Do not release data until appropriate IRB approval or exemption determination is obtained. De-identification determination should be formally evaluated. Verify facility policy and data use agreements.
This is the correct response. Before releasing any patient data for research purposes, the PMHNP should ensure appropriate IRB review or exemption determination has been obtained, verify that the de-identification process meets HIPAA standards (Safe Harbor or Expert Determination), confirm that facility policies and procedures are followed, establish appropriate data use agreements, and ensure compliance with any applicable state laws that may have stricter requirements than federal law. Institutional oversight protects both patients and providers.