The Privacy Rule also permits research using the protected health information (PHI) of decedents. Neither an authorization from the subject’s legal representative nor a waiver is required. (However, please note that although permitted under HIPAA, these activities are already required to be reviewed by the IRB.)

The researcher must submit a request to CPHS that states that:

• The use or disclosure being sought is solely for research on the PHI of those who are deceased

• That the PHI being sought is necessary for the research

• At the request of the covered entity, documentation of the death of the individuals whose PHI is being sought must be provided

In most instances, this type of research will still be reviewed according to CPHS guidelines for expedited review.