Adams School of Dentistry: Procedure for Access to PHI for Research Purposes

Title

Adams School of Dentistry: Procedure for Access to PHI for Research Purposes

I. Introduction

A. Purpose

The purpose of this Procedure is to establish how requests to access patient records for research purposes will be reviewed, approved, and processed.

B. Scope

This Procedure applies to all UNC Adams School of Dentistry personnel who seek to access Protected Health Information (PHI) for research purposes.

II. Procedure

A. Requirements

1. Requests for access to PHI for research purposes, including both physical records and electronic records (e.g. EPR, Ortho II), must be made to the School's HIPAA Privacy Officer. Requests will be processed in accordance with the HIPAA Research Policy.
2. The request must be accompanied by the Adams School of Dentistry "Request for Access to PHI for Research” form and any other required documentation described on form. The School's HIPAA Privacy Officer will not approve the use or disclosure of PHI for research purposes unless the researcher has submitted the required documentation.
3. Personnel who work in the Patient Records Office, the Office of Computing and Information Systems (OCIS), or any other unit in the Adams School of Dentistry that stores PHI shall not release PHI for research purposes without receiving verification from the School's HIPAA Privacy Officer (as evidenced by his or her signature on the access request form) that the researcher has submitted all required documentation and is approved for access to the requested information.
4. Access to PHI must be limited to a period of time not to exceed the duration of the research protocol.

B. Permitted Reasons for Granting Access

1. Authorization signed by the patient (or copy of informed consent document signed prior to 4/14/2003). The request must include a copy of the following:
   1. Adams School of Dentistry "Request for Access to PHI for Research" form
   2. IRB approval letter
   3. Valid authorization from each patient
2. IRB Waiver of Authorization (or IRB waiver of informed consent approved prior to 4/14/2003). This may include a Limited Waiver of Authorization Solely for the Purpose of Prescreening and/or Recruiting Potential Research Participants. The request must include a copy of the following:
   1. Adams School of Dentistry "Request for Access to PHI for Research" form
   2. IRB approval letter
   3. IRB waiver
3. Only Review Preparatory to Research: This scenario does not include access to PHI for research subject eligibility prescreening and/or recruitment contact. The request must include a copy of the Adams School of Dentistry "Request for Access to PHI" form, which includes an affirmation that the researcher:
   1. will not record any PHI;
   2. will not remove any PHI from the records;
   3. will only access or use PHI that is necessary for preparation for research; and
   4. will not use PHI accessed in this review to prescreen individuals or make contact with individuals for recruitment or other research purposes
4. Only Decedents: The request must include a copy of the Adams School of Dentistry "Request for Access to PHI for Research" form, which includes an affirmation that the researcher:
   1. will only access and use PHI of decedents;
   2. will only access and use PHI that is necessary for the research study; and
   3. upon request, can provide documentation of the death of the individuals whose PHI is accessed and used
5. Limited Data Sets: A limited data set is nearly de-identified. All direct identifiers have been removed except for geographic information and all elements of dates relating to an individual. The request must include a copy of the following:
   1. Adams School of Dentistry "Request for Access to PHI for Research" form
   2. IRB approval letter
   3. Data Use Agreement
6. De-Identified Information: The request must include a copy of the Adams School of Dentistry "Request for Access to PHI for Research" form.

C. Accounting of Disclosures

An individual may request a written accounting of all PHI disclosures that occurred during the six years (or shorter time period if requested) prior to the date of the request. This accounting will be provided by the School's HIPAA Privacy Officer in accordance with The University of North Carolina Accounting of Disclosures of Protected Health Information (PHI) Policy.

III. Related Requirements

External Regulations

1. UNC-CH Privacy of Protected Health Information Policy
2. UNC-CH HIPAA Research Policy
3. UNC-CH Accounting of Disclosures of PHI Policy

IV. Contact Information