Home : Academic/Research : Health Sciences

Researchers may have a need to review PHI in preparation for research before a protocol or research proposal is submitted to the IRB. In such situations, the following requirements apply:

Protected health information may be disclosed to an internal researcher without patient authorization, provided that:

1. Use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;
2. No PHI is to be removed by the researcher in the course of review;
3. The PHI sought is necessary for research purposes; and
4. The researcher represents to the holder of the PHI that all of the preceding requirements are met.

PHI may be disclosed to external researchers to the extent allowed by HIPAA if the external researcher obtains the authorization required by Minnesota law and meets the four HIPAA requirements listed above.

Activities that do not meet the above requirements are not considered reviews preparatory to research under HIPAA and PHI may be accessed only as otherwise permitted by HIPAA and state law.

Disclosures of PHI for reviews preparatory to research must be accounted for using Administrative Procedure: Recording and Providing an Accounting of Disclosures.