PARTNERS HUMAN RESEARCH COMMITTEE

Partners_Logo

 

 

Access To Health Information of Decedents for Research

The HIPAA Privacy Rule protects the privacy of identifiable health information of deceased individuals, including deceased subjects in research, until 50 years after the date of death. This protection is in contrast to the Common Rule, which formally only covers living persons as "human subjects." The Privacy Rule allows a researcher to access a decedent's identifiable health information either 1) under a waiver of authorization or 2) without a waiver of authorization if a covered institution obtains assurances from the researcher that:

  • the requested use or disclosure is solely for research on the protected health information of decedents, and
  • the protected health information for which use or disclosure is sought is necessary for the research purposes.

NOTE that minimum necessary and tracking/accounting of disclosures requirements still apply in either case (see below).


To accommodate both the Privacy Rule and the Common Rule with respect to research on decedents, the Partners policy is as follows:

  1. Medical record review:
    • For medical records studies that involve accessing records/PHI of both living and deceased individuals, the investigator should proceed as with a medical records study that involved only living individuals and should submit a medical records protocol application and request a waiver of consent and authorization.

    • For medical records studies that involve accessing records/PHI solely of deceased individuals, the investigator may consult the IRB as to the appropriate process and requirements. Such studies will not constitute human subjects research but will still trigger the above-referenced requirements under the Privacy Rule.

    Records/information pertaining to individuals who have been deceased for more than 50 years is not considered to be PHI under the Privacy Rule; however, investigators should still follow the processes outlined above for medical records studies involving such information.

  2. Clinical trials:
    Investigators must obtain informed consent and authorization from subjects to participate in clinical trial research. In the event that a subject dies before the research is completed, and continued use or disclosure of their identifiable health information is necessary for the research, the authorization will generally be sufficient to permit continued use/disclosure to complete the subject’s participation in the study as described in the form. In some situations, as determined by the PHRC/IRB, it may be necessary to obtain further assurances from the investigator as to the use and disclosure of decedents' information under this policy.

  3. All research:

    • Documentation of Death:
      The Privacy Rule gives the PHRC/IRB the right to request that the investigator submit documentation of the death of decedent-subjects if it determines that proof of death is necessary or justified.
    • Tracking of disclosures:
      Disclosures of decedent's identifiable health information made pursuant to a waiver of authorization or made pursuant to an assurance as permitted by this policy must be tracked in accordance with the accounting requirements of the Privacy Rule. (See Partners Accounting of Disclosures Policy)       (PHS internal only link)
    • Minimum necessary standard applies to the use and disclosure of decedents' PHI.
      (See Minimum Necessary Policy) (PHS internal only link)

Updated 10/2013