# Presentation: 106114

## The HIPAA Privacy Rule and Research

- Lora Kutkat
- NIH Office of Science Policy

**This presentation will probably involve audience discussion, which will create action items.  Use PowerPoint to keep track of these action items during your presentation**
**In Slide Show, click on the right mouse button**
**Select “Meeting Minder”**
**Select the “Action Items” tab**
**Type in action items as they come up**
**Click OK to dismiss this box**
**This will automatically create an Action Item slide at the end of your presentation with your points entered.**

- Disclaimer: This presentation provides basic information about certain provisions of the Privacy Rule in the context of health research.  It should not be construed as a formal training session that would meet the Rule’s training requirements nor should it be construed to give advice to covered entities.  Those who must comply with the Privacy Rule are encouraged to seek legal counsel to determine how the Privacy Rule could apply to specific research projects.

## The Privacy Rule...

- Protects the privacy of individually identifiable health information by establishing conditions for its use and disclosure by a health plan, healthcare clearinghouse, and certain healthcare providers.

## Important Date to Remember

- April 14, 2003
- Compliance date

## Three Rules -- Privacy Rule, Common Rule, FDA Regulations

- Privacy Rule does _not_ replace or modify the Common Rule or FDA regulations.
- Privacy Rule exceeds privacy protections of Common Rule and FDA regulations.
- Applies to covered entities, regardless of funding
- Definition of “identifiable information”
- Requires Authorization for use and disclosure of certain types of health information
- Applies to decedent’s information

## Today’s focus – Clinical Research

- Transition provisions
- De-identified data
- Limited Data Sets
- Recruitment after compliance date
- Authorization

## How will the Privacy Rule affect research?

_**Depends on:**_
**Who you are/where you work**
**Type of information you use, collect, or release**

## Who is Covered?

- _A health care provider who transmits protected health information electronically for any covered HIPAA transaction_
- Examples: a physician who electronically bills for services; a researcher who is employed by a covered entity (possibly)
- A health plan
- A health care clearinghouse

## 
Protected Health Information (PHI) 
Covered Entity + Health information + Identifier = PHI
Transmitted or maintained in any form (paper, electronic, forms, web-based, etc.)
Decedents’ information included

Does not include de-identified health information or biological tissue

- Protected Health Information (PHI)
- Covered Entity + Health information + Identifier = PHI
- Transmitted or maintained in any form (paper, electronic, forms, web-based, etc.)
- Decedents’ information included
- Does not include de-identified health information or biological tissue

**What is Covered?**

## What is an Identifier in the Privacy Rule?

- The Privacy Rule defines 18 identifiers

- Names
- Geographic info (including city, state, and zip)
**Elements of dates**
- Telephone #s
- Fax #s
- E-mail address
- Social Security #
**Medical record, prescription #s**
- Health plan beneficiary #s
- Account #s

- Certificate/license #s
- VIN and Serial #s, license plate #s
- Device identifiers, serial #s
- Web URLs
- IP address #s
- Biometric identifiers (finger prints)
- Full face, comparable photo images
**Unique identifying #s**

## Key Point about Research

- In general, the Privacy Rule requires an individual’s written Authorization be obtained _before _the use and disclosure of PHI.
- For research, the Privacy Rule permits covered entities to use and disclose PHI for research conducted:
- with individual authorization, **or**** **
- without individual authorization under limited circumstances.

## Research Use and Disclosure of PHI Without Authorization

- Research qualifies for the Transition Provisions
- De-identify PHI
- Limited Data Set with Data Use Agreement
- IRB or Privacy Board waiver of Authorization requirement
- Activity preparatory to research
- Research is on decedent’s information
- Disclosure to a public health authority or as required by law

## “Grandfathered” Research

- Grandfathered-in under the Transition Provisions if, BEFORE April 14, 2003, covered entity obtains either:
- Participant’s informed consent,
- Waiver of informed consent, or
- Express legal permission to use or disclose PHI for research.

## EXAMPLE: Transition Provisions

- Assume today is April 14, 2003, and no consent waiver has been approved.
- A study needs 1000 participants enrolled.
- 600 enrolled _before_ April 14, 2003
- 400 will enroll _after_ April 14, 2003
- How many participants need to give Authorization?
- How many informed consents were transitioned?

