1. NE SNIP PRIVACY WORKGROUP Use and Disclosure of Protected Health Information Regarding a Deceased Individual

2. Protected Health Information (PHI) for Decedents Standard: Deceased Individuals A covered entity must comply with the requirements of this subpart with respect to PHI of a deceased person. §164.502(f) Translation: You must follow the same use and disclosure rules for PHI of decedents as for any other individual

3. Verification Requirements Standard: Verification Except for permitted uses where the individual has an opportunity to object: Verify identity of person requesting PHI and authority to have access Obtain documentation (oral or written) if disclosure conditioned on representations §164.514 (h)

4. Who is a Personal Representative? Standard: Personal Representatives Treat personal representative as the individual for purposes of disclosure of PHI Executor, Administrator authorized by law to act on behalf of individual’s estate §164.502 (f) & (g)

5. Permitted Disclosures Law enforcement official to alert if death due to criminal conduct §164.512 (f)(4) Coroners/medical examiners for identification, cause of death, other duties §164.512 (g)(1) Funeral directors as necessary to carry out their duties §164.512 (g)(2) Organ/tissue donation procurement agencies §164.512 (h) Research on decedent’s information §164.512 (i)

6. Research Requirements IRB/Privacy Board approval of waiver of authorization Must confirm that: Disclosure sought solely for research on protected PHI of decedent; Documentation of death; and PHI sought is necessary for the research purposes §164.512 (h)(iii)

7. Waiver Requirements Documentation of approval must include: §164.512 (h) Identification and date of action Waiver criteria approved by IRB/Privacy Board No more than minimal risk Waiver will not adversely effect privacy rights Research cannot be practicably conducted without this waiver Privacy risks reasonable in light of reasonably expected results of research

8. More Waiver Criteria Waiver criteria approved by IRB/Privacy Board Adequate plan to protect identifiers from improper use/disclosure Plan to destroy identifiers at earliest opportunity unless health/research justification for retention Written assurances that PHI will not be reused/redisclosed (limited exceptions)

9. Recommendations Note that the 2-year time limit for protection of PHI was eliminated in the final regulation Revise your release of information policies and procedures to include permitted uses of decedent PHI Remind staff of qualifications of personal representatives (no real change)