Aug 10, 2020 2:15 pm

Research involving data and/or biospecimens from decedents (deceased individuals) is not regulated under the Common Rule.  However, if you or any member of the study team will be accessing Protected Health Information (PHI) of the decedent(s), the project must comply with HIPAA Privacy Rule. 

HIPAA Privacy Rule permits access to PHI as part of Research on Decedents if the researcher provides appropriate representations (or assurances) to the covered entity. These representations are recorded in the eResearch Regulatory Management (eRRM) system.


    1. Use and disclosure is sought solely for research on the PHI of decedents (eResearch application question 25-6.2),
    2. PHI for which use or disclosure is sought is necessary for the research purposes (eResearch 1.8 and 25-6.1), and
    3. At the request of the covered entity, researchers can produce documentation of the death of the individuals whose PHI is sought (eResearch 25-6.2).

    To request “Research on Decedents’ Protected Health Information” review, complete a new application in eResearch Regulatory Management (eRRM). Fill out system-required sections, including:

    • Question 1.8 (project summary): explain the purpose of the project, and why this requires access to PHI.
    • Section 01-1: “Activities Not Regulated…”;
    • Section 04-1: “Research on Decedents”;
    • Section 25-6 of the application. 

    Once completed and submitted, the application will be reviewed by IRBMED Staff for clarity and completeness, then assigned to an IRBMED Board reviewer for determination.


Contact us at or 734-763-4768 / (Fax 734-763-1234)

2800 Plymouth Road, Building 520, Room 3214, Ann Arbor, MI 48109-2800

A list of IRBMED staff is available in the Personnel Directory, or view the list of Regulatory Teams.

Edited By:
Last Updated: August 10, 2020 2:15 PM