# Presentation: 662810

## Privacy Issues In Research

- Stephania H. Putt, RHIA
- Department of Veterans Affairs
- VHA Privacy Officer

## Federal Info & Privacy Laws

- Title 38, United States Code (USC),  Section 5701
- Freedom of Information Act, Title 5 USC 552
- Privacy Act of 1974, Title 5 USC 552a
- Title 38 USC Section 7332
- Standards on Privacy of Individually Identifiable Health Information, 45 CFR Part 164
- Title 38, Code of Federal Regulations, Sections 1.460 - 1.582

## Title 38 USC 5701

- Applies to VA only
- Predates FOIA and Privacy Act
- Affords special protections to veteran’s names and addresses
- Is still in effect even after veteran’s death

## Freedom of Information Act (FOIA)

- Federal records available to any person upon request unless authorized withholding under the law.
- Pertains to all federal agency records:
- agency rules, policy memorandum, directives, manuals, opinions
- electronic mail messages
- telephone directory, employee salaries
- various records

**Notes:**
FOIA enacted in 1966.  Statutory right of access to information in federal agencies to ensure informed citizenry and prevent secret laws.  Records must be disclosed unless exempt.  Public interest in withholding – e.g., national security, privacy, law enforcement, and others.

## FOIA within VA

- Requests must be in writing and signed, as well as, contain a reasonable description of records sought.
- Timeframes for responding to requesters with decision is 10 days.
- Fees are to be charged for copying, search time, and direct employee cost.
- Costs calculated according to 38 CFR §1.555).
- Requester notified when charges exceed $25.00
- VA has no obligation to “create” 	information to meet a request.

**Notes:**
FOIA does not authorize VA to disclose information protected under 38 USC 5701 and 38 USC 7332.  The Privacy Act does allow for disclosure under FOIA in accordance with 5 USC 552a(b)(2).  However, normally these records fail the Exemption 6 , Personal Privacy, test and are withheld under this FOIA exemption. 

## Privacy Act (PA)

- Pertains to any group of VA records (patient or employee) contained in a system of records.
- Prohibits disclosure of any record contained in a system of records unless specifically authorized by the Act (5 U.S.C. §552a(b))
- Provides rights to the individuals to whom the records pertain

## Privacy Act Definitions

- System of Records – a group of any records under the control of any agency from which information about an individual is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.
- Disclosure - whenever VA (employees) communicates, by any means, to anyone in or outside of VA who is not aware of the information.

**Notes:**
System of records must have a notice regarding the existence and character of the records published in the Federal Register.  The notice outlines the individuals on whom the records are pertain, the type of records, purpose of the records and the routine use disclosure statements related to the records.
For the Privacy Act, disclosure includes use of the data for VA purposes.  This is different than the HHS Final Rule on Standards for Privacy definition of disclosure.

## PA Disclosure of Information

- Disclosure prohibited without specific written consent from the individual or Privacy Act authority, 5 USC §552a:
- (b)(1) – employee of agency in order to perform duties
- (b)(3) – published routine use
- (b)(5) – statistical research
- (b)(8) – health or safety of an individual
- (b)(11) – court order

**Notes:**
There are twelve exceptions under the Privacy Act allowing for disclosure of information without the prior written consent of the individual.  

5 USC 552a(b)(5) – disclosure to a recipient who has provided the agency with advance written assurance that the records will be used solely as a statistical research or reporting record, and the records is to be transferred in form that is not individually identifiable.

## 7332-Protected Information

- 38 USC Section 7332-Protected information is any information relating to the condition of:
- HIV or
- Sickle Cell Anemia;
- Or the condition and/or treatment of:
- Drug abuse or
- Alcoholism or alcohol abuse.

## 7332-Protected Information

- Protected information may only be disclosed to a third party with the special written consent of the patient except where expressly authorized by 38 USC 7332.
- VA can disclose this information to:
- VA employees on a need to know basis - more restrictive than Privacy Act need to know.
- Contractors who need the information in order to perform or fulfill the duties of the contract.
- Researchers who provide assurances that the information will not be identified in any report.

