To begin, patients’ initials are protected health information (PHI), so if the sponsor’s intent is to use only de-identified patient data, initials will not work. However, sponsors are not required by law to use de-identified data, so using initials is not a problem unless it contradicts the sponsor‘s promises to the researcher or Covered Entity about what it will use in the study.
If the sponsor is a pharmaceutical company/industry sponsor, its obligation under HIPAA is limited to what the Covered Entity permits for uses and disclosures as described in the clinical trial agreement. Most Covered Entities would expect a sponsor to limit use of PHI to what is needed to perform the study and ensure the study drug or device is safe and effective. Covered Entities should therefore add language to the clinical trial agreement that defines what the sponsor is permitted to do with the PHI.
If the sponsor is an employee of a Covered Entity (i.e. investigator-initiated), the collection of patient initials would mean the researcher is collecting PHI, which would have to be protected from further use or disclosure except as authorized by the patient, unless an IRB or Privacy Board alters or waives the requirement.
