Yes, under the Privacy Rule, a covered may allow a researcher to review PHI for purposes of preparing the research protocol and/or recruiting research participants provided the researcher affirms, either in writing or orally that:
The use or disclosure of PHI is solely to prepare a research protocol or for similar purposes preparatory to research; and No PHI will be removed from the covered entity’s premises.
The preparatory research provision allows a researcher to identify prospective research participants for purposes of seeking their authorization to use their PHI for a research study. However, a researcher who is not a part of the covered entity may not use the preparatory research provision to contact prospective research subjects. Rather, the outside researcher could obtain contact information through a partial waiver of individual authorization by an IRB or Privacy Board as permitted at 45 CFR §164.512(i)(1)(i). The IRB/PB waiver of authorization permits the partial waiver of authorization for the purposes of allowing a researcher to obtain PHI as necessary to recruit potential research subjects. For example, even if an IRB does not waive informed consent and individual authorization for the study itself, it may waive such authorization to permit the disclosure of protected health information as necessary for the researcher to be able to contact and recruit individuals into the study.
