NRPM: Standards for Privacy of Individually Identifiable Health Information. 9. Uses and disclosures for research. (§ 164.510(j))


In § 164.510(j), we propose to permit covered entities to use and disclose protected health information for research without individual authorization, provided that the covered entity receives documentation that the research protocol has been reviewed by an Institutional Review Board or equivalent body – a privacy board – and that the board found that the research protocol meets specified criteria (regarding protected health information) designed to protect the subject. Absent such documentation, the subject’s protected health information could be disclosed for research only with the individual’s authorization, pursuant to the authorization requirements in proposed § 164.508.

Our proposed requirements for this disclosure build on the requirements for such disclosure under the Federal regulation that protects human subjects in research conducted or funded by the Federal government, the Federal Policy for the Protection of Human Subjects (often referred to as the "Common Rule"), first published for several agencies at 56 Fed. Reg. 28,002-028, 032 (1991), and codified for the Department of Health and Human Services at 45 CFR part 46.