Section 19: Health Record Research
The following is the IRB policy concerning research involving the study of medical records or other forms of protected health information (PHI) (See Section 2: Definitions). The policy is not intended to supersede any current medical records guidelines or other policies concerning PHI.
19.2 Use of Protected Health Information
Research projects may involve the collection, disclosure, or use of PHI and such studies raise issues of confidentiality that must be carefully addressed by the investigator and the official custodian of the records. At some institutions, it likely that PIs will desire to use individual’s PHI, collected at that institution, for research purposes. In these cases, potential subjects should:
- Be informed of this possibility upon entry into the institution; and
- Be given an opportunity to either provide or decline authorization to allow use of their PHI for research purposes.
If authorization is not obtained initially and, depending upon the design of the study, federal (HIPAA) (See Section 2: Definitions) or state law may require the investigator to obtain specific authorization for the use of the PHI in that particular study. The specific, approved HIPAA-related authorization verbiage can be found in the HIPAA Research Authorization. The verbiage may be modified slightly, but it is advised that the suggested wording be used as much as possible. If the use or disclosure of PHI involves minimal risk for the subjects, a request for waiver of the requirement for signed authorizations may be requested (See Section 19.5).
19.3 De-identified PHI
PHI can be used or disclosed for research purposes if it has been de-identified and linkage back to a specific subject would not be possible. National Institutes of Health Department of Health Regulations at 45 CFR 164.514(e) provides more details for de-identified information.
19.4 Identifiable PHI
Research use or disclosure of identifiable PHI with authorization of the research subject is permitted providing that use or disclosure is for only the PHI that was originally authorized. In order to use or disclose additional information, the PI would either have to obtain authorization or request a waiver of the requirements to obtain authorization.
To use or disclose identifiable PHI without authorization of the research subject, the PI must accomplish one of the following:
- Complete and submit a Request for the Use of Protected Health Information for obtaining authorization for use of PHI.
- Provide written documentation that the use or disclosure of PHI is solely used to design a research protocol or to assess feasibility of conducting a study.
- Document that the use or disclosure is solely for research on the PHI of decedents.
19.5 Waiver of the Requirement for Obtaining Authorization
The IRB must review requests for waiver (Request for the Use of Protected Health Information) of the requirement for obtaining authorization for use and disclosure of PHI. If a waiver is approved, the IRB must notify the investigator in writing of its determination. PIs must maintain in their files the letter from the IRB which, in addition to the other required information listed below, identifies the IRB and the date on which the waiver or alteration of the requirements to obtain authorization was approved by the IRB. The letter should also include a statement that the IRB has determined that the waiver or alteration satisfies the following criteria:
- The use or disclosure of PHI involves no more than minimal risk to the research subjects;
- The alteration or waiver will not adversely affect the privacy rights and welfare of the subjects;
- The research cannot practicably be conducted without the alteration or waiver;
- The research could not practicably be conducted without access to or the use of the PHI;
- The privacy risks to individuals whose PHI is to be used or disclosed are reasonable in relation to the anticipated benefits, if any, to the individuals, and the importance of the knowledge that may reasonable be expected to result from the research;
- There is an adequate plan to protect the identifiers from improper use and disclosure;
- There is an adequate plan to destroy the identifiers at the earliest possible opportunity consistent with the conduct of the research, unless there is a health or research justification for retaining the identifiers, and;
- There are adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of PHI would be permitted by this policy.
The IRB letter should also contain a brief description of the PHI for which use or access has been determined by the IRB to be necessary, a statement that the waiver or alteration was approved by Expedited Review or at a convened meeting, and the letter should be signed by the IRB Chair or the Chair’s designee.