# Presentation: 378448

## Research

## Scope:  Who is Covered? 

- Limited by HIPAA to:
- Health care providers who transmit health information electronically in connection with a transaction for which there is a HIPAA standard
- Health plans
- Health care clearinghouses

- HHS/OCR May 2004

## Scope:  What is Covered? 

- Protected health information (PHI) is:
- Individually identifiable health information
- Transmitted or maintained in any form or medium by covered entities or their business associates (includes oral, paper, and electronic)
- De-identified information is not covered
- Employment and FERPA (Family Educational Rights & Privacy Act) records are not covered

- HHS/OCR May 2004

## Uses & Disclosures: Key Points

- NO use or disclosure of PHI unless required or permitted by the Rule_ _
- _Required_ disclosures are limited to:
- Disclosures to the individual who is the subject of information
- Disclosures to Secretary of HHS to determine compliance

- HHS/OCR May 2004

## Permissive Uses & Disclosures

- To the individual (or personal representative)
- For treatment, payment, & health care operations (TPO)
- Opportunity to agree or object
- For specific public priorities
- “Incident To”
- Limited Data Set
- As authorized by the individual

- HHS/OCR May 2004

## Research Provisions

- Covered entities may use and disclose PHI for research:
- with individual authorization, or
- without individual authorization under limited circumstances

- HHS/OCR May 2004

## Relationship to Other Research Rules

- The Privacy Rule **does not** override the Common Rule or FDA’s human subject protection regulations

- HHS/OCR May 2004

## Common Rule vs. Privacy Rule

- Common Rule/FDA
- Regulated

- Privacy Rule

- IRB review of research
- and informed consent

- Valid authorization

***Research ***_***WITH***_** patient permission**

- HHS/OCR May 2004

## Privacy Authorization

- Research participant authorization to use or disclose PHI is required for most clinical trials and some records research
- May be no expiration date or event or may continue until “end of research study”
- May be combined with informed consent to participate in research

- HHS/OCR May 2004

## May I use a research subject’s PHI once he revokes his authorization?

- CE may continue to use and disclose PHI that was obtained prior to the time the individual revoked his authorization, as necessary to maintain the integrity of the research study. An individual may not revoke an authorization to the extent CE has acted in reliance on the authorization. For research uses and disclosures, this reliance exception at 45 CFR 164.508(b)(5)(i) permits the continued use and disclosure of PHI already obtained pursuant to a valid authorization to the extent necessary to preserve the integrity of the research study.

- HHS/OCR May 2004

## Common Rule vs. Privacy Rule

***Research ***_***WITHOUT***_** patient permission**

- Common Rule

- Privacy Rule

- IRB/Privacy Board Review—
*  **	**3 waiver criteria*
- Preparatory research;
- Research on decedents; or
- Limited data set

- IRB Review—*4 waiver criteria*

- HHS/OCR May 2004

## Use and Disclosure of PHI for Research Without Individual Authorization:

**Four Options:**
**OPTION 1:**  Obtain documentation that an IRB or Privacy Board has approved an alteration to or waiver of authorization based on the following 3 waiver criteria:

- HHS/OCR May 2004

## 3 Waiver Criteria

**1)** The use or disclosure of PHI involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements...

- HHS/OCR May 2004

## Minimal Risk Elements

- an adequate plan to protect the identifiers from improper use/disclosure;
- an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining identifiers or such retention is otherwise required by law; and
- adequate written assurances that PHI will not be reused/disclosed to any other person or entity, with certain exceptions.

- HHS/OCR May 2004

## Waiver criteria...

**2)** The research could not practicably be conducted without the alteration or waiver
**3)** The research could not practicably be conducted without access to and use of the PHI

- HHS/OCR May 2004

## Can I create a database for research purposes through an IRB or Privacy Board waiver of individual authorization? 

- Yes. A CE may use or disclose PHI without individuals’ authorizations for the creation of a research database, provided the CE obtains documentation that an IRB or Privacy Board has determined that the specified waiver criteria were satisfied. PHI maintained by a CE in such a research database could be used or disclosed for future research studies as permitted by the Privacy Rule – that is, for future studies in which individual authorization has been obtained or where the Rule would permit research without an authorization, such as pursuant to an IRB or Privacy Board waiver.

