Key takeaways
- The Health Insurance Portability and Accountability Act (HIPAA) reaches a study when its sessions can expose protected health information held by a covered entity or by a business associate working for one.
- A direct-to-consumer health app that no covered entity hired falls outside HIPAA but can fall under the Federal Trade Commission's Health Breach Notification Rule.
- Safe Harbor de-identification removes 18 identifiers, full-face photographs among them, so a session clip that shows a face is still identifiable.
- A National Provider Identifier lookup proves an identifier exists, not that a clinician holds a license, so check licenses with the state board.
- The U.S. Department of Health and Human Services recognizes no HIPAA certification, so ask any research partner how it controls each exposure point instead of asking for a badge.
In healthcare UX research, one patient name can turn up in five places before a study ends: the screener, the calendar invite, a shared screen, the recording and the notes. Follow a name such as Ana Ruiz through a single remote study and each stop is routine, yet each one can carry protected health information (PHI) out of the session. Ana Ruiz is a placeholder; no real patient or client stands behind the name.
A retail app study passes through the same five stops, since user experience (UX) research runs on screeners, invites and recordings everywhere. A health product turns each stop into a question under the Health Insurance Portability and Accountability Act (HIPAA), whether you run the study in-house or hire UX research services, so this checklist pairs each stop with the rule behind it and the control that closes it, from recruiting clinicians to deleting the last recording.
What is healthcare UX research, and what makes it different?
Healthcare UX research studies how clinicians, patients and caregivers use health software, through interviews, observation and usability tests, under the rules that protect patient data.
UX research in healthcare differs from other UX research in three ways: participants are hard to reach, a session can expose regulated data, and medical device software adds U.S. Food and Drug Administration (FDA) human factors expectations. In its Summary of the HIPAA Privacy Rule, the U.S. Department of Health and Human Services (HHS) defines protected health information as individually identifiable health information that a covered entity or its business associate holds or transmits.
The work studies users of patient portals, telemedicine apps and clinical tools beside an electronic health record (EHR); it is not clinical research on treatments, although HIPAA's definition of research can still reach it. Nurses, physicians, front-desk staff, patients and caregivers each form a separate user group, and our research program plans 10–15 interview participants per user group. Patients are often vulnerable users, such as older adults or people in pain, so plan shorter sessions and plainer forms.
The user interface (UI) that follows is designed in our healthcare UI UX design process, the healthcare UI UX design side of the same product. List your user groups first, because recruiting, sample size and budget are all counted per group.
What does UX mean in medical terms?
UX means user experience in healthcare as anywhere else: how clinicians, patients and caregivers experience a piece of software.
Clinical teams use many short abbreviations of their own, so a study protocol or readout that clinicians read should spell out "user experience (UX)" the first time. Do the same on consent forms for patients.
Does HIPAA apply to your healthcare UX research?
Yes, when your healthcare UX research touches protected health information held by a covered entity or its business associate; no, for a direct-to-consumer app no covered entity hired.
HIPAA applicability turns on two facts: who hired the research team, and whose data the session will show. HHS names three kinds of covered entity: health plans, health care clearinghouses, and health care providers that transmit health information electronically in standard transactions.
A business associate is a person or organization outside a covered entity's workforce that performs a function or service for it involving PHI, and HHS's business associate guidance counts its subcontractors too. Selling software alone does not make a vendor a business associate, HHS says in a HIPAA FAQ on software vendors, but needing access to PHI to do the work does. A research team whose sessions for a hospital or health plan can expose PHI should therefore expect a business associate agreement (BAA) before the first session, as the contract terms that protect research data explain, while the covered entity's privacy officer decides whether the team counts as a business associate.
