Research & HIPAA | Health Information Privacy & Compliance Office

Use of Disclosure of PHI for Research Purposes

The HIPAA Privacy Rule contains provisions that apply to research involving the use or disclosure of Protected Health Information (PHI). PHI is health information that is individually identifiable and is created by or held by a Covered Entity.

The University of Minnesota's health plans, its health care provider services, and those that may access PHI to support the plans or health care provider services (collectively referred to as the University's "health care components") are a single Covered Entity. Thus, all health information that identifies an individual and is held by or created by these areas of the University is PHI.

There are several ways that a researcher may use PHI for research:

A researcher may obtain a signed HIPAA Authorization from each research subject.
A researcher may seek a Waiver of Authorization using the University's IRB Form HRP-441.
A researcher may use PHI in a Limited Data Set, which contains a very limited set of indirect identifiers, and is only used within the University's Health Care Components or a Data Use Agreement.
A researcher may use PHI that has been de-identified.
A researcher may use of the PHI of deceased individuals when that research only involves the information of decedents (see below).
A researcher may have limited access to PHI for 'activities preparatory to research' (see below).

Research Involving Only The Information of Decedents

HIPAA permits researchers to use the PHI of decedents for research without Authorization. This provision of HIPAA only allows the researcher to use and disclose PHI for research purposes; it does not allow a researcher to use PHI for any other reason, or disclose PHI outside of the Covered Entity which holds the PHI. The researcher must make the following representations to the University during the HIPCO Ancillary Review process:

The use or disclosure of PHI is sought solely for research on the protected health information of decedents (not, e.g., for research on living relatives of decedents);
The decedents’ PHI is necessary for the research purposes; and
Upon the request of the IRB, the investigator will provide documentation of the death of the individuals.

HIPAA exempts the information of individuals who have been deceased for more than 50 years from the definition of PHI. For this reason, researcher do not need to seek Authorization under HIPAA to use and disclose this information for any purpose. However, the University's IRB may still need to approve research on these deceased individuals.

Activities Preparatory to Research

HIPAA permits researchers to access and use PHI for 'activities preparatory to research' without the Authorization of the subject of the PHI. This provision allows researchers to review patient data to prepare a research protocol, develop a hypothesis, or assess whether a sufficient and appropriate number of individuals would meet the eligibility criteria of the proposed study. During the preparatory to research activities, the researcher may not record or store patient information or contact patients. If a researcher is planning patient recruitment for a study, they would not be eligible to use and access PHI under this provision.

Before accessing and using PHI for this purpose, the researcher must make the following representations to the University:

The access to and use of PHI is requested solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;
The PHI will not be removed from the Covered Entity in the course of review; and
The PHI for which use or access is requested is necessary for the research.

For further information, please see this guide.