A covered entity may use or disclose decedents’ PHI for research, provided it first obtains certain representations and documents from the researcher.

For example, the covered entity may require representations that the use or disclosure is solely for research on the decedents’ PHI and the PHI is necessary for research purposes. The covered identity may also request documentation of the death of such individual.