Direct-to-consumer products sit on the other side of the line. In HHS's February 2016 guidance "Health App Use Scenarios & HIPAA", a consumer who picks an app and enters her own data does not make the developer a business associate, while a provider who contracts the developer does. Apps outside HIPAA are still regulated: the Federal Trade Commission (FTC) amended its rule with effect from July 29, 2024, and the FTC Health Breach Notification Rule covers health apps HIPAA does not, counting an unauthorized disclosure as a breach.
| Who hired the team, and whose data | Rule that applies | What to do before sessions |
|---|---|---|
| A covered entity, with its patients' data | HIPAA | Sign a BAA, agree on the minimum necessary data |
| A business associate, for a covered entity | HIPAA, through the BAA chain | Sign a subcontractor BAA |
| A direct-to-consumer app no covered entity hired | Often the FTC Health Breach Notification Rule | Treat session data as health data; de-identify anyway |
| A product that holds no health data | Neither | Standard research consent |
This is a map, not legal advice: the covered entity's privacy officer or your own counsel makes the call, so bring them the study protocol before recruiting starts. When the answer is "outside HIPAA", de-identify to HIPAA's bar anyway, because the same session data deserves the same protection whichever rule applies.
Does a healthcare UX research study need IRB approval?
No, not by default: whether a study with patients or clinicians goes to an Institutional Review Board (IRB) depends on whether it counts as research and on the organization's own policy.
The HIPAA Privacy Rule defines research as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge", in the Code of Federal Regulations (CFR) at 45 CFR 164.501. A study built to improve one product is usually planned around a product question, but that does not make it exempt, and a hospital's own policy can send any study with patients to its IRB or privacy board. Ask its research office before you recruit, and leave room in the plan for that ethics review.
Where does PHI leak during healthcare UX research?
Protected health information leaks out of UX research in healthcare at six exposure points, from the screener to the repository, and each has its own control.
HHS's minimum necessary standard requires covered entities to make reasonable efforts to limit uses, disclosures and requests of PHI to the minimum necessary for the purpose. The same principle makes a good design rule for a study: ask for less, show less and keep less. The riskiest point is the screen share, where a clinician walking through a workflow can open a live EHR, such as Epic or Oracle Health, with a patient list in view.
The map pairs each exposure point with what leaks and the control.
| Exposure point | What leaks | Control |
|---|---|---|
| Screener | Diagnosis detail beyond what selection needs | Ask for the condition category only |
| Calendar invite | A name with a clinic or condition in the title | Neutral titles and participant identifiers |
| Screen share | A live EHR with a patient list | Test environment, synthetic patient data, one shared app window |
| Recording | Faces and names spoken aloud | Camera-off option, audio-only, trim before sharing |
| Notes and quotes | Names, dates, room numbers | Participant identifiers, redaction while writing |
| Repository | Raw clips open to the whole company | Access by role and a deletion date |
Observers are a seventh, quieter risk, so admit only the people the consent form names, with visible names. Write each control into your study protocol now; the session checklist further down puts them in order.
How do you recruit clinicians and patients for UX research?
Recruit clinicians and patients for healthcare user research through three recruitment channels: an invitation from the covered entity, a specialist healthcare recruiter or a patient advocacy organization.
Patient advocacy organizations matter most when a condition is rare, because one clinic's list holds too few people to fill a user group. Participant access, not the discussion guide, sets the schedule of a healthcare study, so pick the channel before you write the questions.
- Invitation from the covered entity: best for patients of a portal or staff of a hospital. Check who sends it, so contact details reach the research team only when someone replies.
- Specialist healthcare recruiter: best for practicing clinicians by role and specialty. Check how it verifies licenses and what lead time it quotes.
- Patient advocacy organizations: best for people living with a specific condition, and their caregivers. Check the organization's own rules and that taking part stays voluntary.
Clinician availability is the next constraint: shift schedules and on-call time leave short windows around a shift, so offer remote sessions or a simulation lab, and expect recruiting to outlast the 3–6 day recruitment step of our program.
