Procedure for Accessing Protected Health Information for Research Purposes
*Applicable to all Carilion employees and all non-employees
Carilion Clinic's commitment to a system-wide electronic health record provides meaningful use to clinicians and patients, as well as an enriched environment and exceptional resource to investigators conducting clinical research. Information found in the links on this page address issues related to the proper use of electronic protected health information (PHI) for research purposes. Information herein also delineates a mechanism with which the Office of Sponsored Projects, Carilion Institutional Review Board and Corporate Health Information Management ensures appropriate access and acquisition of PHI for the conduct of research. Note: Data may not be stored on any personally owned device (laptop, USB, tablet, phone, etc.). Data must be stored on servers located on the Carilion Clinic domain (a PRF can be used to request a share). Data may not be exchanged with others outside of Carilion through email (unless a secure email is obtained). Data may not be placed in a cloud or other hosted environment - unless it is reviewed and approved by Privacy and Information Security. If data is to be deidentified - it must meet Safe Harbor guidelines  and must be reviewed by Privacy and Information Security prior to being shared). This procedure is intended for both Carilion employees as well as non-employees.
If you are interested in accessing PHI for your research project, or if you are unsure if your project involves PHI, please review the documents linked below, and complete the Request For Access form. Note that you must also indicate that your research project involves PHI on the appropriate Research and Development Approval Form (R&D Forms Page).
- Guidance to evaluate if your research involves PHI 
- Policy for Use and Disclosure of Protected Health Information for Research Purposes 
- Privacy Office procedure for providing access to non-employees 
- PHI Access Request Form.doc Access to PHI diagram 
If you have any questions about these documents or about Protected Health Information and Research, please contact the Privacy Officer / Health Information Management Office; Cynthia Phelps, Carilion Clinic HIM Director, email@example.com  or (540) 224-6875.