Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research (2009)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Appendix A Previous Recommendations to the Department of Health and Human Services As a result of the reported concerns about the Privacy Rule’s effect on health research, several organizations have provided the U.S. Department of Health and Human Services (HHS) with recommendations on how to improve the way the Privacy Rule regulates research. Table A-1 describes the recommendations of the National Committee on Vital and Health Statistics, the Association of American Medical Colleges, the Secretary’s Advisory Committee on Human Research Protections, and the National Cancer Advisory Board. A brief explanation of how these organizations generated their recommendations is provided below. NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS The U.S. Congress gave the National Committee on Vital and Health Statistics (NCVHS) the responsibility of advising the Secretary of HHS on the adoption of the Privacy Rule standards, monitoring its implementation, and reporting annually to Congress on the progress made in its adoption. In accordance with this mandate, NCVHS has held a number of hearings on the Privacy Rule and the problems that the medical community has experienced in implementing the requirements of the Privacy Rule. One of the topics explored during these hearings was the obstacles associated with conducting research under the Privacy Rule. After each hearing, NCVHS subsequently issued a letter to the Secretary of HHS with a set of recom- mendations for improving the Privacy Rule. The recommendations outlined in Table A-1 are based on the hearings held on August 21–23, 2001, and November 19–20, 2003 (NCVHS, 2001, 2004).  

TABLE A-1 Previous Recommendations to HHS Regarding Research and the HIPAA Privacy Rule  Topic Issues Recommendations Organization Accounting for disclosures of Creates excessive paperwork for 1. Eliminate the accounting for disclosures NCVHS protected health information covered entities and has resulted in requirement for research (AAMC, SACHRP) AAMC (PHI) for research purposes some covered entities refusing to and SACHRP make PHI available to researchers. instead, inform patients that PHI might be used for research purposes (SACHRP). 2. HHS should issue guidance to provide covered entities with ways to fulfill this requirement in a convenient and practical manner (NCVHS). Standards for deidentification of Loss of ability to carry out research HHS should review standards to reduce the number NCVHS data because of loss of information, of categories removed from deidentified data. AAMC cost, and administrative burden. SACHRP Recruitment of research subjects 1. Institutional Review Boards 1. HHS should classify research recruitment as a NCVHS (IRBs) already consider recruitment health care operation, obviating the need for SACHRP as part of their study oversight. authorization and allaying confusion (SACHRP). 2. Artificial distinction between internal and external researchers 2. If “1” is rejected, HHS should provide additional exists. formal guidance on contacting potential research 3. Identification and contacting participants potential research participants are and considered different activities. HHS should end differential treatment of internal and 4. Creation of biased populations external researchers for purposes of identifying and in studies, especially too few less- contacting potential participants (SACHRP, NCVHS). educated, low-income individuals. 

Databases and tissue Loss of future research 1. When an IRB has approved a consent form that NCVHS repositories: future uses of opportunities; confusion regarding permits future uses under the Common Rule SACHRP research data and biological combined authorization. standard, the same should apply under the Privacy NCAB materials Rule. Permit combining research authorization for a clinical trial and for banking data and materials collected as part of the trial in a single form (NCVHS, SACHRP). 2. Eliminate the restriction on the use of data for unspecified future research, or allow a less specific description of the intended use (NCAB). 3. Clarify how identified datasets collected under a broad authorization to create a database could be released to researchers through the use of a waiver of authorization, a limited dataset, or by deidentifying the information. Research exempt under the Discrepancies between the 1. Revise categories of research not requiring NCVHS Common Rule Common Rule and the Privacy authorization to include research determined by IRB SACHRP Rule create challenges for IRBs and to be exempt from Common Rule requirements Privacy Boards that must make (SACHRP). decisions about such things as waivers of authorization. 2. HHS should provide further interpretation, guidance, and technical assistance to help the research community to understand the relationship between the Privacy Rule and the Common Rule (NCVHS).  continued 

TABLE A-1 Continued  Topic Issues Recommendations Organization Use and disclosure of PHI for The process for obtaining an 1. Authorization and waiver of authorization NCVHS research authorization or waiver of requirements should be eliminated for research AAMC authorization is burdensome, and purposes. Research disclosures are adequately NCAB discourages research from being protected by the Common Rule (AAMC). conducted. 2. Continue to require authorization or waiver of authorization for research, despite the administrative burden (NCVHS). IRB waiver of authorization Authorization and informed HHS should clarify that nothing in the Privacy Rule NCVHS consent can be combined into a prevents IRBs from reviewing authorization forms single document. Under the when considering the adequacy of privacy and Common Rule, IRBs must review confidentiality of subjects under the Common Rule. informed consent documents. However, the Privacy Rule does not require IRBs to review authorization forms. Genetics research It is unclear whether DNA samples HHS should clarify whether DNA samples can be NCVHS can ever be deidentified because considered deidentified data. analyzing the samples could reveal unique DNA identifiers of the individual. Types of covered entities Academic medical centers cannot The covered entity status, hybrid entity status, and AAMC organize in a manner that reflects affiliated covered entity status should be redefined to the functional operations of the reflect the function served by the different parts of the medical school, affiliated practice organization, not the organizational form of the plans, and teaching hospital. organization. 