License verification needs two lookups. A free search of the National Provider Identifier (NPI) Registry confirms that a provider's NPI exists, but the Centers for Medicare & Medicaid Services (CMS) states that issuing an NPI does not validate licensure or credentials, so check the license with the state licensing board when the role matters.
Incentive reporting comes next. When a drug or device maker sponsors the study, payments to physicians and, since program year 2021, to physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, anesthesiologist assistants and certified nurse midwives can be reportable under Open Payments, the CMS program the Physician Payments Sunshine Act created. Ask the sponsor's compliance team before you set incentives.
Patients and caregivers need plain language at a 6th–8th grade reading level and session tools that meet Web Content Accessibility Guidelines version 2.2 (WCAG 2.2), because older adults and people with low digital literacy struggle with clumsy video setups. Hard-to-recruit clinicians push a program toward the top of our $25,000–$60,000 range, as what hard-to-recruit clinicians do to a research budget shows, so count your clinician roles before you budget.
Which UX research methods work with clinicians and patients?
Six methods suit clinical and patient UX research, from clinician shadowing to human factors validation, and each one carries its own HIPAA exposure to plan for.
The table compares the six by the question each answers, where it runs and how to control its exposure.
| Method | Question it answers | Where it runs | PHI exposure and control |
|---|---|---|---|
| Clinician shadowing | How work really happens, workarounds included | On a ward or in a clinic | Real patients in view; agree what gets written down, never record patients |
| Remote clinician interviews | Workflow steps and the context of use | Video call | A live EHR on screen; one app window and test data |
| Patient and caregiver interviews about the app | Needs, worries and routines at home | Video call or phone | Patients volunteer diagnoses; consent covers quotes, notes use identifiers |
| Card sorting with clinical terms | Which labels and groupings clinicians expect | Online tool | Low; no patient data needed |
| Formative usability testing | Use errors on critical tasks in a prototype | Remote or a simulation lab | Prototype holds synthetic patient data |
| Human factors validation | Whether intended users perform critical tasks safely | Simulated use environment | Summative test the device maker plans for its FDA submission |
Clinician shadowing is contextual inquiry on a ward or in a clinic, so it needs on-site visits, and when contextual inquiry earns a ward visit explains the trade-off. Minimal-footprint observation keeps it workable: one observer, no camera, notes without patient names. A task analysis from that step lists the critical tasks, which the FDA defines as tasks that, done wrong or not done at all, can cause serious harm to the patient or user.
Formative usability testing is the healthcare usability testing done while the design can still change, and our usability test rounds with design fixes in between work that way. Human factors validation is different. For medical device software, the FDA human factors guidance of 2016 recommends at least 15 participants from each distinct user population in validation testing. That summative usability testing checks the finished interface against the context of use and the use-related risks the manufacturer documents under IEC 62366-1, the International Electrotechnical Commission's usability engineering standard, so it sits outside our UX research program.
Session timeouts deserve a task of their own. In HHS's HIPAA Security Series paper on technical safeguards, automatic logoff is an addressable implementation specification of the HIPAA Security Rule, which HHS says does not mean optional: the covered entity implements it when reasonable and appropriate, or documents why not and adopts an equivalent measure. A timeout that fires mid-note can cost a clinician the note in progress. Test the timeout length and how work is recovered with clinicians, in the same prototype.
- Synthetic record ("Test, Patient A") instead of a live patient
- Masked medical record number and date of birth
- One shared app window, not the whole desktop
- Participant identifiers on camera-off tiles
- Recording indicator visible to everyone
- Session timeout banner under test
Pick the cheapest method that answers your question with the least patient data in view.
What should consent cover in healthcare UX research?
Consent for healthcare UX research tells clinicians and patients what is recorded, who watches, how quotes are used, how long files are kept and how to withdraw.
Consent scope covers five lines, each with its own reason:
- Recording, with a separate tick box, so a participant can join without being recorded.
- Observers, named by role, so nobody watches unannounced.
- Quotes, with a separate tick box, because a quote in a readout travels further than a note.
