Reviews preparatory to research and research involving the PHI of decedents are two instances that do not require subject authorization.
In addition, activities involved in preparing for research, covered entities may use or disclose PHI to a researcher without an individual’s Authorization, a waiver or an alteration, or a data use agreement. The covered entity must obtain from a researcher representations that:
- the use or disclosure is requested solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research,
- the PHI will not be removed from the covered entity in the course of review, and
- the PHI for which use or access is requested is necessary for the research.
« Return to previous FAQs page