Medical Records and the Law

526 CHAPTER 14: HEALTH INFORMATION IN MEDICAL RESEARCHto a third party except as required by law, for authorized oversight ofthe research study, or for other research uses and disclosures permittedby the Privacy Rule.Second, the IRB or privacy board must determine that the researchcould not practicably be conducted without the waiver or alteration.Finally, the board must decide and document that the research couldnot practicably be conducted without access to, and use of, PHI. Thegrant of waiver or alteration of the authorization requirement must beadequately documented, and documentation of such waiver must bemaintained for at least six years from the later of the date of creation orthe date when the authorization was last in effect. 36 The waiver provisionhas been used from time to time to grant a limited waiver solely forthe purpose of recruiting subjects. Following recruitment, an authorizationwould be needed to actually conduct the research.Research Exceptions to Authorization or Waiver RequirementsThe Privacy Rule contains three explicit exemptions that permit coveredentities to use or disclose PHI in connection with medical researchwithout obtaining a valid authorization or valid authorizationwaiver: (a) review preparatory to research, 37 (b) research involving useof PHI regarding decedents, 38 and (c) disclosures in connection withcertain obligations to report information in connection with certainpublic health activities and FDA reporting requirements. 39This exception permits a researcher to use or disclose PHI in connectionwith activities preparatory to research, such as preparation of aresearch protocol (including, without limitation, designing a study, assessingthe feasibility of conducting a study, and assessment of whethera sufficient and appropriate subject pool exists to support the study), ifboth of the following criteria are met: (a) the principal investigator doesnot record or remove the PHI from the provider entities, and (b) theinformation sought is necessary for the purposes of the research. 403645 C.F.R. § 164.530(j)(2).3745 C.F.R. § 164.512(i)(1)(ii).3845 C.F.R. § 164.512(i)(1)(iii).3945 C.F.R. § 164.512(b)(1). In addition to these research-related exceptions to thePrivacy Rule, covered entities do not need to obtain individuals’ authorization to usePHI in treatment, payment, or healthcare operations. 45 C.F.R. §§ 164.506(c) and164.502(a)(1)(ii).4045 C.F.R. §§ 164.506(c) and 164.502(a)(1)(ii).