For epidemiological or laboratory research from databases, repositories of tissue samples, or other clinical data, critical
threshold issues are posed for the entity that holds that information. Under what terms did they receive permission to compile
the data? Can they simply provide access to researchers upon request? Generally, the initial authorization to collect the
data will determine the extent to which it can be disclosed.
When Can PHI Be Used?
There are three circumstances in which PHI can be used for research:
- when the information has been de-identified (so it's no longer PHI)
- with the patient's written permission (authorization)
- under certain other limited exceptions that encourage research.
De-identification De-identification is a helpful concept, but de-identifying is difficult, because HIPAA requires the elimination of 18 separate
elements that could be used to identify the individual—including name, address, social security number, birth date, admission
and discharge dates, and zip code.
If a study requires only a patient's age range (under 89), sex, and general area of the country, de-identification may be
an option because this kind of general demographic information is not considered PHI. Thus, the covered entity could disclose
it to an unaffiliated researcher or sponsor without any other HIPAA requirements or obligations. If the covered entity has
developed a method of coding additional protected information about the individual from whom the de-identified information
was obtained, however, the code itself cannot be disclosed.
Patient authorization Authorizations are by far the most common method of facilitating access to PHI. Authorizations are specific permissions by
the individual under HIPAA for use or disclosure of PHI for a particular purpose. The authorization for research must pertain
to a specific study, or to the creation of a research repository or database. It must be in writing and signed by the individual,
and the actual uses and disclosures must be described to the extent possible.
At a minimum, an authorization must express the following: "Because you are participating in a research study of a drug being
developed by Company A, information about you and your treatment with this drug will be provided to Company A. By signing
this authorization, you agree to the disclosure of your PHI to Company A."
There are three different types of consent that a patient must give as part of the research process:
- consent to treatment
- consent to participation in research, which has many required elements under federal law
- HIPAA authorization in which the patient consents to the use and disclosure to others of healthcare information that could
be used to identify him or her.
These three different consents may be combined in a single document or treated separately. As a practical matter, it generally
is easier for a patient to be confronted with one document rather than three.
The original privacy regulations required that the authorization have a specific expiration date. But the revised regulations
permit the use of the word "none" or "end of research study" to satisfy that element of the authorization. This is particularly
applicable to the creation of databases and repositories.
There are other required statements that must appear in authorizations. For example, authorizations must contain a statement
of the individual's right to revoke the authorization, with an explanation of how that can be done. Fortunately, information
already used or disclosed does not have to be retracted when an authorization is revoked; any information on which the researcher
already is relying for completion of the research, or that already has been provided to the research sponsor, can continue
to be used. Going forward, the revocation only will affect disclosure of information that has not become integral to the research
There must be a statement about whether participation in the research study is conditioned on the signing of the authorization,
which is often the case. Permitting this use of the authorization encourages research. By contrast, medical treatment for
a patient not participating in a research study cannot be conditioned upon the signing of an authorization for any other purpose.