Research & HIPAA

Use of Disclosure of PHI for Research Purposes

The HIPAA Privacy Rule contains provisions that apply to research involving the use or disclosure of Protected Health Information (PHI).  PHI is health information that is individually identifiable and is created by or held by a Covered Entity.

The University of Minnesota's health plans, its health care provider services, and those that may access PHI to support the plans or health care provider services (collectively referred to as the University's "health care components") are a single Covered Entity. Thus, all health information that identifies an individual and is held by or created by these areas of the University is PHI.

There are several ways that a researcher may use PHI for research:

  • A researcher may obtain a signed HIPAA Authorization from each research subject.
  • A researcher may seek a Waiver of Authorization using the University's IRB Form HRP-441.
  • A researcher may use PHI in a Limited Data Set, which contains a very limited set of indirect identifiers, and is only used within the University's Health Care Components or a Data Use Agreement.
  • A researcher may use PHI that has been de-identified.
  • A researcher may use of the PHI of deceased individuals when that research only involves the information of decedents (see below).
  • A researcher may have limited access to PHI for 'activities preparatory to research' (see below).

Activities Preparatory to Research

HIPAA permits researchers to access and use PHI for 'activities preparatory to research' without the Authorization of the subject of the PHI. This provision allows researchers to review patient data to prepare a research protocol, develop a hypothesis, or assess whether a sufficient and appropriate number of individuals would meet the eligibility criteria of the proposed study. During the preparatory to research activities, the researcher may not record or store patient information or contact patients. If a researcher is planning patient recruitment for a study, they would not be eligible to use and access PHI under this provision.

Before accessing and using PHI for this purpose, the researcher must make the following representations to the University:

  • The access to and use of PHI is requested solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;
  • The PHI will not be removed from the Covered Entity in the course of review; and
  • The PHI for which use or access is requested is necessary for the research.

For further information, please see this guide.