Their current research studies involve the use of personally identifiable health information maintained by a hospital, clinic, physician, professional association, or other HIPAA-covered health care provider, or a private, state, or federal health insurance plan (e.g., Medicaid), or