- Retention, with the deletion date, so the participant knows when the files end.
- Withdrawal, with a contact, so a participant can ask for their recording to be deleted inside the retention window.
Write it at a 6th–8th grade reading level and collect it before the session starts, never in its first minute.
Informed consent and a HIPAA authorization are two different permissions, even though HHS allows a research authorization to be combined with the consent form. Informed consent is the participant's agreement to take part in the study, collected by the research team. A HIPAA authorization is a signed permission under 45 CFR 164.508 that a covered entity needs for certain uses or disclosures of PHI, including some research uses, and HHS's HIPAA and research page lists authorization, an IRB or privacy board waiver, and de-identified data among the research routes.
Authorization status, whether a HIPAA authorization is needed at all, is the covered entity's call, so ask its privacy officer whether its own disclosure of PHI to your study needs one. A caregiver who joins speaks for themselves; do not collect the patient's details through the caregiver unless the study protocol allows it. Draft the consent form before the screener, so both promise the same things.
How do you de-identify healthcare UX research findings?
Findings from healthcare user research leave the research team only after de-identification, by HIPAA's Safe Harbor method, which removes 18 identifiers, or the Expert Determination method.
The de-identification method you pick sets the work. The Safe Harbor method removes the 18 identifiers listed in 45 CFR 164.514(b)(2), from names and dates finer than the year to full-face photographs and comparable images, and requires that the covered entity have no actual knowledge that the remaining information can identify the person. HHS's de-identification guidance treats derived values, such as initials or the last four digits of a Social Security number, as identifiers too, so they do not pass Safe Harbor.
Where the 18 Safe Harbor identifiers tend to surface in a study:
- Screener and contact details (6): names; geographic subdivisions smaller than a state; all elements of dates except the year, and ages over 89; telephone numbers; fax numbers; email addresses.
- Recording (2): full-face photographs and comparable images; biometric identifiers, including finger and voice prints.
- Shared screen and transcript (7): Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers, including license plates; device identifiers and serial numbers.
- Repository and tools (3): web universal resource locators (URLs); Internet Protocol (IP) addresses; any other unique identifying number, characteristic or code.
The Expert Determination method relies instead on a qualified expert who applies statistical and scientific principles and documents that the risk of re-identification is very small; HHS names no required degree or certificate for that expert.
De-identified research synthesis means applying that bar to every artifact: give transcripts participant identifiers, trim clips or keep them audio-only, and strip dates, places and rare conditions from quotes. Build personas and journey maps, two deliverables of a research program, from de-identified notes only. A journey map needs the problem a participant raised, not the participant's name; the Vocable case study shows the same habit outside healthcare, since we designed each screen of that content marketing product around a problem we heard in stakeholder interviews. Keep raw recordings in a restricted folder under the covered entity's security policies until a set retention window closes, and delete contact details on the same date.
The test data source decides how much of this you face: our healthcare design work uses synthetic patient data in prototypes, the invented records vendor pages call dummy data, so the screen holds nothing to remove. HHS's Office for Civil Rights enforces the HIPAA Privacy Rule and the HIPAA Security Rule, so treat a leaked clip as a compliance incident, not a housekeeping slip. Set the deletion date in the plan, before the first recording exists.
Healthcare UX research checklist for each session
This healthcare UX research checklist holds 15 checks for clinician and patient sessions: six before the session, four during it and five after it.
To run UX research with clinicians and patients without breaking HIPAA rules, settle applicability first, keep PHI out of every exposure point and de-identify whatever leaves the team. Each line below comes from a section above; run it once per session, not once per study.
Before the session
- Confirm HIPAA applicability with the covered entity's privacy officer, because the answer sets every other control.
- Put a BAA in place if PHI can appear, because access to PHI comes after the agreement.
- Cut the screener to condition categories, so it asks for the minimum necessary.
- Send neutral calendar invites with participant identifiers, so names and conditions stay out of inboxes.
