45 CFR 164.512(i) (HIPAA Uses and Disclosures for Research Purposes)

45 CFR 164.512(i) is the section of the HIPAA Privacy Rule captioned "Uses and disclosures for research purposes." It is one of several provisions in 164.512 that let a covered entity use or disclose protected health information (PHI) without the individual’s authorization and without giving the individual an opportunity to agree or object, provided specific conditions are met. For research, those conditions define three separate, non-overlapping pathways. A disclosure has to satisfy the documentation or representation requirements of one of the three — there is no general-purpose "research exception" that covers activity falling outside all three.

The three pathways under 164.512(i)(1)

1. IRB or Privacy Board waiver or alteration of authorization — 164.512(i)(1)(i)

A covered entity may use or disclose PHI for research if it obtains documentation that an IRB or a Privacy Board has approved a full or partial waiver, or an alteration, of the individual authorization otherwise required under 164.508. A Privacy Board (where an entity uses one instead of, or alongside, an IRB) must include members with varied backgrounds and relevant professional competence, at least one member unaffiliated with the covered entity or the research sponsor, and no member with a conflict of interest reviewing a project in which they have that conflict.

Under 164.512(i)(2), the documentation the covered entity must obtain includes, at minimum:

• Identification of the IRB or Privacy Board and the date the waiver or alteration was approved.
• A statement that the board determined the waiver or alteration satisfies three criteria: (a) the use or disclosure involves no more than minimal risk to the individuals’ privacy, based on an adequate plan to protect identifiers from improper use/disclosure, an adequate plan to destroy identifiers at the earliest opportunity (absent a health or research justification for retaining them, or a legal requirement to retain them), and adequate written assurances that the PHI will not be reused or redisclosed except as permitted by law, for authorized oversight of the research, or for other research for which use/disclosure would be permitted; (b) the research could not practicably be conducted without the waiver or alteration; and (c) the research could not practicably be conducted without access to and use of the PHI.
• A brief description of the PHI for which access has been determined necessary.
• A statement that the waiver/alteration was approved under normal or expedited review procedures, and the applicable procedure.
• Signature of the chair, or a designated board member, of the IRB or Privacy Board.

2. Reviews preparatory to research — 164.512(i)(1)(ii)

A covered entity may permit access to PHI without a waiver or authorization when a researcher represents — in writing or orally, and the covered entity may rely on the representation — that the review is sought solely to prepare a research protocol or for a similar preparatory purpose (for example, assessing feasibility, estimating an eligible-patient population, or designing a study), that no PHI will be removed from the covered entity in the course of the review, and that the PHI for which access is sought is necessary for the research purpose. This pathway does not authorize the researcher to record identifiable data offsite; it exists to let investigators scope a study before going through IRB/waiver or authorization processes.

3. Research on a decedent’s information — 164.512(i)(1)(iii)

A covered entity may use or disclose a deceased individual’s PHI for research on representation from the researcher that the use or disclosure sought is solely for research on decedents’ PHI, that the PHI is necessary for the research, and — at the covered entity’s request — documentation of death. HIPAA’s protections for PHI do not extend to information about individuals who have been deceased for more than 50 years (164.502(f)), but within that period, decedent research still requires one of these representations.

What 164.512(i) does not cover

Two closely related research-access mechanisms sit in different sections of the Privacy Rule and are commonly confused with 164.512(i):

• Limited data sets — PHI stripped of the sixteen direct identifiers listed at 164.514(e)(2) (a narrower list than full Safe Harbor de-identification) and disclosed under a Data Use Agreement — are authorized under 45 CFR 164.514(e), not 164.512(i). See Data Use Agreement (DUA).
• De-identified data under the Safe Harbor or Expert Determination methods (164.514(a)-(b)) is not PHI at all once properly de-identified, so it falls outside the Privacy Rule entirely rather than relying on any 164.512(i) pathway.
• Written individual authorization under 164.508 is a separate route to the same end (using PHI for research) that does not depend on IRB/Privacy Board review at all.

Downstream compliance consequence: accounting of disclosures

A disclosure made under a 164.512(i) waiver of authorization is not exempt from the separate HIPAA right to an accounting of disclosures at 45 CFR 164.528 — unlike an authorized disclosure under 164.508, which is exempt. Research offices tracking 164.512(i)-waived disclosures for audit purposes should coordinate with whoever administers accounting-of-disclosures requests; see HIPAA Accounting of Disclosures for the exemptions, the six-year lookback, and the simplified per-protocol accounting method available at 164.528(b)(4) for research involving 50 or more individuals’ records.

References

• 45 CFR 164.512(i), Code of Federal Regulations (eCFR)
• 45 CFR 164.514(e), Code of Federal Regulations (eCFR) — limited data sets
• HHS Office for Civil Rights, guidance on HIPAA and research