Q&A: Disclosures of PHI for research

Q: If researchers want to obtain PHI for a person who died of COVID-19, what is the protocol for releasing that information? What are the HIPAA protections?

A: The protocol for such disclosures would be the same as for any other research involving PHI. If the researchers can’t use de-identified data, the research project needs to be approved by an Institutional Review Board (IRB) or a Privacy Board (PB). HIPAA requires researchers either to obtain authorization from (in this case) the personal representative of the deceased individual or to have the research project approved by an IRB or a PB.

Editor’s note: Chris Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS.