Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 285
Appendix A
Previous Recommendations
to the Department of Health
and Human Services
As a result of the reported concerns about the Privacy Rule’s effect on
health research, several organizations have provided the U.S. Department
of Health and Human Services (HHS) with recommendations on how to
improve the way the Privacy Rule regulates research. Table A-1 describes
the recommendations of the National Committee on Vital and Health
Statistics, the Association of American Medical Colleges, the Secretary’s
Advisory Committee on Human Research Protections, and the National
Cancer Advisory Board. A brief explanation of how these organizations
generated their recommendations is provided below.
NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS
The U.S. Congress gave the National Committee on Vital and Health
Statistics (NCVHS) the responsibility of advising the Secretary of HHS on
the adoption of the Privacy Rule standards, monitoring its implementation,
and reporting annually to Congress on the progress made in its adoption.
In accordance with this mandate, NCVHS has held a number of hearings
on the Privacy Rule and the problems that the medical community has
experienced in implementing the requirements of the Privacy Rule. One of
the topics explored during these hearings was the obstacles associated with
conducting research under the Privacy Rule. After each hearing, NCVHS
subsequently issued a letter to the Secretary of HHS with a set of recom-
mendations for improving the Privacy Rule. The recommendations outlined
in Table A-1 are based on the hearings held on August 21–23, 2001, and
November 19–20, 2003 (NCVHS, 2001, 2004).
OCR for page 286
TABLE A-1 Previous Recommendations to HHS Regarding Research and the HIPAA Privacy Rule
Topic Issues Recommendations Organization
Accounting for disclosures of Creates excessive paperwork for 1. Eliminate the accounting for disclosures NCVHS
protected health information covered entities and has resulted in requirement for research (AAMC, SACHRP) AAMC
(PHI) for research purposes some covered entities refusing to and SACHRP
make PHI available to researchers. instead, inform patients that PHI might be used for
research purposes (SACHRP).
2. HHS should issue guidance to provide covered
entities with ways to fulfill this requirement in a
convenient and practical manner (NCVHS).
Standards for deidentification of Loss of ability to carry out research HHS should review standards to reduce the number NCVHS
data because of loss of information, of categories removed from deidentified data. AAMC
cost, and administrative burden. SACHRP
Recruitment of research subjects 1. Institutional Review Boards 1. HHS should classify research recruitment as a NCVHS
(IRBs) already consider recruitment health care operation, obviating the need for SACHRP
as part of their study oversight. authorization and allaying confusion (SACHRP).
2. Artificial distinction between
internal and external researchers 2. If “1” is rejected, HHS should provide additional
exists. formal guidance on contacting potential research
3. Identification and contacting participants
potential research participants are and
considered different activities. HHS should end differential treatment of internal and
4. Creation of biased populations external researchers for purposes of identifying and
in studies, especially too few less- contacting potential participants (SACHRP, NCVHS).
educated, low-income individuals.
OCR for page 287
Databases and tissue Loss of future research 1. When an IRB has approved a consent form that NCVHS
repositories: future uses of opportunities; confusion regarding permits future uses under the Common Rule SACHRP
research data and biological combined authorization. standard, the same should apply under the Privacy NCAB
materials Rule. Permit combining research authorization for a
clinical trial and for banking data and materials
collected as part of the trial in a single form
(NCVHS, SACHRP).
2. Eliminate the restriction on the use of data for
unspecified future research, or allow a less specific
description of the intended use (NCAB).
3. Clarify how identified datasets collected under a
broad authorization to create a database could be
released to researchers through the use of a waiver of
authorization, a limited dataset, or by deidentifying
the information.
Research exempt under the Discrepancies between the 1. Revise categories of research not requiring NCVHS
Common Rule Common Rule and the Privacy authorization to include research determined by IRB SACHRP
Rule create challenges for IRBs and to be exempt from Common Rule requirements
Privacy Boards that must make (SACHRP).
decisions about such things as
waivers of authorization. 2. HHS should provide further interpretation,
guidance, and technical assistance to help the research
community to understand the relationship between
the Privacy Rule and the Common Rule (NCVHS).
continued
OCR for page 288
TABLE A-1 Continued
Topic Issues Recommendations Organization
Use and disclosure of PHI for The process for obtaining an 1. Authorization and waiver of authorization NCVHS
research authorization or waiver of requirements should be eliminated for research AAMC
authorization is burdensome, and purposes. Research disclosures are adequately NCAB
discourages research from being protected by the Common Rule (AAMC).
conducted.
2. Continue to require authorization or waiver of
authorization for research, despite the administrative
burden (NCVHS).
IRB waiver of authorization Authorization and informed HHS should clarify that nothing in the Privacy Rule NCVHS
consent can be combined into a prevents IRBs from reviewing authorization forms
single document. Under the when considering the adequacy of privacy and
Common Rule, IRBs must review confidentiality of subjects under the Common Rule.
informed consent documents.
However, the Privacy Rule does not
require IRBs to review
authorization forms.
Genetics research It is unclear whether DNA samples HHS should clarify whether DNA samples can be NCVHS
can ever be deidentified because considered deidentified data.
analyzing the samples could reveal
unique DNA identifiers of the
individual.
