HIPAA Statement

In-House Research Global Ltd (“In-House Research”, “we”, “us”, “our”) is a UK-based healthcare market research fieldwork agency. We work with many US clients, recruit US-based healthcare professionals and vets to take part in research, and run surveys in the United States.

This statement explains how the US Health Insurance Portability and Accountability Act (HIPAA) relates to our work, and how we protect health information. It should be read alongside our Privacy Policy, which explains how we handle personal data under UK and EU data protection law.

What is HIPAA?

HIPAA is a US law that protects individuals’ health information, known as protected health information (PHI). Its Privacy Rule sets standards for how PHI may be used and shared, including limiting it to the “minimum necessary”. Its Security Rule sets standards for keeping electronic PHI confidential, accurate and secure.

HIPAA applies to “covered entities” (health plans, healthcare clearinghouses and most healthcare providers) and to their “business associates”, which are organisations that handle PHI on a covered entity’s behalf.

Does HIPAA apply to In-House Research?

In our usual work, In-House Research is neither a covered entity nor a business associate:

We recruit healthcare professionals and vets to take part in market research. The professional information they share with us, such as their name, specialty and practice details, is not PHI.
Our patient panel is open only to adults living in the UK. We do not recruit US patients.
We do not receive patient records from hospitals, doctors, health plans or any other covered entity.
When a study asks healthcare professionals to complete a patient record form survey, the forms are designed to be fully de-identified. Healthcare professionals are asked not to include any information that could identify a patient, such as names, contact details, record numbers or full dates, in line with HIPAA’s de-identification standard.

If a client ever needs us to handle PHI on behalf of a covered entity, we will sign a Business Associate Agreement (BAA) before receiving any PHI, and handle it in line with HIPAA’s requirements.

How we protect health information

Although HIPAA does not usually apply to our work, we follow its principles, together with the BHBIA Legal & Ethical Guidelines for healthcare market research, whenever we handle health information:

Minimum necessary: we only collect and share the information a study needs.
Limited access: access to respondent data is restricted to our two directors.
Encryption: our sign-up forms use Zoho’s form encryption, and data is encrypted in transit (TLS) and at rest.
Secure hosting: our respondent database is hosted by Zoho in its EU data centres (Amsterdam and Dublin). Zoho holds independent security certifications, including ISO/IEC 27001 and SOC 2 Type 2.
Multi-factor authentication protects our file storage
Password-protected exports: any respondent data exported for a study is password protected and deleted after 2 years.
No AI tools: we never enter respondents’ personal data into AI tools.
Training: our team holds BHBIA certificates, renewed annually, in adverse event reporting and in the legal and ethical guidelines for market research and data analysis.
Adverse events: we follow our clients’ safety reporting requirements, including US FDA reporting where it applies. Respondents choose whether their contact details are shared with the client’s safety team or the report stays anonymous.
Breach response: if we discover a breach involving health information, we will act promptly to contain it, inform the client concerned and notify affected individuals and authorities where the law requires.

Your privacy rights

You can ask us at any time to access, correct or delete the personal data we hold about you, or withdraw your consent to us using it. We never sell personal data.

To update your details or leave our panels, click here. For any other request, email info@inhouseresearch.co.uk or call +44 (0)7769 641727. We will respond within one month. Full details of your rights are in our Privacy Policy.

Validity and questions

This HIPAA Statement was last updated on 5th November 2026. We review it at least once a year. If you have any questions, please contact us at info@inhouseresearch.co.uk or call +44 (0)7769 641727.