45 CFR 164.512(i) (HIPAA Uses and Disclosures for Research Purposes)

45 CFR 164.512(i) is the provision of the HIPAA Privacy Rule that permits a covered entity to use or disclose protected health information (PHI) for research without the individual’s written authorization. Its opening words settle a question people often get wrong: the permission applies “regardless of the source of funding of the research.” What it does not do is create a general research exemption — it opens exactly three doors, and a use or disclosure qualifies only if it fits through one of them.

The three pathways

1. Board approval of a waiver or alteration of authorization — 164.512(i)(1)(i)

The covered entity obtains documentation that an IRB or a Privacy Board has approved a waiver or alteration, in whole or in part, of the authorization otherwise required by 45 CFR 164.508. The IRB must be one established under a listed Common Rule counterpart (the regulation enumerates them, from 7 CFR 1c.107 through 49 CFR 11.107, including 45 CFR 46.107 and 21 CFR 56.107).

A Privacy Board is the HIPAA-specific alternative for institutions without an applicable IRB, and 164.512(i)(1)(i)(B) sets its composition: members with varying backgrounds and appropriate professional competency to review the protocol’s effect on privacy rights; at least one member not affiliated with the covered entity, not affiliated with any entity conducting or sponsoring the research, and not related to anyone so affiliated; and no member may participate in a review in which they have a conflict of interest.

2. Reviews preparatory to research — 164.512(i)(1)(ii)

The covered entity obtains representations from the researcher that the use or access is sought solely to review PHI as necessary to prepare a research protocol or for similar preparatory purposes; that no PHI will be removed from the covered entity by the researcher during the review; and that the PHI sought is necessary for the research purposes. The middle representation is the one that limits this pathway in practice — it supports feasibility assessment and cohort estimation, but the moment identifiers leave the covered entity the activity has outgrown the preparatory-review permission.

3. Research on decedents’ information — 164.512(i)(1)(iii)

The covered entity obtains a representation that the use or disclosure is sought solely for research on decedents’ PHI; documentation of death, at the covered entity’s request; and a representation that the PHI is necessary for the research purposes.

What the waiver documentation must contain — 164.512(i)(2)

Where the waiver pathway is used, the documentation the covered entity holds must include all of the following, and an incomplete package is a compliance gap even if the underlying approval was sound:

• Identification and date — a statement identifying the IRB or Privacy Board and the date the waiver or alteration was approved.
• The waiver criteria findings — a statement that the board determined the waiver satisfies three criteria: (A) the use or disclosure involves no more than minimal risk to individuals’ privacy, based on at least an adequate plan to protect identifiers from improper use and disclosure, an adequate plan to destroy the identifiers at the earliest opportunity consistent with the research (unless retention has a health or research justification or is required by law), and adequate written assurances that the PHI will not be reused or disclosed except as required by law, for authorized oversight of the study, or for other permitted research; (B) the research could not practicably be conducted without the waiver or alteration; and (C) the research could not practicably be conducted without access to and use of the PHI.
• A brief description of the PHI determined necessary by the board.
• Review and approval procedures — a statement that the waiver was reviewed and approved under either normal or expedited review procedures, with IRBs following the Common Rule procedures and Privacy Boards following the parallel process.
• Signature of the chair or other designated member of the board.

Note the structure of criterion (A): “minimal risk to the privacy of individuals” is not a free-standing judgement. The regulation says the finding must be based on at least the three listed elements, so a board that records a bare conclusion of minimal risk without addressing protection, destruction and reuse has not made the finding the rule requires.

Common misreadings

• It is not a de-identification route. If the information has been de-identified under 45 CFR 164.514(b) it is no longer PHI and 164.512(i) is not needed at all. The limited data set with a data use agreement is a separate permission at 164.514(e).
• It is not the same as IRB approval of the study. An IRB can approve a protocol and separately decline to waive HIPAA authorization; the waiver criteria at 164.512(i)(2)(ii) are their own test with their own findings.
• A signed HIPAA authorization is a different instrument. Where the individual signs an authorization complying with 164.508, no waiver is needed — 164.512(i) exists for the cases where obtaining one is impracticable.
• Preparatory review is not a data-collection permission. Recording identifiers into a study file during a “preparatory to research” review contradicts the representation that no PHI will be removed.
• The permission runs to the covered entity, not the researcher. It is the covered entity that must obtain the documentation or representations before using or disclosing, which is why these requests route through a privacy office rather than being self-certified by a study team.

Frequently Asked Questions

Does 45 CFR 164.512(i) let researchers use health information without patient authorization?

Yes. 164.512(i) is one of the provisions in 164.512 that lets a covered entity use or disclose PHI for research without the individual’s authorization and without giving the individual a chance to agree or object, provided the disclosure fits one of three specific pathways: an IRB or Privacy Board waiver, a review preparatory to research, or research on a decedent’s information.

What is a “review preparatory to research” under 164.512(i)(1)(ii)?

It is access to PHI that a researcher represents is sought solely to prepare a research protocol or for a similar preparatory purpose, such as assessing feasibility or estimating an eligible-patient population. The researcher must represent that no PHI will be removed from the covered entity and that the PHI is necessary for that purpose; it does not authorize recording identifiable data offsite.

Does 164.512(i) apply to research involving deceased patients?

Yes. A covered entity may use or disclose a deceased individual’s PHI for research if the researcher represents that the use is solely for research on decedents’ PHI, that the PHI is necessary for the research, and, if requested, provides documentation of death.

Is a limited data set the same as a 164.512(i) waiver?

No. Limited data sets — PHI stripped of the sixteen direct identifiers listed at 164.514(e)(2) and disclosed under a Data Use Agreement — are authorized under 45 CFR 164.514(e), a separate provision, not 164.512(i). See Data Use Agreement (DUA).

Are disclosures made under a 164.512(i) waiver exempt from the HIPAA accounting-of-disclosures requirement?

No. Unlike an authorized disclosure under 164.508, a disclosure made under a 164.512(i) waiver of authorization is not exempt from the accounting-of-disclosures right at 45 CFR 164.528. See HIPAA Accounting of Disclosures.

What are the three pathways for using PHI for research under 164.512(i)?

An IRB or Privacy Board approved waiver or alteration of authorization (164.512(i)(1)(i)), a review preparatory to research (164.512(i)(1)(ii)), or research on a decedent’s information (164.512(i)(1)(iii)). A disclosure must satisfy the documentation or representation requirements of one of these three — there is no general-purpose research exception covering activity outside them.