## HIPAA Privacy Rule

- Notice of Privacy Practices
- Authority to use and/or disclose information for treatment, payment or health care ops
- Other authority to disclose information for purposes such as:
- Law Enforcement
- Public Health Reporting
- Research with IRB Waiver
- Authorization for other uses and/or disclosures of information not otherwise allowed

## HIPAA Privacy Rule

- Administrative Requirements
- Privacy official
- Privacy Policies
- Training
- Accounting of Disclosures
- Individuals’ Right to:
- Access their information
- Request an Amendment
- Receive Confidential Communications
- Request Restrictions on the use or disclosure of their information

## Relationship b/w Laws

- All applicable privacy laws and regulations must be applied when:
- Using or Disclosing information, and
- Process Requests from individuals exercising their privacy rights.
- When conflicts arise between the laws:
- The more stringent law applies for disclosures,
- The one that affords the greatest rights to the individual applies for privacy rights.
- See VHA Handbook 1605.1

## Use of Information

- Employees must have authority to use information other than just a “need to know” to perform duties.
- Authority to USE data for Research:
- PA (b)(1) Provision
- HIPAA Privacy Rule – Authorization as part of Informed Consent or IRB Approval of Waiver of Authorization
- 38 USC 7332 – Employee official duties

**Notes:**
There are also new requirements regarding the use of information within VHA. In the past it was just a matter of “need to know”.  

## Disclosure of Information

- VHA must have authority in order to disclose information outside VA under all applicable laws.
- Authority to disclose for Research:
- FOIA – Written request with no exemptions
- PA – Routine Use in system of records
- HIPAA Privacy Rule – Authorization as part of Informed Consent or IRB Approval of Waiver of Authorization
- 38 USC 7332 – Authorization as part of Informed Consent or assurance of no identified data in report

**Notes:**
You will notice that requirements for the HIPAA Privacy Rule are the same as use internal to VHA.  It is also important to note that providing information from VHA records to a non-VA employee is a disclosure that requires legal authority. 

## Disclosure from VHA

- Requests for patient specific information must be in writing; and
- Contain the written authorization of the patient or legal guardian/representative; or
- Legal authority to disclose must be present.
- VA can charge most third parties for search fees, copying fees, and abstracts
- Accounting of disclosures must be maintained.

**Notes:**
Title 38 Code of Federal Regulations outlines the copying fees and timeframes for responding to a request for release of information.  The accounting of disclosures is mandated by the Privacy Act.

## Accounting of Disclosures

- VHA is required to keep an accurate accounting of disclosures for research.
- The accounting must include:
- Date, nature, and purpose of the disclosure; and
- Name and address of the person or agency to whom the disclosure is made.

## Accounting of Disclosures

- Retain accounting for 6 years or life of the record, whichever is longer.
- An accounting is NOT required for use of information for research.

**Notes:**
The Privacy Act affords the greater rights when compared to the HIPAA Privacy Rule. As such all disclosures required to be tracked by the Privacy Act must be accounted for, even though the HIPAA Privacy Rule may exempt that disclosure from accounting.

## Privacy Review

- Review of Research Documentation to ensure all privacy requirements are met.
- Verification of PI
- Research Protocol
- IRB Approval of Study
- IRB Approval of Waiver of Authorization
- Review of Informed Consent, if applicable

**Notes:**
All research requests for data both internal and external must be reviewed to ensure all of the privacy requirements are met.

## For Additional Information

- VHA Privacy Office web site at: _[http://vaww.vhaco.va.gov/privacy](http://vaww.vhaco.va.gov/privacy)__  _
- Contact:
- Stephania H. Putt, VHA Privacy Officer,
- (727) 320-1839
- Clay Johnson, VHA FOIA Officer,
- (202) 273-6266