HIPAA Privacy Rule: WHAT?
Research Using Protected Health Information of Decedents


With limited exceptions, the Privacy Rule requires researchers to obtain written authorizations from research subjects before using the subjects’ protected health information (PHI) in the course of that research. One of those exceptions is for the use of decedents’ PHI, after filing an appropriate certification.

If you wish to use the PHI of subjects you know to be deceased, you may use the Privacy Rule exception by making a certification. The certification is appropriate when: (1) the PHI sought via the certification is only that of decedents, (2) you can document the death of each individual if asked to do so, and (3) the PHI is necessary to the research purposes.


The Common Rule does not apply to research involving decedents. Rather, the Common Rule applies only to research involving “human subjects”, who are defined as “living” individuals. See 45 CFR 46.101(a) & 46.102(f). However, it is the policy of UW that the determination as to whether research is exempt under the Common Rule (because the subjects are all deceased), is made by the IRB. Therefore, an exemption application must be submitted to the IRB, even if you believe your research is exempt.

You may make a certification for research on the PHI of decedents when all subjects in your protocol, or in a distinct part of that protocol, are deceased. Stated another way, the certification is appropriate when your research is specifically directed at the use of PHI of decedents.

If your research protocol involves the use of PHI of both living and non-living subjects, but no distinct part of your protocol is directed at the use of decedent’s PHI, you should not use the process here, but rather obtain an authorization, or seek a waiver of authorization, before using the PHI. It is not necessary to file a certification to continue using PHI of a research subject who dies during the course of your research, as you will have obtained an authorization, or waiver of authorization, for the subject while living that will allow you to continue using that PHI.


Before you will be permitted to use PHI of decedents for research purposes, you must acknowledge and agree to abide by the Privacy Rule requirements by signing a Certification for Research on the Protected Health Information of Decedents.

A certification must be filed for each protocol involving research directed at the use of known decedents’ PHI.

Instructions on where to file the certification are on the form.

Return to HIPAA Research Guide main page

Questions or comments? Contact us.
Last updated: September 12, 2003