Medical Records and the Law

U.S. Federal Laws Relating to Acquisition and Use of Health Information 523covered entity will release medical records information to a researcherrequesting it, the covered entity will require written documentationof the fact that the researcher has obtained a valid HIPAA authorizationor IRB or privacy board waiver, or that the researcher’s accessto, and use of, the information qualifies for an exception to the authorizationor waiver requirement. In practice, many, if not all, coveredentities insist that such documentation be produced as part ofthe IRB or privacy board review process using forms that have beenapproved by the IRB or privacy board. This indirectly places on IRBsand privacy boards part of the responsibility of implementing the authorization,waiver, and exception provisions of HIPAA, even thoughHIPAA itself does not impose that responsibility on the IRB. 27 Asthe common point of contact for researchers seeking access to themedical records maintained by providers, the health informationmanagers of providers also bear part of the HIPAA complianceresponsibility. A significant aspect of their role is to collect forthe covered providers’ compliance records the various forms ofHIPAA-related documentation they obtained through the IRBprocess.Second, HIPAA also indirectly extends to other stakeholders, suchas industry sponsors, who seek, and in many cases contractually mandate,that they be given access by a researcher to PHI. These stakeholderswill likely be contractually bound, under the terms of theapplicable written research agreements, to comply with the requirementof the particular authorization, waiver, or exception.Third, many researchers also function as HIPAA covered providers,both apart from and in connection with certain clinical trials.In all cases, it is important for researchers who from time to timefunction as covered providers to remember that they may not freelyuse for research the PHI that they obtain from the medical records oftheir patients. HIPAA sets forth specific requirements with whichcovered providers must comply when using the information for what27For example, HIPAA requires no IRB involvement in the determination that an exceptionto the authorization or waiver requirement applies in a particular case. Nor doesHIPAA require an IRB review and approval of the authorization used in connection witha study when the authorization is not included as part of the same form as the CommonRule informed consent.