**400**

**600**

## De-identified Health Information

- Completely de-identified information (18 elements removed) _and_ no knowledge that remaining information can identify the individual.  OR
- Statistically “de-identified” information where a statistician certifies that there is a “very small” risk that the information could be used to identify the individual.

## Limited Data Set with Data Use Agreement

- The Privacy Rule permits _limited types of identifiers_ to be released with health information (referred to as a Limited Data Set).
- Limited Data Sets can only be used and released in accordance with a Data Use Agreement between the covered entity and the recipient.

## The Limited Data Set w/ Data Use Agreement

- Names
- Postal address info (if other than city, state, and zip)
- Telephone and fax #s
- E-mail address
- Social Security #
- Medical record, prescription numbers
- Health plan beneficiary #s
- Account #s

- A data set that _**excludes**_** **the following direct identifiers can be considered a Limited Data Set

- Certificate/license #s
- VIN and Serial #s, license plate #s
- Device identifiers, serial #s
- Web URLs
- IP address #s
- Biometric identifiers (finger prints)
- Full face, comparable photo images

## Slide 17

## Preparatory to Research

- Researcher must obtain representation that:
- PHI is to be used _solely_ to prepare a  protocol or for a similar purpose
- PHI will not be removed from the covered entity AND
- PHI is necessary for research

## Authorization Needed for Research Recruitment Use or Disclosure?

- To prepare a protocol or similar and no PHI will be _removed_ from the covered entity.
- Patient’s direct treatment provider discusses possible participation with patient.
- Pursuant to a waiver of the Authorization requirement

_**NO if...**_

**Notes:**
If NO
But, the researcher must provide representation that the PHI:
Is necessary to prepare a research protocol or similar;
Will NOT leave the covered entity; and
Is necessary for the research. 

## Others...

- IRB or Privacy Board waiver of Authorization requirement
- Research is on decedent’s information
- Disclosure to a public health authority or as required by law

## For research, the Privacy Rule permits covered entities to use and disclose PHI for research conducted:
with individual authorization, or 
without individual authorization under limited circumstances.  

- with individual authorization, **or **
- without individual authorization under limited circumstances.

**Authorization Generally Required**

## Authorizations for Research

- Must be for a specific research study – Authorization for future, unspecified research is NOT permitted but authorization may be used to create a repository or database
- Review/approval by IRB/Privacy Board NOT needed
- Different from, but may be combined w/, informed consent
- Must contain “core elements” & “required statements”
- Research authorizations need not expire

## The Authorization Document(can be part of informed consent document)

_**Elements of an Authorization**_
**Authorization to Use and Disclose PHI**

- _Core Elements:_
- Description of PHI to be used or disclosed
- Person(s) authorized to make and receive requested use or disclose
- Purpose for the use or disclosure
- Expiration date or event* (e.g. “end of the research study” or “none”)

- Patient Signature			Date

- _Statements:_
- Right to revoke Authorization plus exceptions and process
- Ability/Inability to condition treatment, payment, or enrollment/eligibility for benefits on Authorization
- PHI may no longer be protected by Privacy Rule once it is disclosed by the covered entity

- *Research authorizations need not expire.

## Stay Tuned for...

- Office for Civil Rights Web site updates
- http://www.hhs.gov/ocr/hipaa/
- Educational information from NIH and other research agencies
- http://privacyruleandresearch.nih.gov

## NIH Privacy Contacts

- _Office of Science Policy_
_**Dr. Lana Skirboll**_	_**Ms. Lora Kutkat**_**	**_**Ms. Betsy Dean**_
-     301-496-2122	     301-594-2464  	     301-594-7743
- _[skirboll@od.nih.gov](mailto:skirboll@od.nih.gov)_ 	_[kutkatl@od.nih.gov](mailto:kutkatl@od.nih.gov)_	_[deanb@od.nih.gov](mailto:deanb@od.nih.gov)_

- _Office of Extramural Research_
_**Dr. Della Hann**_
- 301-402-2725
- _[hannd@od.nih.gov](mailto:hannd@od.nih.gov)_