Abstract
This study was designed to assess differences in the content of HIPAA authorization forms now required for clinical research. Authorization forms were collected from 111 institutions, including academic medical centers and commercial Institutional Review Boards. The requirement for an element covering the use of information acquired was fulfilled in 95% of the forms, and 100% had a statement fulfilling the core requirement of a description of the data to be collected. However, only 19% distinguished between entities that could see personal identifiers versus aggregate data. Significant differences existed in how long the disclosure agreement would remain in effect, and complex legalistic language was common. Thus, while research authorization forms technically met the requirements, the complex language and confusion over personal identifiers may raise concerns in prospective research participants.