Clinical Research Interview Transcription: HIPAA, IRB, and Participant Confidentiality

Quick answer: Clinical interview transcription can involve several overlapping rule sets. IRB/Common Rule obligations, HIPAA requirements, contractual security rules, and participant consent are not interchangeable. Before a recording leaves the study team, determine whether it contains PHI, whether the vendor will act as a HIPAA business associate, what the approved protocol permits, whether especially protected substance-use-disorder information is involved, and which identifiers must be removed. Then document access, transfer, retention, deletion, and transcript conventions in the vendor workflow.

Clinical qualitative data is unusually revealing. A single interview may contain a participant’s name, diagnosis, medication history, employer, family circumstances, exact dates, hospital locations, and third-party information. Even a study that ultimately publishes only themes can begin with highly identifiable recordings.

VerbalScripts provides medical transcription, patient interview transcription, and research transcription workflows. Clinical teams should request a written scope before sending PHI or restricted research data.

HIPAA and IRB review solve different problems

A common procurement mistake is to ask, “Is the vendor HIPAA compliant and IRB compliant?” as though one checkbox answers every question.

IRB/Common Rule: concerns protections for human research participants when the regulations and institutional policies apply. The IRB reviews the study and protocol.

HIPAA: protects PHI held or handled by covered entities and business associates in circumstances governed by the HIPAA Rules. When a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity or business associate, the relationship may require a BAA.

A study at an academic medical center can therefore require both protocol compliance and a HIPAA business-associate workflow. Another study may be subject to the Common Rule but not involve HIPAA PHI. The research/privacy office should make that determination.

Determine what is actually in the recording

Before choosing a workflow, map the data:

• participant name or initials;

• date of birth or age detail;

• medical-record or study numbers;

• dates of visits and procedures;

• diagnoses and symptoms;

• medication names and doses;

• provider names;

• hospitals/clinics;

• geography;

• family-member information;

• employer/occupation;

• rare conditions or events that indirectly identify the participant.

The transcript can make this information easier to search and copy than the original audio, so access control must extend to the written file.

When might a BAA be required?

HHS explains that business associates include persons or entities performing certain functions or services involving PHI on behalf of covered entities, and applicable subcontractors also take on business-associate obligations. If a transcription company will create, receive, maintain, or transmit ePHI for a covered entity, the covered entity should determine whether a BAA is required before the files are transferred.

Do not assume encryption alone eliminates the relationship. HHS notes, for example, that cloud providers maintaining ePHI can be business associates even when the data is encrypted and they do not hold the decryption key.

If your study needs a BAA, make it part of vendor onboarding rather than a last-minute attachment after uploading.

Consent and protocol restrictions still matter

A BAA does not override the research protocol. If the consent form promised that only the named study team would hear the recordings, the PI may need to consult the IRB before using an outside transcription service. If the protocol states that identifiers will be removed before external processing, build that step into the workflow.

Use the broader IRB-Compliant Research Transcription checklist when evaluating third-party access.

Special caution: substance-use-disorder records and 42 CFR Part 2

Some records related to substance-use-disorder treatment are subject to 42 CFR part 2 in addition to HIPAA. HHS finalized changes aligning parts of Part 2 with HIPAA, with a compliance date in 2026 for the 2024 final rule framework. Part 2 does not apply to every mental-health or research interview; it applies based on the source and nature of the records and program.

If Part 2 could apply, involve the organization’s privacy/legal team before sending recordings to any vendor. Do not rely on a general transcription agreement as a substitute for that analysis.

De-identification: decide what the transcript should contain

Common workflows include:

Identifiable master + de-identified research copy

The vendor transcribes accurately, then applies a supplied replacement map. The restricted master is retained only as long as the protocol permits.

Coded transcript from the start

The study uses participant codes and asks the vendor to replace spoken direct identifiers with approved placeholders.

Researcher-led de-identification

The vendor returns a restricted verbatim transcript and the study team performs de-identification because researchers are better able to recognize context-specific indirect identifiers.

