As a covered entity, is it necessary that we take steps to address and contractually obligate the sponsor, or any other recipient of PHI pursuant to an authorization form, to limit their use of the PHI to the authorization’s uses?

The patient’s HIPAA Authorization gives the Covered Entity permission to disclose PHI for use in the study but it does not carry forward to also bind the sponsor. The Covered Entity needs to contractually obligate the sponsor (or other recipient) via the clinical trial agreement and/or a data use agreement, to limit uses or disclosures as spelled out in the Authorization, unless the use/disclosure is otherwise required or permitted by law.

1. PFS Clinical has made reasonable efforts to ensure the accuracy of the information contained in this document; however, this document is provided “as is” without any express or implied warranty. This document does not constitute legal advice. If you require legal advice, please consult with your attorney.