MINIMUM NECESSARY STANDARD: RESEARCH ACTIVITIES

The HIPAA Privacy Rule requires Partners and its affiliated hospitals and providers to make all reasonable efforts to use or release only the "minimum necessary" identifiable health care information to achieve the intended purpose. The minimum necessary standard does not apply to 1) treatment-related requests or disclosures of health care information, or 2) situations in which an individual has signed an authorization for the use or disclosure of identifiable information (such as in a clinical trial), and 3) other limited exceptions that apply to administrative requirements. Partners policy describes how the minimum necessary standard applies generally, and this PHRC policy describes how the minimum necessary standard applies to research (please refer to Partners minimum necessary policy and the policy of individual entities as needed).

I. Research Pursuant to an Authorization (e.g., clinical trial)
If a researcher obtains written authorization from subjects to use or disclose their protected health information, the minimum necessary standard does not apply. However, the authorization must describe in a reasonably specific way, among other things, what information will be used or disclosed, by whom and to whom, and for what purposes.

II. Research Pursuant to a Waiver of Authorization (e.g., medical records research)
If a researcher requests that the PHRC approve a waiver of individual authorization, then the minimum necessary standard applies. The researcher must describe in the waiver request specifically what health care information is necessary for the research. If the researcher requests access to electronic health care information (either medical records or the Research Patient Data Registry (RPDR)), the researcher should identify the fields that will be searched in order to conduct the research. If the researcher requires access to paper records, then the researcher should identify the specific information that s/he will look for and retain to conduct the research.

III. Research Using a Limited Data Set
The Privacy Rule also applies the minimum necessary standard to the use or disclosure of a limited data set for research. Accordingly, a researcher must determine what types of data are necessary to conduct the research and must clearly describe those in the protocol submitted to the PHRC. For more information, see the PHRC policy on Limited Data Sets.

IV. Research Using Decedents Protected Health Information
The Privacy Rule also applies the minimum necessary standard to the use or disclosure of decedents protected health information.

V. Uses Preparatory to Research
Any uses under the provision preparatory to research are limited to minimum necessary.