Reproduced with permission from Medical
Research Law & Policy Report, Vol. 2, No. 1, 76-77 (Jan. 15,
2003).
Copyright 2003 by The Bureau of National Affairs, Inc. (800-372-1033)
| Type of PHI or Information Disclosed |
Purposes or Action Required |
Individual Authorization Required Under §164.508 |
Minimum Necessary Standard Applies §164.502(b).,
§164.514(d) |
Accounting Under §164.528 for a Period
of 6 Years From Disclosure |
| De-Identified Data |
Remove all identifiers pursuant to §164.514(b)(2). |
No. Can also disclose without authorization to
a business associate (subject to the applicable regulations)
solely for the purposes of the business associate carrying out
the de-identification. |
No, because properly de-identified information
no longer is PHI. |
No |
| "Statistical" Determination That
Information is Not PHI |
An expert meeting the standards of § 164.514(b)(1)
determines using statistical and scientific methods that the
risk is very small that the information used alone or in combination
with reasonably available information would permit recipient
to identify the individual subject of the information. |
No. The expert is opining that the information
is not PHI. |
No, because the information is de-identified and
no longer PHI. |
No |
| For Public Health Activities |
- Disclosures to public registries [§164.514(b)(i)]
- Disclosures for FDA safety monitoring purposes [§164.514(b)(iii)]
- Disclosures for other public health activities or as required
by law, as defined by the regulation.
|
No |
Yes, but a covered entity can rely on the requesting
public health authorities minimum necessary determination. For
routine and recurring disclosures, covered entities may develop
standard protocols that address the types and amounts of PHI
to be disclosed. |
Yes, but see special provisions at §164.528(b)(3)
if multiple disclosures have been made to the same person or
entity for a single purpose under § 164.512, which includes
disclosures for public health activities. |
| Limited Data Set |
- Disclosures to private registries
- Remove all facial identifiers pursuant to §164.514(e)
- Enter into a Data Use Agreement that meets the standards
of §164.514(e).
|
No. Can also disclose without authorization to
a researcher (acting as a business associate, subject to the
business associate regulations) solely for the purposes of such
business associate creating the limited data set. |
Yes |
No |
| For Research Purposes Upon IRB or Privacy Board
Waiver |
- Authorization can be waived or modified in accordance
with § 164.512(i)(1)(i)
- Waiver must be documented in accordance with § 164.512(i)(2)
|
As waived or modified by the IRB or Privacy Board. |
Yes |
Yes, but see special provisions at §164.528(b)(4)(i)
if disclosures have been made for 50 or more persons for a particular
research purpose during an accounting period. |
| Activities Preparatory to Research Under §164.512(i)(1)(ii) |
- Representations must be obtained from the researcher that
the PHI is sought for activities preparatory to research
and is necessary for research; and
- PHI must not be removed from premises.
|
No |
Yes |
Yes, but see special provisions at §164.528(b)(4)(i)
if disclosures have been made for 50 or more persons for a particular
research purpose during an accounting period. |
| Research on Decedent's PHI Under § 164.512(i)(1)(iii)
|
- Representations must be obtained from the researcher that
- the PHI is sought solely for research on PHI of decedents
- Researcher will provide documentation of death of individuals
if requested,
- The PHI is necessary for research.
|
No |
Yes |
Yes, but see special provisions at §164.528(b)(4)(i)
if disclosures have been made for 50 or more persons for a particular
research purpose during an accounting period. |
| With Individual Authorization |
Can be combined with an informed consent form,
but must meet requirements of §164.508. |
Yes, but can be for open ended period (such as
"until study is completed" or "none"). |
No |
No |
Our purpose in publishing this article is
to inform our clients and friends of recent developments in HIPAA.
It is not intended, nor should it be used, as a substitute for specific
legal advice as legal counsel may only be given in response to inquiries
regarding particular situations.
