5.3 PHI in Clinical Research: IRB Waivers, Preparatory to Research, Decedents, and Limited Data Sets (DUA)

5.3 PHI in Clinical Research: IRB Waivers, Preparatory to Research, Decedents, and Limited Data Sets (DUA)

CHPS Core Standard: Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the disclosure of Protected Health Information (PHI) for clinical and biomedical research is governed by 45 CFR § 164.508 (Research Authorizations), 45 CFR § 164.512(i) (Uses and Disclosures for Research Without Authorization), and 45 CFR § 164.514(e) (Limited Data Sets and Data Use Agreements). Balancing the acceleration of medical science against individual privacy requires health data leaders to master IRB waiver mechanics, feasibility reviews, decedent protections, and contractual data covenants.

---

1. Defining Research Under HIPAA and the Baseline Authorization

Under 45 CFR § 164.501 (incorporating the Federal Policy for the Protection of Human Subjects, known as the Common Rule, 45 CFR Part 46), research is defined as:

"A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."

The Baseline: Research Authorization (45 CFR § 164.508)

The default legal mechanism for using or disclosing PHI in research is a signed, valid HIPAA authorization. Under the 2013 HIPAA Omnibus Rule, several historic restrictions on research authorizations were modernized:

• Compound Authorizations Permitted (45 CFR § 164.508(b)(3)(i)): Covered entities may combine a HIPAA research authorization with another legal document, most notably an Informed Consent document under the Common Rule or FDA regulations (21 CFR Part 50).
• Conditioning Research-Related Treatment (45 CFR § 164.508(b)(4)(i)): While covered entities are generally prohibited from conditioning clinical treatment on the signing of an authorization, a healthcare provider may condition the provision of research-related treatment (such as enrollment in an experimental clinical trial) on the patient executing an authorization for the use and disclosure of their PHI for that research.
• Flexible Expiration Terms (45 CFR § 164.508(c)(1)(v)): Unlike general authorizations, a research authorization does not require a discrete calendar expiration date. It may state that the authorization expires at the "end of the research study" or "none" when creating a research repository or central tissue bank.

---

2. The Three Statutory Non-Authorization Research Pathways (45 CFR § 164.512(i))

Obtaining signed authorizations from every individual is frequently impossible in retrospective population health studies, multi-decade registry analyses, or feasibility modeling. Under 45 CFR § 164.512(i), covered entities may use or disclose PHI for research without patient authorization under three explicit statutory pathways:

                    ┌────────────────────────────────────────────────────────┐
                    │ Research Uses & Disclosures Without Patient Authorization│
                    │                 (45 CFR § 164.512(i))                   │
                    └───────────────────────────┬────────────────────────────┘
                                                │
         ┌──────────────────────────────┼──────────────────────────────┐
         ▼                              ▼                              ▼
┌─────────────────┐            ┌─────────────────┐            ┌─────────────────┐
│   IRB / PRIVACY │            │   REVIEWS       │            │   RESEARCH ON   │
│   BOARD WAIVER  │            │ PREPARATORY TO  │            │   DECEDENTS'    │
│ § 164.512(i)    │            │    RESEARCH     │            │      DATA       │
│   (1)(i)        │            │ § 164.512(i)    │            │ § 164.512(i)    │
│ Full or partial │            │   (1)(ii)       │            │   (1)(iii)      │
│ waiver based on │            │ Protocol design │            │ Solely deceased │
│ 3 legal criteria│            │ & feasibility;  │            │ patients;       │
│                 │            │ NO PHI REMOVED  │            │ 50-year rule    │
└─────────────────┘            └─────────────────┘            └─────────────────┘

1. Institutional Review Board (IRB) or Privacy Board Waiver (45 CFR § 164.512(i)(1)(i))

A covered entity may use or disclose PHI pursuant to formal documentation that an Institutional Review Board (IRB) (constituted under FDA or HHS Common Rule regulations) or a specialized Privacy Board has approved a waiver or alteration of the authorization requirement.

Privacy Board Composition (45 CFR § 164.512(i)(1)(i)(B))

If an organization does not route research through an existing IRB, it may convene an ad-hoc Privacy Board. The Privacy Board must:

• Have members of varying backgrounds and appropriate professional competence as necessary to review the effect of the research protocol on the individual's privacy rights;
• Include at least one member who is not affiliated with the covered entity, not affiliated with any entity conducting or sponsoring the research, and not related to any person affiliated with such entities; and
• Ensure no member participates in a review if they have a conflict of interest.