- HHS/OCR May 2004

## Research Use and Disclosure of PHI Without Individual Authorization:

**OPTION 2:**  Obtain representation that the use or disclosure is necessary to prepare a research protocol or for similar purposes preparatory to research
- No PHI removed from CE

- HHS/OCR May 2004

## Can the preparatory research provision be used to recruit research subjects? 

- 45 CFR 164.512(i)(1)(ii) does not permit the researcher to remove PHI from the CE’s site. A researcher who is an employee or a member of the covered entity’s workforce could use PHI to contact prospective research subjects and to identify prospective research participants for purposes of seeking their authorization to use or disclose PHI for a research study. In addition, the Rule permits a covered entity to disclose PHI to the individual who is the subject of the information. See 45 CFR 164.502(a)(1)(i).

- HHS/OCR May 2004

**Notes:**
45 C.F.R. 164.512(I)(1)(ii)

## What about a researcher who is not part of the CE?

-  A researcher who is not a part of the CE may not use the preparatory research provision to contact prospective research subjects. Rather, the outside researcher could obtain contact information through a partial waiver of individual authorization by an IRB or Privacy Board as permitted at 45 CFR164.512(i)(1)(i).
- The IRB or Privacy Board waiver of authorization permits the partial waiver of authorization for the purposes of allowing a researcher to obtain PHI as necessary to recruit potential research subjects.

- HHS/OCR May 2004

## Research Use and Disclosure of PHI Without Individual Authorization:

**OPTION 3:**  Obtain representation that the use or disclosure is solely for research on decedents’ protected health information

- HHS/OCR May 2004

## Research Use and Disclosure of PHI Without Individual Authorization

**OPTION 4:** Only use or disclose limited data set/“indirect identifiers” (e.g. zip codes, dates of service, age, death)
- Requires a data use agreement

- HHS/OCR May 2004

## Individual Rights

- Notice of Privacy Practices
- Access : inspect and copy
- Amend
- Accounting
- Alternative communication
- Request restrictions
- Complain to Covered Entity & Secretary (OCR)

- HHS/OCR May 2004

## Accounting for Research Disclosures

- Upon request, must provide accounting for research disclosures made without individual authorization (except for disclosures of the limited data set).
- For 50+ records:
- List of protocols for which PHI may have been disclosed, and
- Researcher contact information

- HHS/OCR May 2004

## Covered Entity and Researcher Relationship

- Researcher within Covered Entity
- Rule applies to entire entity; or
- Elect Hybrid status
- Must include clinical researcher in covered component if covered health care provider
- May include clinical researcher in covered component even if not covered health care provider
- May not include researcher that is not also providing health care
- Researcher and Covered Entity are two separate legal entities

- HHS/OCR May 2004

## Research participant's right of access to research records or results 

- With few exceptions, the Privacy Rule gives patients the right to inspect and obtain a copy of health information about themselves that is maintained by a CE or its BA in a DRS. While it may be unlikely that a researcher would be maintaining a DRS, any research records or results that are actually maintained by the CE as part of a DRS would be accessible to research participants unless one of the Privacy Rule’s permitted exceptions applies.

- HHS/OCR May 2004

## Ongoing Research at Time of Compliance Date (4/14/03)

- Grandfathers in use or disclosure of PHI as permitted by the following if obtained prior to the compliance date:
- Legal permission for the use or disclosure PHI;
- Informed consent for the research; or
- An IRB waiver of informed consent under the Common Rule.

- HHS/OCR May 2004

## CLIA and the Privacy Rule (1)

- CLIA and its regulations require clinical labs to comply with standards regarding  testing of human specimens.  It requires clinical labs to disclose test results or reports only to authorized persons, as defined by state law.  If a state does not define the term, the federal law defines it as the person who ordered the test.

- HHS/OCR May 2004

## CLIA and the Privacy Rule (2)

- The Rule at 164.524(a)(1)(iii)(A) provides that CEs maintaining PHI that is subject to CLIA requirements do not have to provide individuals with a right of access to or a right to inspect and obtain a copy of this information if the disclosure of the information to the individual would be prohibited by CLIA.

- HHS/OCR May 2004

## CLIA and the Privacy Rule (3)

- CLIA regulations exempt the components or functions of research labs that test human specimens but do not report patient specific results for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of individual patients from the CLIA regulatory scheme.  42 CFR 493.3(a)(2).

- HHS/OCR May 2004

## CLIA and the Privacy Rule (4)

- For certain research laboratories that are exempt from the CLIA regulations, the Privacy Rule does not require such research laboratories, if they are also a covered health care provider, to provide individuals with access to PHI because doing so may result in the research laboratory losing its CLIA exemption. 164.524(a)(1)(iii)(B).

- HHS/OCR May 2004

## Additional Information

- _[www.hhs.gov/ocr/hipaa/](http://www.hhs.gov/ocr/hipaa/)_
- OCR Privacy Toll Free Number:
- (866) 627-7748

- HHS/OCR May 2004