Access
To Health Information of Decedents for Research
The HIPAA Privacy Rule protects the privacy of identifiable health information of deceased individuals, including deceased subjects in research, until 50 years after the date of death. This protection is in contrast to the Common Rule, which formally only covers living persons as "human subjects." The Privacy Rule allows a researcher to access a decedent's identifiable health information either 1) under a waiver of authorization or 2) without a waiver of authorization if a covered institution obtains assurances from the researcher that:
-
the requested use or disclosure is solely for research on the protected health information of decedents, and
-
the protected health information for which use or disclosure is sought is necessary for the research purposes.
NOTE that minimum necessary and tracking/accounting of disclosures requirements still apply in either case (see below).
To accommodate both the Privacy Rule and the Common Rule with respect to research on decedents, the Partners policy is as follows:
-
Medical record review:
• For medical records studies that involve accessing records/PHI of both living and deceased individuals, the investigator should proceed as with a medical records study that involved only living individuals and should submit a medical records protocol application and request a waiver of consent and authorization.
• For medical records studies that involve accessing records/PHI solely of deceased individuals, the investigator may consult the IRB as to the appropriate process and requirements. Such studies will not constitute human subjects research but will still trigger the above-referenced requirements under the Privacy Rule.
Records/information pertaining to individuals who have been deceased for more than 50 years is not considered to be PHI under the Privacy Rule; however, investigators should still follow the processes outlined above for medical records studies involving such information.
-
Clinical trials:
Investigators must obtain informed consent and authorization from subjects to participate in clinical trial research. In the event that a subject dies before the research is completed, and continued use or disclosure of their identifiable health information is necessary for the research, the authorization will generally be sufficient to permit continued use/disclosure to complete the subject’s participation in the study as described in the form. In some situations, as determined by the PHRC/IRB, it may be necessary to obtain further assurances from the investigator as to the use and disclosure of decedents' information under this policy.
-
All research:
Updated 10/2013
|