Second, when stating that research participation is voluntary, as required by the federal regulations, the combined form should explicitly mention the option to withdraw. The Privacy Rule allows investigators to use participants' protected health information until their authorization is withdrawn in writing or until the authorization expires. Hence, combined forms should recommend that participants withdraw in writing. Third, when explaining confidentiality protections, researchers should state on the combined form that the regulations may not protect individuals' health information after its disclosure. Finally, the Privacy Rule gives participants the right to access their protected health information. Hence, studies that require withholding certain information from participants, for instance, whether they are receiving drug or placebo, should state this on the combined form. These additions (Table) provide a checklist that investigators and institutional review boards can use to assess adherence to the Privacy Rule's authorization requirements.