A DUA must be completed before a limited file is used or disclosed to an institution or external party. In addition, affected companies such as Stanford must take all reasonable steps to remedy a recipient`s violation of the DUA. For example, if Stanford learns that the data it has provided to a recipient is being used in a way that is not authorized under the DUA, Stanford must work with the recipient to resolve that issue. If these efforts fail, Stanford would be required to stop any further disclosure of PHI to the recipient under the DUA and report the matter to the Federal Office of Public Health and Social Affairs for Civil Rights. Limited records may contain only the following identifiers: An affected company (Hopkins) may use one of its own employees to create the “limited record”. DHHS also pointed out that a registered company can allow a person applying for “limited registration” to create it as long as the person acts as a business partner of the registered company. A business partner is a person who is not part of the workforce of the registered company, but who uses the RPS of the registered company to perform a task on behalf of the registered company. (Examples of business partners are lawyers, accountants, companies that analyze patient data, etc.) The relevant company (Hopkins) must enter into a separate business partnership agreement with the company and the agreement must comply with the requirements of data protection regulations. Once the limited registration has been created under the Business Partnership Agreement, all PSRs, with the exception of the PSR, which is considered the limited registration under the Data Use Agreement, must be returned to the relevant entity. Some of the uses and disclosures of RPS permitted under the confidentiality rule of section 164.512 without authorization, waiver or modification of the authorization or data use agreement are summarized below.
Affected entities wishing to use and disclose PHI for these or other purposes authorized under section 164.512 should refer to the Confidentiality Policy for information on relevant implementation requirements. If Stanford is the provider of a limited dataset, Stanford requires a DUA to be signed to ensure that the appropriate provisions to protect the limited dataset are in place. The following are the contacts for different types of research: (A) Determine the permitted uses and disclosures of this information by the recipient of the limited record pursuant to paragraph (e)(3) of this section. The data use agreement shall not allow the recipient of the limited registration to use or further disclose the information in a manner that would violate the requirements of this Subsection if the entity concerned did so; The privacy policy describes how affected companies may use or disclose PHI, including for research purposes. In general, the rule allows affected companies to use and disclose PSRs for research purposes if they have been authorized to do so by the subject in accordance with the confidentiality rule. In addition, in certain circumstances, the rule allows affected companies to use and disclose PSRs for certain types of research activities without authorization. For example, PSRs may be used for research purposes or disclosed if an affected entity receives documentation that an Institutional Review Committee (IRB) or Privacy Board has waived the authorization requirement or approved an amendment. The rule also allows a captured entity to enter into a data usage agreement for sharing a limited record. There are also separate provisions on how PSR may be used or disclosed for research preparation activities and for the search for information about the deceased. A limited data set is described as health information that excludes certain direct identifiers listed (see below), but may include the city; State; POSTAL CODE; the elements of the date; and other numbers, characteristics or codes that are not listed as direct identifiers.
The direct identifiers listed in the provisions of the limited data set of the data protection rule apply both to information about the person and to information about the person`s relatives, employers or household members. The following identifiers must be removed from health information if the data is to be considered a limited record: (C) Indicate that the recipient of the record is limited: This means that for a record to be considered a limited record, all of the following direct identifiers, to the extent that they relate to the individual or his or her relatives, Employers or household members, must be removed: Prohibit the recipient from using or continuing to disclose the information, except to the extent permitted by the Agreement or otherwise permitted by law. The following page provides useful information about the people who internally manage different types of DUAs and other agreements at Stanford: ico.sites.stanford.edu/who-will-handle-my-agreement For activities related to research preparation, the companies concerned may use PHI without an individual`s permission, a waiver or change of authorization, or a data use agreement, or to a researcher. pass.. .