1. Purpose

To define the permitted pathways for using and disclosing protected health information for research at Quillbrook, and to ensure every use is authorised, limited to the minimum necessary, and documented.

2. Scope

Applies to all workforce members who create, receive, use, disclose or maintain protected health information for research, recruitment, feasibility assessment, monitoring, publication or data sharing, in any medium.

3. Responsibilities

• HIPAA Privacy Officer: Owns this procedure, reviews authorisations and waiver requests, and investigates complaints and incidents.
• Principal Investigator: Ensures every use of protected health information in the study has a valid pathway and is limited to the minimum necessary.
• Regulatory Affairs: Submits authorisation and waiver documentation to the IRB and files approvals.
• All Workforce Members: Access protected health information only as required for their assigned duties and report suspected privacy incidents immediately.

4. Definitions

Protected health information (PHI)

Individually identifiable health information transmitted or maintained in any form or medium by a covered entity.

Research authorisation

A written, signed permission from the individual meeting the requirements of 45 CFR 164.508 that allows specified uses and disclosures of PHI for a research study.

Waiver of authorisation

An IRB or Privacy Board determination under 45 CFR 164.512(i) that the research may use PHI without individual authorisation because defined criteria are met.

Limited data set

PHI that excludes the sixteen direct identifiers listed at 45 CFR 164.514(e) and may be disclosed under a data use agreement; dates and certain geographic detail may remain.

De-identified information

Health information from which identifiers have been removed under the Safe Harbor method of 45 CFR 164.514(b)(2) or by a qualified statistician's Expert Determination under 164.514(b)(1); it is not PHI.

Minimum necessary

The requirement to limit use, disclosure and requests for PHI to the least amount needed to accomplish the intended purpose.

5. Procedure

1. Identify and document, before any PHI is used, which lawful pathway applies to each research activity: individual authorisation, IRB or Privacy Board waiver, a limited data set with a data use agreement, de-identified data, a review preparatory to research, or research on decedents' information.
2. Use the IRB-approved research authorisation form, which must be written in plain language and must specify the PHI to be used, who may use and receive it, the purpose, the individual's right to revoke and how, the expiration event, and the consequences of refusing to sign.
3. Obtain the individual's signature and date on the authorisation before using or disclosing their PHI for the study; do not combine the research authorisation with any other authorisation except as expressly permitted.
4. Provide a copy of the signed authorisation to the individual and retain the original in the research record for at least six years from the last effective date.
5. Where authorisation is impracticable, request an IRB or Privacy Board waiver and document the required findings: that the use presents no more than minimal risk to privacy, including an adequate plan to protect identifiers, an adequate plan to destroy identifiers at the earliest opportunity or a justification for retention, and written assurance that PHI will not be reused or disclosed except as permitted; that the research could not practicably be conducted without the waiver; and that it could not practicably be conducted without access to PHI.
6. Process revocation of an authorisation immediately in writing; stop further use and disclosure, except to the extent the site has already relied on the authorisation or must maintain the integrity of the study, and document the revocation date.
7. Conduct reviews preparatory to research only to prepare a protocol or assess feasibility, using PHI solely within Quillbrook, recording no PHI outside the review, and removing no PHI from the covered entity; document the representations made for each review.
8. Apply minimum necessary to every use, disclosure and request: use the study identifier rather than the name or medical record number wherever possible, request only the data elements the protocol requires, and never copy an entire medical record when specific results suffice.
9. De-identify using the Safe Harbor method by removing all eighteen identifier categories, including names, all geographic subdivisions smaller than a state, all dates more specific than year, ages over eighty-nine, telephone and fax numbers, email addresses, social security, medical record, health plan, account, certificate, licence, vehicle, device, URL, IP address, biometric identifiers and full-face images, together with any other unique identifying number or code, and confirm no actual knowledge that the remaining information could identify the individual.
10. Alternatively, obtain an Expert Determination by a qualified statistician documenting the methods, the assumptions, and the conclusion that the risk of re-identification is very small; retain the written determination.
11. Disclose a limited data set only under an executed data use agreement that specifies permitted uses, prohibits re-identification and contact of individuals, requires safeguards, and obliges the recipient to report any unauthorised use.
12. Verify the identity and authority of any person requesting PHI before disclosing, and confirm the disclosure pathway; never disclose to a sponsor, monitor, vendor or registry without a documented basis.
13. Record every disclosure that is subject to accounting, including waiver-based disclosures, in the accounting of disclosures log maintained under HIP-004.
14. Transmit PHI only by approved encrypted channels per HIP-002, never by personal email, personal cloud storage, unencrypted removable media, or messaging applications.
15. Remove or mask PHI from all publications, posters, abstracts and case reports, including narrative details and images that could identify an individual, and obtain HIPAA Privacy Officer review before submission.
16. Report any use or disclosure that may not be permitted, including a misdirected fax, email or shipment, to the HIPAA Privacy Officer immediately, and process it under HIP-003.
17. Complete HIPAA privacy training at hire and annually, and document completion in the training record per TRN-001.

6. References

• 45 CFR Part 160 — General Administrative Requirements
• 45 CFR Part 164, Subpart E — Privacy of Individually Identifiable Health Information
• 45 CFR 164.508 — Uses and disclosures for which an authorization is required
• 45 CFR 164.512(i) — Uses and disclosures for research purposes
• 45 CFR 164.514 — De-identification, limited data sets, minimum necessary
• 45 CFR Part 46 — Common Rule
• HIP-002 HIPAA Security Rule Safeguards
• HIP-004 Individual Rights: Access, Amendment & Accounting of Disclosures

7. Revision History

• v2.0 · May 10, 2021 — Added limited data set and data use agreement requirements.
• v3.0 · Apr 22, 2024 — Expanded de-identification guidance with Expert Determination.
• v4.0 · Mar 02, 2026 — Added publication review and revocation handling; aligned with HIP-004 accounting log.