The Privacy Rule provides protections to living and deceased individuals. To use decedents’ PHI for research purposes, a researcher must provide all of the following:
- Representation that the use or disclosure is solely for research involving the PHI of decedents (e.g., and not also the living relatives of decedents)
- Representation that the PHI is necessary for the research
- Documentation (at the request of the covered entity holding the PHI) of the death of the individuals whose PHI is sought.
Note: If the participant population contains both living and deceased individuals, the requirements for Authorization (or waiver or alteration) apply.
« Return to previous FAQs page