The Privacy Rule also permits research using the protected health information (PHI) of decedents. Neither an authorization from the subject’s legal representative nor a waiver is required. (However, please note that although permitted under HIPAA, these activities are already required to be reviewed by the IRB.)
The researcher must submit a request to CPHS that states that:
In most instances, this type of research will still be reviewed according to CPHS guidelines for expedited review.