- Load the prototype with synthetic patient data, so no live record reaches the screen.
- Send the consent form ahead and collect it before the session, so participants read it without pressure.
During the session
- Ask clinicians to share one app window, never a live EHR, so patient lists stay off the recording.
- Offer camera-off or audio-only, so faces stay out of clips.
- Admit only observers named in the consent form, so every viewer is known.
- Write notes with participant identifiers, so raw notes need no cleanup.
After the session
- De-identify transcripts, clips and quotes by the Safe Harbor method, so findings can travel.
- Store raw recordings in a restricted folder, so only named people open them.
- Delete recordings and contact details when the retention window closes, so nothing outlives its use.
- Check incentive reporting if a drug or device maker paid, because Open Payments can apply.
- Build the readout from de-identified notes only, so no slide carries PHI.
Lines 1, 2 and 14 need answers from outside the research team, so start those before recruiting opens.
When should a healthcare team bring in a research partner?
Bring in a partner for healthcare UX research studies when clinician recruitment, the PHI protocol or the number of user groups outgrows your team's time.
Three signals point that way:
- Clinician recruitment with verification, because NPI lookups, license checks and shift-bound scheduling eat into a product manager's calendar.
- A PHI protocol nobody owns, because six exposure points, consent, de-identification and retention need one person accountable for every session.
- Several user groups at once, because nurses, physicians, front-desk staff, patients and caregivers each need their own sample of 10–15 interviews.
A vendor can call its recruiting "HIPAA-compliant fielding", but HHS's Office for Civil Rights says it does not certify any person or product as HIPAA compliant, so judge any partner by its answers instead. Ask these questions of every partner, us included, before the first session:
- How does your screener keep to the minimum necessary? Listen for the fields it drops.
- What data fills your prototypes? Listen for synthetic records, never live ones.
- Where do recordings live, who can open them and when are they deleted? Listen for a folder, named roles and a date.
- Will you sign a BAA if PHI can appear? Listen for a plain yes or no, with the reason.
Our UX research in healthcare follows the same published program terms as any other study: 4–8 weeks, $25,000–$60,000, 10–15 interviews per user group, contextual inquiry on site where the question needs it, and a 90-minute readout.
By the readout, Ana Ruiz should appear only as participant P03 in what the team shares (the invite title, the clip, the quote on the findings slide), while her name and contact details wait in the restricted folder for the deletion date. Before any call, write down your clinician roles, patient groups and the systems that hold their data, because those three facts size the study. Add one line on where PHI can appear, then tell us which clinicians and patients you need to reach. Every project begins with a free consultation and a fixed-scope proposal.
FAQs
Is there a HIPAA certification for UX research vendors?
No. HIPAA defines no official certification for agencies or software, and HHS states in a HIPAA Security Rule FAQ that it does not endorse or otherwise recognize private organizations' "certifications". Ask instead how the vendor handles each exposure point and whether it signs a BAA when PHI can appear.
Can healthcare UX research be done remotely?
Yes, for most methods. Interviews, screen-share walkthroughs, card sorts and many usability tests run remotely, while clinician shadowing needs on-site visits. Remote healthcare research sessions add the screen share and the recording as exposure points, so plan those controls first.
Do you need real patient data to test a healthcare prototype?
No. Synthetic patient data lets clinicians and patients complete the same tasks without live PHI on screen. Use realistic but invented names, values and dates, so the data looks like a real chart without belonging to anyone.
How much does healthcare UX research cost?
UX research for healthcare products is priced in our standard research program range, $25,000–$60,000 over 4–8 weeks. More user groups and hard-to-recruit participants, such as hospital clinicians, move a program toward $60,000.
How should you pay clinicians who join a UX research study?
Pay a fair incentive for their time and schedule sessions around their shifts. When a drug or device maker funds the study, ask its compliance team whether the payment is reportable under Open Payments before you send it.
