Skip to Main Navigation
Skip to Main Content
The University of Texas at Dallas

HIPAA Privacy Manual

Section 6: Research Uses and Disclosures of PHI

Effective Date: April 14, 2003
Last Revised: July 24, 2006 Includes Texas Privacy Law

POLICY

UTD shall obtain an individual’s written authorization or satisfy an exception to the authorization requirement before using or disclosing the individual’s PHI for research purposes. UTD employees whose responsibilities include using or disclosing PHI for research purposes shall be familiar with this policy and shall follow these procedures.

PROCEDURE

1. Determine That the Requested Use or Disclosure Is for Research Purposes. This Policy only applies when the purpose of the requested use or disclosure is research, defined as a systematic investigation including research development, testing, and evaluation that is designed to develop or contribute to generalizable knowledge. This Policy does not apply if the purpose of the requested use or disclosure is health care operations, defined to include quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination.

2. Determine That the Information To Be Used or Disclosed Is PHI. This Policy only applies if the information being used for research is PHI. If the information being used or disclosed has been completely de-identified in accordance with Section 5.1 of this Manual, this Policy does not apply and UTD may use or disclose the de-identified information without following the procedures set forth in this Policy.

3. Obtain Individual Authorization or Satisfy an Exception to the Authorization Requirement. Once UTD has determined that the purpose of the requested use or disclosure is research and that the information to be used or disclosed is PHI, UTD shall obtain the written authorization of the individual who is the subject of the PHI or satisfy an exception to the authorization requirement before using or disclosing the individual’s PHI for research purposes. Accordingly, to use or disclose PHI for research purposes, UTD must satisfy one of the following:

a. Obtain Written Authorization. UTD shall obtain the written authorization of each individual who is the subject of the PHI being used or disclosed for the research purposes.

b. Obtain Representations From the Researcher That the Review Is Preparatory to Research. , in order to use PHI UTD may rely on the following written representations from the researcher:

i) the use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;

ii) no PHI will be removed from UTD’s premises by the researcher in the course of the review; and

iii) the PHI for which the use or access is sought is necessary for the research purposes.

c. UTD may disclose PHI in reliance on the above written representations only if the research project has been approved by the UTD IRB.

d. UTD’s use or disclosure of PHI under this paragraph 3(b) may enable a researcher to do the following:

(i) review, but not remove, PHI to determine whether UTD has PHI relating to prospective research participants who may meet the eligibility criteria for enrollment in the researcher’s study; or

(ii) make a determination regarding whether there are a sufficient number of patients with a particular health condition within the community that would make the researcher’s study feasible.

In addition, this paragraph 3(b) permits an UTD researcher to use PHI to contact prospective research subjects, but it does not permit a researcher who is not part of UTD’s workforce to obtain PHI to contact prospective research subjects.

e. Obtain Representations and Documentation From the Researcher That the Research Relates to Decedents’ Information. Using sample Representation Form (see Appendix: A.7.2), in order to use PHI UTD may rely on the following from the researcher:

i) a representation that the use or disclosure is sought solely for research on the PHI of decedents;
ii) documentation, at the request of UTD, of the death of such individuals; and
iii) a representation that the PHI for which use or disclosure is sought is necessary for the research purposes.

f. UTD may disclose PHI in reliance on the above only if the research project has been approved by the UTD IRB.

4. Obtain the UTD IRB or HIPAA Compliance Steering Committee Approval of the Waiver of or Alteration to the Otherwise Required Authorization.

a. UTD may rely on written documentation regarding the following:

i) The waiver of or alteration to the authorization has been approved by the IRB or a HIPAA Compliance Steering Committee meeting specified standards;
ii) A statement identifying the IRB or HIPAA Compliance Steering Committee and the date on which the alteration or waiver of authorization was approved;
iii) The IRB or HIPAA Compliance Steering Committee has determined that the alteration or waiver, in whole or in part, of authorization, satisfies specified criteria;
iv) A brief description of the PHI for which use or access has been determined to be necessary by the IRB or HIPAA Compliance Steering Committee;
v) A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures; and
vi) The documentation of the alteration or waiver of authorization must be signed by the chair or other member, as designated by the chair, of the IRB or HIPAA Compliance Steering Committee.

b. UTD may disclose PHI in reliance on the above documentation only if the research project has been approved by the UTD IRB.

5. Disclose a Limited Data Set Pursuant to a Data Use Agreement. UTD is permitted to use or disclose a limited data set of information for research purposes pursuant to a data use agreement without the prior written authorization of the individual(s) who is/are the subject of the information.

6. Make Minimum Necessary Uses and Disclosures.

a. For purposes of paragraph 3(b) of this Policy, UTD is permitted to rely on the requesting researcher’s representation that the purpose of the request is to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research and that the request meets the minimum necessary requirements; UTD may only disclose to the requesting researcher the PHI specifically requested by the researcher.

b. For purposes of paragraph 3(c) of this Policy, UTD is permitted to rely on the requesting researcher’s representation that the purpose of the request is for research on the PHI of decedents and that the request meets the minimum necessary requirements; UTD may only disclose to the requesting researcher that PHI specifically requested by the researcher.

c. For purposes of paragraph 3(d) of this Policy, UTD is permitted to rely on the statement in the IRB or HIPAA Compliance Steering Committee Waiver or Alteration Form establishing the specific PHI for which use or access has been determined to be necessary by the IRB or HIPAA Compliance Steering Committee; UTD shall only disclose the PHI specifically identified in the IRB or HIPAA Compliance Steering Committee Waiver or Alteration Form.

7. Include Required Disclosures in the Accounting of Disclosures. To the extent UTD discloses PHI for research purposes pursuant to an authorization in accordance with paragraph 3(a) of this Policy, or discloses a limited data set pursuant to a data use agreement in accordance with paragraph 3(e) of this Policy, the disclosure(s) need not be included in the accounting. However, to the extent UTD discloses PHI for research purposes pursuant to an exception to authorization (i.e., in accordance with paragraphs 3(b), (c), or (d) of this Policy), the disclosure must be included in the accounting. An individual who is responsible for disclosing PHI pursuant to paragraphs 3(b), (c), or (d) of this Policy shall ensure that the information necessary to complete an accounting of disclosures pursuant to Section 4.6 of this Manual is provided to the Medical Records Supervisor who is responsible for preparing such accountings.

8. Notice of Privacy Practices. UTD will ensure that its Notice of Privacy Practices informs individuals of the possible disclosures for Research purposes contained in this section.