The third option can be safer analytically when “identifying” details are also scientifically meaningful. The correct approach depends on the protocol and data-sharing plan.

Transcript accuracy in clinical interviews

Clinical interviews contain words that ordinary ASR systems and generalist transcriptionists can confuse:

• drug names and dosages;

• similar medical terms;

• acronyms;

• laboratory values;

• anatomical sites and laterality;

• device/product names;

• negation (“no fever” versus “fever”);

• names of trials, scales, and instruments.

A professional workflow should use the study glossary and mark uncertainty rather than guessing. For medical specialty dictation, see Pathology and Radiology Dictation Transcription.

Speaker labels for clinical qualitative research

Use role labels that protect identity while supporting analysis:

• INTERVIEWER

• PARTICIPANT P014

• CAREGIVER

• CLINICIAN

If several clinicians or family members speak, supply a roster or opening voice identification when possible. Multi-speaker health focus groups require even more preparation; see Healthcare Focus Group Transcription.

Retention and deletion should cover working files

Ask the vendor to define the lifecycle for:

• uploaded original;

• local or temporary working copy;

• audio-processing derivative, if one is created;

• draft transcript;

• reviewed transcript;

• final delivery;

• backups and logs.

A statement that “files are deleted” is incomplete if it does not define when and which copies. Match the vendor schedule to the protocol, institutional retention policy, BAA, and DMS plan.

Clinical research transcription checklist

Protocol: Third-party transcription is permitted or approved

Consent: Participant promises are consistent with vendor access

HIPAA: PHI/BAA status determined by privacy office

Part 2: Applicability evaluated where SUD records may be involved

Identifiers: Master/de-identified workflow defined

Security: Transfer, storage, authentication and access requirements met

Personnel: Authorized roles and subcontractors disclosed as required

Transcript: Speaker labels, verbatim level, timestamps, terminology rules

Retention: Audio/draft/final deletion lifecycle documented

Analysis: Final structure tested in research software if applicable

What to send VerbalScripts

For a clinical research project, request a quote with the approximate audio minutes, speaker count, medical specialty, transcript convention, required agreement (including BAA if your organization determines one is needed), de-identification rules, data-handling constraints, and delivery schedule.

For recurring research, ask for one pilot transcript before a large batch. That lets the study team validate terminology, identifiers, and analysis formatting before the workflow scales.

Frequently asked questions

Is every clinical research transcript PHI?

No. HIPAA status depends on the data and the entities handling it. A research dataset can be sensitive or identifiable without being PHI, and a de-identified dataset may fall outside parts of HIPAA. Let the privacy/research office classify the data.

Does IRB approval automatically satisfy HIPAA?

No. The rules address different obligations. A study may need IRB approval and a separate HIPAA authorization, waiver, or business-associate arrangement depending on the circumstances.

Can a transcription vendor remove HIPAA identifiers?

A vendor can follow a defined redaction/de-identification instruction, but the covered entity/research team should determine the legally and scientifically appropriate method. Context can contain indirect identifiers that require researcher judgment.

Are psychiatric interviews handled differently?

Mental-health information is generally protected as PHI like other health information, while HIPAA gives special treatment to psychotherapy notes as a defined category. Substance-use-disorder records may also implicate Part 2. See Psychiatric Evaluation Transcription.

Can the transcript be returned without the participant’s name?

Yes, if the protocol calls for coded labels. Supply the exact participant-code convention and rules for names spoken inside the recording.

Protect the participant and the analysis

Clinical transcription is successful when privacy controls and scientific usability reinforce each other: restricted access, clear identifiers, a reliable audit trail, accurate medical language, and a transcript that can move directly into analysis. Contact VerbalScripts with your project parameters to scope the workflow before restricted recordings are transferred.

Privacy note: This article is general operational information, not legal advice. HIPAA, Common Rule, Part 2, state law, and institutional policies require fact-specific review.

Authoritative references

• HHS, Research and HIPAA

• HHS, Business Associates

• HHS, HIPAA Security Rule

• HHS, 42 CFR Part 2

• HHS OHRP, 45 CFR part 46