Transition provisions The implementation of the Privacy For research begun before the Privacy Rule took SACHRP Rule could hamper studies already effect, grandfather research that did not receive IRB under way. review or oversight because it was exempt under Common Rule. International research 1. Different interpretations of the 1. Clarify, if legally possible, that PHI from foreign SACHRP Privacy Rule lead to recruitment nationals outside the United States collected by difficulties. researchers from covered entities is not subject to the 2. Tendency to abandon U.S. Privacy Rule solely because of the relationship with research sites for those with less the covered entity. stringent rules. (NOTE: This is not strictly a problem in international 2. More generally, clarify what the rules are regarding research.) research on foreign nationals. Public health research Effect on registries and other public Broaden the definition of public health authority to SACHRP health tools. ensure inclusion of federal and state agencies that are primarily responsible for the prevention and control of disease, injury, or disability, or the analysis of data in alliance with public health and public benefits agencies. NOTE: Association of American Medical Colleges (AAMC), National Cancer Advisory Board (NCAB), National Committee on Vital and Health Statistics (NCVHS), and Secretary’s Advisory Committee on Human Research Protections (SACHRP).  

0 BEYOND THE HIPAA PRIVACY RULE ASSOCIATION OF AMERICAN MEDICAL COLLEGES The Association of American Medical Colleges (AAMC) has publicly opposed the current research provisions of the Privacy Rule since the Final Rule was proposed in 2002. During the Notice of Proposed Rulemaking period, AAMC submitted a lengthy and detailed comment urging HHS not to apply the Privacy Rule to research. AAMC has continued to campaign for a change in the rule’s regulation of research since it became law. In spring 2003, AAMC conducted a survey of 331 investigators, Institutional Review Board personnel, privacy officials, research administrators, deans, and others involved in research to gain knowledge about how the Privacy Rule has influenced the research process. AAMC then created a database of qualitative case reports documenting research projects that were affected, delayed, hindered, benefited, abandoned, or foregone because of the Privacy Rule (see also Chapter 5 for survey results). Based on the results of the survey, AAMC came up with a number of recommendations for improving the Privacy Rule’s regulation of research (NCVHS, 2003). SECRETARY’S ADVISORY COMMITTEE ON HUMAN RESEARCH PROTECTIONS The Secretary’s Advisory Committee on Human Research Protections (SACHRP) is charged with advising the Secretary of HHS on human sub- jects research and the protection of human subjects. On March 30, 2004, SACHRP received presentations from a number of different medical experts on the Privacy Rule’s impact on human subjects research. Based on these presentations, SACHRP submitted recommendations to HHS on Septem- ber 1, 2004, on areas of the Privacy Rule that it deemed in need of clarifica- tion or modification (SACHRP, 2005). NATIONAL CANCER ADVISORY BOARD The National Cancer Advisory Board (NCAB) is appointed by the President to advise the Secretary of HHS and the Director of the National Cancer Institute with respect to the activities of the Institute. In 2003, NCAB undertook a survey to examine the impact that the Privacy Rule has had on cancer research. It requested the names of Privacy Rule experts from cancer center directors, Clinical Cooperative Group Chairs, and prin- cipal investigators of Special Programs of Research Excellence. Through this process 226 Privacy Rule experts were identified. These experts were invited to visit a Website and submit public comments on the effect of the Privacy Rule on cancer research. A total of 89 responses were received (see also Chapter 5 for survey results). On November 5, 2004, NCAB sent a 

 APPENDIX A set of recommendations to the Secretary of HHS. The recommendations listed ways to minimize the negative impact of the Privacy Rule on cancer research (NCI, 2003). REFERENCES NCI (National Cancer Institute). 2003. The HIPAA Privacy Rule: Feedback from NCI cancer centers, cooperative groups, and specialized programs of research excellence (spores). NCVHS (National Committee on Vital and Health Statistics). 2001. Letter to Secretary Thompson on research recommendations as it relates to the new Privacy Rule. http:// www.ncvhs.hhs.gov/011121lt.htm (accessed September 11, 2008). NCVHS, Subcommittee on Privacy and Confidentiality. 2003. Susan Ehringhaus’s testimony on behalf of the Association of American Medical Colleges. November 19, 2003. NCVHS. 2004. Letter to Secretary Thompson, recommendation on the effect of the Privacy Rule. http://ncvhs.hhs.gov/040305l2.htm (accessed August 27, 2008). SACHRP (Secretary’s Advisory Committee on Human Research Protections). 2005. Summary of SACHRP’s recommendations on the HIPAA Privacy Rule. http://www.hhs.gov/ohrp/ sachrp/tableofrecommendations.html (accessed March 10, 2006).