The Three Mandatory Statutory Waiver Criteria (45 CFR § 164.512(i)(2)(ii))

To grant a full or partial waiver of authorization, the IRB or Privacy Board must formally determine and document that the research satisfies all three statutory criteria:

1. Criterion 1: The use or disclosure of PHI involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
   • An adequate plan to protect the identifiers from improper use and disclosure;
   • An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
   • Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted under this subpart.
2. Criterion 2: The research could not practicably be conducted without the waiver or alteration. (e.g., in a 20-year retrospective epidemiological study of 60,000 diabetic patients, locating and obtaining authorization from every patient is impossible, and attempting to contact them would introduce severe selection bias or emotional distress).
3. Criterion 3: The research could not practicably be conducted without access to and use of the PHI. (e.g., the scientific hypotheses require analyzing longitudinal hemoglobin A1c lab values correlated with specific geographic and clinical variables that cannot be evaluated using de-identified data).

Administrative Requirement: The waiver documentation must be signed by the IRB or Privacy Board Chair (or designee), specify whether it was reviewed under normal or expedited procedures, and be retained by the covered entity for six (6) years.

2. Reviews Preparatory to Research (45 CFR § 164.512(i)(1)(ii))

Clinical researchers often need to query institutional databases before drafting a research grant, finalizing a study protocol, or evaluating whether a sufficient patient population exists to support a clinical trial. Under this statutory exception, a covered entity may permit a researcher to access PHI based on receipt of three representations from the researcher:

1. Representation 1: Use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;
2. Representation 2: No PHI is to be removed from the covered entity by the researcher in the course of the review; and
3. Representation 3: The PHI for which use or access is sought is necessary for the research purposes.

[!CAUTION] The Subject Recruitment Trap: A critical candidate trap on the CHPS examination concerns patient recruitment. A researcher utilizing the 'Preparatory to Research' exception cannot contact prospective subjects directly to solicit trial participation! Under HHS OCR guidance, directly contacting patients constitutes active recruitment, which is part of the research study itself—not preparation. To recruit subjects, the researcher must either: (1) have an IRB-approved partial waiver of authorization for recruitment, (2) have the patient's treating physician make the initial contact, or (3) obtain direct authorization.

3. Research on Decedents' Information (45 CFR § 164.512(i)(1)(iii))

To utilize or disclose PHI of deceased individuals for research, the covered entity must obtain from the researcher three specific representations:

1. Representation 1: The use or disclosure is sought solely for research on the protected health information of decedents;
2. Representation 2: At the request of the covered entity, documentation of the death of such individuals will be provided (e.g., copy of death certificate, state vital statistics record, obituary);
3. Representation 3: The PHI sought is necessary for the research purposes.

The 50-Year Post-Mortem Rule (45 CFR § 164.502(f))

Prior to the 2013 HIPAA Omnibus Rule, PHI was protected indefinitely. The Omnibus Rule fundamentally altered this by establishing the 50-year post-mortem rule:

A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual. (45 CFR § 164.502(f))

Once an individual has been deceased for more than 50 years, their medical records cease to be PHI under federal law. Historical and archival medical records (e.g., 1918 influenza epidemic records) can be disclosed for research without any HIPAA representations, authorizations, or IRB waivers.

---

3. Limited Data Sets (LDS) and Data Use Agreements (DUA) (45 CFR § 164.514(e))

In many research, public health, and healthcare operational workflows, analysts require geographic and temporal granularity that Safe Harbor de-identification completely strips, but the research team does not require direct identifiers like names, MRNs, or phone numbers. To bridge this divide, HIPAA created the Limited Data Set (LDS).

What is a Limited Data Set?

Under 45 CFR § 164.514(e)(2), a Limited Data Set is Protected Health Information that excludes 16 specified direct identifiers of the individual or of relatives, employers, or household members of the individual.

