(a) Except as provided by this section, to use or disclose protected health information (PHI), an authorization is required that:(1) conforms with the requirements of 45 Code of Federal Regulations (CFR) §164.508 and, if applicable 42 CFR Part 2; and(2) includes a statement that the subject's right to access his or her PHI created or obtained during research may be temporarily suspended while the research is in progress, and will be reinstated upon completion of the research, if the research includes treatment.(b) During the review of proposed research, the designated institutional review board (IRB) has the authority to approve a waiver or alteration of the authorization requirement in accordance with 45 CFR §164.512(i).(c) The designated IRB has the authority to approve the use or disclosure of PHI for purposes preparatory to research if the IRB obtains from the investigator adequate representations as required by 45 CFR §164.512(i)(1)(ii).