MINIMUM
NECESSARY STANDARD: RESEARCH ACTIVITIES
The
HIPAA Privacy Rule requires Partners and its affiliated
hospitals and providers to make all reasonable efforts
to use or release only the "minimum necessary"
identifiable health care information to achieve the intended
purpose. The minimum necessary standard does not apply
to 1) treatment-related requests or disclosures of health
care information, or 2) situations in which an individual
has signed an authorization for the use or disclosure
of identifiable information (such as in a clinical trial),
and 3) other limited exceptions that apply to administrative
requirements. Partners policy describes how the minimum
necessary standard applies generally, and this PHRC policy
describes how the minimum necessary standard applies to
research (please refer to Partners
minimum necessary policy and the policy
of individual entities as needed).
I.
Research Pursuant to an Authorization (e.g., clinical
trial)
If a researcher obtains written authorization from subjects
to use or disclose their protected health information,
the minimum necessary standard does not apply. However,
the authorization must describe in a reasonably specific
way, among other things, what information will be used
or disclosed, by whom and to whom, and for what purposes.
II.
Research Pursuant to a Waiver of Authorization (e.g.,
medical records research)
If a researcher requests that the PHRC approve a waiver
of individual authorization, then the minimum necessary
standard applies. The researcher must describe in the
waiver request specifically what health care information
is necessary for the research. If the researcher requests
access to electronic health care information (either medical
records or the Research Patient Data Registry (RPDR)),
the researcher should identify the fields that will be
searched in order to conduct the research. If the researcher
requires access to paper records, then the researcher
should identify the specific information that s/he will
look for and retain to conduct the research.
III.
Research Using a Limited Data Set
The Privacy Rule also applies the minimum necessary standard
to the use or disclosure of a limited data set for research.
Accordingly, a researcher must determine what types of
data are necessary to conduct the research and must clearly
describe those in the protocol submitted to the PHRC.
For more information, see the PHRC policy on Limited
Data Sets.
IV.
Research Using Decedents Protected Health Information
The Privacy Rule also applies the minimum necessary standard
to the use or disclosure of decedents protected health
information.
V.
Uses Preparatory to Research
Any uses under the provision preparatory to research are
limited to minimum necessary.
|