Types of covered entities Academic medical centers cannot The covered entity status, hybrid entity status, and AAMC
organize in a manner that reflects affiliated covered entity status should be redefined to
the functional operations of the reflect the function served by the different parts of the
medical school, affiliated practice organization, not the organizational form of the
plans, and teaching hospital. organization.
OCR for page 289
Transition provisions The implementation of the Privacy For research begun before the Privacy Rule took SACHRP
Rule could hamper studies already effect, grandfather research that did not receive IRB
under way. review or oversight because it was exempt under
Common Rule.
International research 1. Different interpretations of the 1. Clarify, if legally possible, that PHI from foreign SACHRP
Privacy Rule lead to recruitment nationals outside the United States collected by
difficulties. researchers from covered entities is not subject to the
2. Tendency to abandon U.S. Privacy Rule solely because of the relationship with
research sites for those with less the covered entity.
stringent rules. (NOTE: This is not
strictly a problem in international 2. More generally, clarify what the rules are regarding
research.) research on foreign nationals.
Public health research Effect on registries and other public Broaden the definition of public health authority to SACHRP
health tools. ensure inclusion of federal and state agencies that are
primarily responsible for the prevention and control
of disease, injury, or disability, or the analysis of data
in alliance with public health and public benefits
agencies.
NOTE: Association of American Medical Colleges (AAMC), National Cancer Advisory Board (NCAB), National Committee on Vital and Health
Statistics (NCVHS), and Secretary’s Advisory Committee on Human Research Protections (SACHRP).
OCR for page 290
0 BEYOND THE HIPAA PRIVACY RULE
ASSOCIATION OF AMERICAN MEDICAL COLLEGES
The Association of American Medical Colleges (AAMC) has publicly
opposed the current research provisions of the Privacy Rule since the Final
Rule was proposed in 2002. During the Notice of Proposed Rulemaking
period, AAMC submitted a lengthy and detailed comment urging HHS not
to apply the Privacy Rule to research. AAMC has continued to campaign
for a change in the rule’s regulation of research since it became law. In
spring 2003, AAMC conducted a survey of 331 investigators, Institutional
Review Board personnel, privacy officials, research administrators, deans,
and others involved in research to gain knowledge about how the Privacy
Rule has influenced the research process. AAMC then created a database of
qualitative case reports documenting research projects that were affected,
delayed, hindered, benefited, abandoned, or foregone because of the Privacy
Rule (see also Chapter 5 for survey results). Based on the results of the
survey, AAMC came up with a number of recommendations for improving
the Privacy Rule’s regulation of research (NCVHS, 2003).
SECRETARY’S ADVISORY COMMITTEE ON
HUMAN RESEARCH PROTECTIONS
The Secretary’s Advisory Committee on Human Research Protections
(SACHRP) is charged with advising the Secretary of HHS on human sub-
jects research and the protection of human subjects. On March 30, 2004,
SACHRP received presentations from a number of different medical experts
on the Privacy Rule’s impact on human subjects research. Based on these
presentations, SACHRP submitted recommendations to HHS on Septem-
ber 1, 2004, on areas of the Privacy Rule that it deemed in need of clarifica-
tion or modification (SACHRP, 2005).
NATIONAL CANCER ADVISORY BOARD
The National Cancer Advisory Board (NCAB) is appointed by the
President to advise the Secretary of HHS and the Director of the National
Cancer Institute with respect to the activities of the Institute. In 2003,
NCAB undertook a survey to examine the impact that the Privacy Rule
has had on cancer research. It requested the names of Privacy Rule experts
from cancer center directors, Clinical Cooperative Group Chairs, and prin-
cipal investigators of Special Programs of Research Excellence. Through
this process 226 Privacy Rule experts were identified. These experts were
invited to visit a Website and submit public comments on the effect of the
Privacy Rule on cancer research. A total of 89 responses were received (see
also Chapter 5 for survey results). On November 5, 2004, NCAB sent a
OCR for page 291
APPENDIX A
set of recommendations to the Secretary of HHS. The recommendations
listed ways to minimize the negative impact of the Privacy Rule on cancer
research (NCI, 2003).
REFERENCES
NCI (National Cancer Institute). 2003. The HIPAA Privacy Rule: Feedback from NCI cancer
centers, cooperative groups, and specialized programs of research excellence (spores).
NCVHS (National Committee on Vital and Health Statistics). 2001. Letter to Secretary
Thompson on research recommendations as it relates to the new Privacy Rule. http://
www.ncvhs.hhs.gov/011121lt.htm (accessed September 11, 2008).
NCVHS, Subcommittee on Privacy and Confidentiality. 2003. Susan Ehringhaus’s testimony
on behalf of the Association of American Medical Colleges. November 19, 2003.
NCVHS. 2004. Letter to Secretary Thompson, recommendation on the effect of the Privacy
Rule. http://ncvhs.hhs.gov/040305l2.htm (accessed August 27, 2008).
SACHRP (Secretary’s Advisory Committee on Human Research Protections). 2005. Summary
of SACHRP’s recommendations on the HIPAA Privacy Rule. http://www.hhs.gov/ohrp/
sachrp/tableofrecommendations.html (accessed March 10, 2006).
OCR for page 292
