, emails, or EDC queries

Compliance Is a Habit, Not a Task

The most compliant CRAs:

• Understand what constitutes PHI
• Use only secure, approved systems
• Follow sponsor, CRO, and site SOPs
• Keep data secure in all environments
• Report incidents immediately
• Avoid introducing PHI into study communications

Final Takeaway

For CRAs, HIPAA and HITECH compliance is about respecting the dignity and privacy of every study participant. Apply these principles consistently to protect patients, uphold data integrity, and strengthen the credibility of your work.