UPMC has established a policy whereby researchers may access protected health information held by UPMC solely for use preparatory to research. Following is an excerpt from the policy. The policy in its entirety can be found on the IRB website, and researchers should directly contact the appropriate offices within UPMC for further information.
For reviews of PHI preparatory to research (hypothesis/protocol work), HIPAA permits UPMC to make available the PHI to a researcher based solely on the researchers written representations that no PHI shall be recorded for the purpose of research and/or removed from the provider entity and that the PHI reviewed by the researcher shall be limited to that necessary to prepare a research protocol. UPMC shall permit researchers to review PHI, held by a UPMC entity, for the purpose of preparing a research hypothesis and research protocol.
UPMC has a template agreement that is available to the researcher (from the IRB or UPMC) for this HIPAA-permitted activity. The researcher must provide requested information and attest/sign and submit this agreement to the director of the entity’s health information management department or an individual designated by the entity to receive such information in order to access the records/PHI.