Guidance on Future Research Authorizations From the HHS

The Department of Health and Human Services (HHS) Office of Civil Rights (OCR) issued a new guidance in June 2018 that provides clarification on the use and disclosure of protected health information (PHI) for research.

Generally, authorizations for the use or disclosure of PHI for future research must include a description of each purpose of the requested use or disclosure. OCR had already provided that authorizations for future research did not need to specify each specific future study, if the studies to be conducted were not yet determined. The authorization does need to adequately describe the purposes for which the PHI will be used in the future such that it would be reasonable for the individual to expect that his or her PHI could be used or disclosed for such future research.

The OCR guidance also clarified that an authorization for future research use or disclosure of PHI must contain an expiration date or an expiration event. In the case of authorizations for future research, the statement “at the end of the research study” or “none” is sufficient. Additionally, an example of an expiration event would be a statement that the authorization will remain valid unless and until it is revoked by the individual.

The guidance also contains information on the requirement to inform individuals that they have the right to revoke an authorization after it is provided and the appropriate mechanisms by which someone could revoke an authorization for future research purposes.

For questions about HIPAA authorizations for research, or other privacy-related questions in the research context, contact the Research Compliance Program at researchcompliance@medstar.net.