Access
To Health Information of Decedents for Research
The
HIPAA Privacy Rule protects the privacy of identifiable
health information of deceased individuals, including
deceased subjects in research. This is in contrast to
the Common Rule that formally only covers live persons
as "human subjects." The Privacy Rule allows
a researcher to access a decedent's identifiable health
information without the authorization of the decedent
or their representative if a covered institution obtains
assurances from the researcher that:
-
the requested use or disclosure is solely for research
on the protected health information of decedents,
and
-
the
protected health information for which use or disclosure
is sought is necessary for the research purposes.
The
standard PHRC/IRB submission forms for waiver of informed
consent and authorization include adequate information
for these assurances.
To
accommodate both the Privacy Rule and the Common Rule
with respect to research on decedents, the Partners
policy is as follows:
-
Medical record review:
As is the current practice, all research protocols
involving the review of medical records of deceased
subjects or living and deceased subjects require review
and approval by the PHRC/IRB.
-
Clinical trials:
Investigators must obtain informed consent and authorization
from subjects to participate in clinical trial research.
In the event that a subject dies before the research
is completed, and continued use or disclosure of their
identifiable health information is necessary for the
research, the authorization should cover continued
use/disclosure. In some situations, as determined
by the PHRC/IRB, it may be necessary to obtain further
assurances from the investigator as to the use and
disclosure of decedents' information under this policy.
-
All research:
-
Documentation
of Death:
The Privacy Rule gives the PHRC/IRB the right
to request that the investigator submit documentation
of the death of the decedent-subjects if it determines
that proof of death is necessary or justified.
-
Tracking
of disclosures:
Disclosures of decedent's identifiable health
information made pursuant to a waiver of authorization
or made pursuant to an assurance as permitted
by this policy must be tracked in accordance with
the accounting requirements of the Privacy Rule.
(See Partners Accounting of Disclosures Policy)
-
Minimum
necessary standard applies to the use and disclosure
of decedents' PHI.
(See Minimum Necessary Policy
|
