Health Insurance Portability and Accountability Act (HIPAA),1 which protect the privacy of individually identifiable health information, was imminent and, Geetter noted, will influence the sharing of medical information for research as well as health care. Also, the Common Rule,2 which provides protection for human research subjects, was undergoing “a massive upgrade for the 21st century,” according to Geetter. For example, a proposed change to the rule dealt with whether human biospecimens could ever be considered de-identified, which will have a substantial effect on research. To further complicate matters, there is a lack of harmonization among regulations. For example, Food and Drug Administration (FDA) regulations, the Common Rule, and HIPAA do not agree on aspects of data sharing. Furthermore, state-by-state rules exist that tend to be disease specific, and these can have provisions related to data sharing.
Another uncertainty mentioned by Geetter related to the implications of the FDA’s “Part 11” rule,3 which covers the submission of electronic data to the FDA. Parts of the rule are currently enforced, but other parts are not. This affects data sharing because most data sharing involves electronic data, which is likely to be included in future FDA submissions.
The “preparatory to research exception” is a HIPAA pathway that allows sharing of protected health information (PHI) without an individual’s authorization in order to prepare for a clinical trial. However, data sharing using this pathway is limited by a restriction preventing PHI from leaving the premises of a covered entity. “This made sense when you were looking at dusty paper medical records,” Geetter noted. “It does not make as much sense, in my view, when you are talking about electronic data that may never be at the covered entity’s premises to begin with” because the data may be in an electronic health record held by a vendor who uses cloud computing services.
Geetter concluded by observing that the line between clinical care and research is growing progressively more blurred, especially as electronic health record systems become more common. Opportunities for systematic data collection across institutions will become more plentiful as these systems become increasingly interoperable. Data generated during clinical care, in addition to that resulting from research studies, may become available for mining. However, competing public priorities will likely place limits on the ability of that data to be viewed and shared. For
145 CFR 160, 164.
245 CFR 46.
321 CFR 50, 56.