Comparison of Identifiers Stripped:

SAFE HARBOR (45 CFR § 164.514(b)(2))    LIMITED DATA SET (45 CFR § 164.514(e)(2))
Strips 18 Identifiers:                  Strips 16 Direct Identifiers:
├── Names                               ├── Names
├── Geographic units < State            ├── Postal address (other than city/state/ZIP)
│   (All cities, counties, full ZIPs)   ├── Telephone numbers
├── ALL DATES (Except Year)             ├── Fax numbers
│   (All days/months stripped)          ├── Email addresses
├── Ages > 89 aggregated                ├── Social Security numbers
├── Phone, Fax, Email                   ├── Medical record numbers
├── SSN, MRN, Health Plan IDs           ├── Health plan beneficiary numbers
├── Account, License, Vehicle IDs       ├── Account numbers
├── Device IDs, URLs, IPs               ├── Certificate/license numbers
├── Biometrics, Full-face photos        ├── Vehicle identifiers and serials
└── Unique codes                        ├── Device identifiers and serials
                                        ├── Web URLs
   CRITICAL ANALYTICAL ELEMENTS         ├── IP address numbers
   PERMITTED IN A LIMITED DATA SET:     ├── Biometric identifiers
   ✓ Full Dates (Birth, Death, Admit)   └── Full-face photos
   ✓ Exact Ages (Including 90+)
   ✓ City, Town, County, State
   ✓ Full 5-Digit ZIP Codes!

Permissible Uses of a Limited Data Set (45 CFR § 164.514(e)(3))

A covered entity may disclose an LDS only for the purposes of:

1. Research;
2. Public Health activities; or
3. Health Care Operations.

Critical Candidate Trap: An LDS may never be disclosed for marketing, commercial sale, or direct clinical treatment. Furthermore, an LDS remains PHI; therefore, it cannot be disclosed without executing a mandatory contract.

Mandatory Terms of a Data Use Agreement (DUA) (45 CFR § 164.514(e)(4))

A covered entity may disclose a Limited Data Set only if the entity obtains satisfactory assurances from the recipient in the form of a signed Data Use Agreement (DUA). Under federal law, the DUA must:

1. Establish Permitted Uses: Establish the permitted uses and disclosures of the LDS by the recipient, strictly limited to research, public health, or healthcare operations;
2. Establish Authorized Users: Establish who is permitted to use or receive the Limited Data Set;
3. Recipient Commitments: Mandate that the data recipient agrees to:
   • Not use or further disclose the information other than as permitted by the DUA or as otherwise required by law;
   • Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the DUA;
   • Report to the covered entity any use or disclosure of the information of which it becomes aware that is not provided for by the DUA (breach and incident reporting);
   • Ensure that any agents or downstream subcontractors to whom it provides the LDS agree to the same restrictions and conditions that apply to the recipient; and
   • ABSOLUTE STATUTORY PROHIBITIONS:
     • NOT to re-identify the information; and
     • NOT to contact the individuals who are the subjects of the data.

Accounting of Disclosures Exemption (45 CFR § 164.528(a)(1)(viii))

A major administrative benefit of utilizing a Limited Data Set under a DUA is its treatment under the patient's Right to an Accounting of Disclosures. Under 45 CFR § 164.528(a)(1)(viii), disclosures of a Limited Data Set made pursuant to a valid DUA are statutorily exempt from the accounting of disclosures requirement. If an organization discloses 100,000 patient records as an LDS for cancer research, it is not required to log those 100,000 disclosures in each individual patient's accounting log.

---

4. Comprehensive Research Governance and Disclosure Framework

---

5. CHPS Exam Tips and Common Candidate Traps

[!TIP] Exam Tip: Accounting of Disclosures Tracking When an exam item asks about research disclosures and the Accounting of Disclosures log under 45 CFR § 164.528:

• Disclosures made with a patient's signed Authorization are EXEMPT.
• Disclosures of a Limited Data Set under a DUA are EXEMPT.
• Disclosures of Full PHI under an IRB or Privacy Board Waiver are MANDATORY to track and include in the patient's accounting log upon request!

[!WARNING] Candidate Trap: DUA vs. BAA Distinction Do not confuse a Data Use Agreement (DUA) with a Business Associate Agreement (BAA). A BAA is required when an external vendor performs a service on behalf of the covered entity. A DUA is used when an external researcher or public health agency receives a Limited Data Set for their own research or public health investigations, not on behalf of the hospital. A researcher receiving an LDS under a DUA is not a Business Associate.

[!CAUTION] Candidate Trap: The Preparatory to Research Contact Prohibition Always scrutinize exam questions where an investigator claims they accessed charts under the 'preparatory to research' provision and then called the patients. This is illegal. Access preparatory to research permits looking at records within the covered entity solely to determine feasibility or design a protocol. It categorically forbids removing data and forbids contacting patients.