Institutional Review Board

USE OF PROTECTED HEALTH INFORMATION DURING ACTIVITIES PREPARATORY TO RESEARCH

HIPAA Privacy Rule 

Under the HIPAA Privacy Rule, covered entities - health plans, health care clearinghouses, and health care providers who electronically transmit any health information - are permitted to use and disclose protected health information (PHI) for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule. For activities involved in preparing for research, covered entities may use or disclose PHI to a researcher without an individual's authorization, a waiver or an alteration of authorization, or a data use agreement. Under such circumstances, however, the covered entity must obtain from a researcher, representations that:

  1. The use and disclosure is requested solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;
  2. The PHI will not be removed from the covered entity in the course of review; and, 
  3. The PHI for which use or access is requested is necessary for the research. 

Certification or representation is not required if no HIPAA identifiers will be viewed. For instance, a researcher may evaluate research feasibility by interrogating an electronic medical record  only for total number of patients with a specific diagnosis without viewing individual records or requesting identifiable data.

Activities Preparatory to Research

Activities preparatory to research include activities conducted for the purpose of:

  1. Developing a research question or hypothesis; 
  2. Preparing a research protocol; 
  3. Writing a grant application; or, 
  4. Assessing the feasibility of conducting a study.

The preparatory to research provision also allows a researcher to identify prospective research participants for purposes of seeking their authorization to use or disclose protected health information for a research study (e.g., by screening of electronic medical records). In addition, under 45 CFR 164.502(a)(1)(i), the Rule permits a covered entity to disclose protected health information to the individual who is the subject of the information. Therefore, covered health care providers and patients may discuss the option of enrolling in a clinical trial without patient authorization, and without an Institutional Review Board (IRB) or Privacy Board waiver of the authorization. However, a researcher who is not a part of the covered entity may not use the preparatory research provision to contact prospective research subjects. Furthermore, as best practice, a researcher or study team member who is not part of the routine care team should only contact the potential subject through a member of the subject's routine care team.

Procedures

  1. Download the Request for Review of PHI Preparatory to Research form
  2. Complete and sign the form 
  3. Obtain approval/signature of the Authorizing Official of the covered entity 
  4. Submit a copy of the signed form to the IRB Office at IRBOffice@lsuhsc.edu

Covered Entities  

LSUHSC investigators conduct research at, or in collaboration with individuals at, many different health care provider institutions. Examples include University Medical Center, Children's Hospital - NOLA, LSU Health Network facilities, and Ochsner Health System among others.

To access PHI under the preparatory to research provision, the investigator should obtain approval using procedures established by the relevant covered entity. Then submit documentation of the approval to the LSUHSC IRB Office at IRBOffice@lsuhsc.edu.

Alternatively, an investigator may obtain access to PHI from the covered entity following the procedure outlined below.

Links to Additional Information