NE SNIP PRIVACY WORKGROUP

Use and Disclosure of Protected Health Information Regarding a

Deceased Individual

Protected Health Information (PHI) for Decedents

Standard: Deceased Individuals A covered entity must comply with the requirements of this subpart with respect to PHI of a deceased person. §164.502(f)

Translation: You must follow the same use and disclosure rules for PHI of decedents as for any other individual

Verification Requirements

Standard: Verification Except for permitted uses where the individual has an opportunity to object: Verify identity of person requesting PHI

and authority to have access Obtain documentation (oral or written)

if disclosure conditioned on representations §164.514 (h)

Who is a Personal Representative?

Standard: Personal Representatives Treat personal representative as the individual for purposes of disclosure of PHI

Executor, Administrator authorized by law to act on behalf of individual’s estate §164.502 (f) & (g)

Permitted Disclosures

Law enforcement official to alert if death due to criminal conduct §164.512 (f)(4)

Coroners/medical examiners for identification, cause of death, other duties §164.512 (g)(1)

Funeral directors as necessary to carry out their duties §164.512 (g)(2)

Organ/tissue donation procurement agencies §164.512 (h)

Research on decedent’s information §164.512 (i)

Research Requirements

IRB/Privacy Board approval of waiver of authorization

Must confirm that: Disclosure sought solely for research on

protected PHI of decedent; Documentation of death; and PHI sought is necessary for the research

purposes §164.512 (h)(iii)

Waiver Requirements Documentation of approval must include: §164.512 (h)

Identification and date of action Waiver criteria approved by IRB/Privacy Board

No more than minimal risk Waiver will not adversely effect privacy rights Research cannot be practicably conducted without

this waiver Privacy risks reasonable in light of reasonably

expected results of research

More Waiver Criteria

Waiver criteria approved by IRB/Privacy Board Adequate plan to protect identifiers

from improper use/disclosure Plan to destroy identifiers at earliest

opportunity unless health/research justification for retention

Written assurances that PHI will not be reused/redisclosed (limited exceptions)

Recommendations

Note that the 2-year time limit for protection of PHI was eliminated in the final regulation

Revise your release of information policies and procedures to include permitted uses of decedent PHI

Remind staff of qualifications of personal representatives (no real change)