Under HIPAA, "retrospective research" (a.k.a., data mining) on collections of PHI generally … A) Is covered by Common Rule/FDA requirements, but not HIPAA’s. B) Does not meet the definition of research, and so requires no HIPAA authorization or meeting one of the criteria for waiving authorization. C) Is research, and so requires either an authorization or meeting one of the criteria for a waiver of authorization. D) Must meet HIPAA requirements only if the data collection is in a different jurisdiction (state) than the researcher accessing it.