NRPM: Standards for Privacy of Individually Identifiable Health Information. § 164.510 Standards and implementation specifications for uses and disclosures for which individual authorization would not be required.


A covered entity could disclose protected health information to a health researcher for health research purposes subject to 45 CFR part 46 and purposes other than those subject to 45 CFR part 46, provided that the covered entity has obtained written documentation demonstrating that the applicable requirements proposed in this section have been met.

The burden associated with these proposed requirements is the time and effort necessary for a covered entity to maintain documentation demonstrating that they have obtained institutional review board or privacy board approval, which meet the requirements of this section. On an annual basis it is estimated that this proposed requirement will affect 1 % or 8,903 of covered entities. We further estimate that it will take an average of 1 hour per entity to meet these proposed requirements on an annual basis. Therefore, the total estimated annual burden associated with this proposed requirement is 8,903 hours.