Under Ohio State's Patient Information and HIPAA Policy , the vast majority of medical data used in research (and outside the electronic medical record) is classified as Research Health Information (RHI), which is not regulated under the Health Insurance Portability and Accountability Act (HIPAA). The Office of Technology and Digital Innovation's (OTDI) Digital Security and Trust (DST) team has set up a webpage of RHI-related resources , which can help you properly identify and secure your RHI data.
