HIPAA PRIVACY REGULATIONS

&nb= sp;

AND MEDI= CAL RESEARCH:

&nb= sp;

UTHSC IRB GUIDANCE AND PROCEDURES

&nb= sp;

Prepared by= :

Terrence F.= Ackerman, Ph.D.

Executive V= ice Chairman

Institution= al Review Board

Professor a= nd Chairman

Department = of Human Values and Ethics

INTRODUCTION

Recognizin= g that the rapid evolution of information systems poses dangers to the privacy of personal health information, Congress addressed the issue of establishing national standards for the use and disclosure of individually identifiable health information in the Health Insurance Portability and Accountability A= ct of 1996 (HIPAA). Certain sect= ions of the Act (called, ironically, the “Administrative Simplification Provisions”) authorized the Secretary of Health and Human Services (H= HS) to promulgate standards for the privacy of individually identifiable health information if Congress did not enact health care privacy legislation by Au= gust 21, 1999. After Congress fail= ed to meet its self-imposed deadline, HHS issued privacy regulations on December = 28, 2000 entitled, “Standards for Privacy of Individually Identifiable He= alth Information”, 45 CFR Parts 160 and 164. Subsequently, Part 160 was issued = in amended form on May 31, 2002 and Parts 160 and 164 were issued with additio= nal amendments on August 14, 2002. The compliance date for health care facilities and providers is April 14, 2003. The regulations are com= monly referred to as the “Privacy Rule” and are administered by the H= HS Office of Civil Rights.

            The regulations apply to individually identifiable health information (called “protected health information” (PHI) in the text of the regulat= ion) that is used and disclosed by health care providers and facilities. In promulgating the regulations, H= HS cited three basic objectives: to provide persons with specific and concrete legal controls over the use and disclosure of PHI, to minimize harm to the interests of individuals resulting from unauthorized use and disclosure of = PHI, and to provide uniformity and consistency for privacy protections across the nation. The regulations impose three basic requirements on health care providers and facilities (called “covered entities” in the text of the regulations) that hold or= maintain PHI. First, covered entities = must obtain the agreement of patients to use or disclose their PHI unless specif= ied exceptions are applicable. Se= cond, persons must be notified by covered entities of their rights under the priv= acy regulations. Third, use and disclosure of PHI by covered entities must generally be restricted to the minimum necessary to accomplish the intended purpose. Finally, the regulations implement= four basic rights of persons with respect to their PHI: to agree to the use and disclosure= of PHI, to inspect and copy their records, to amend their records, and to obta= in certain limited audits of the disclosures of their records that have been m= ade by covered entities.

            The Privacy Rule establishes the conditions under which PHI may be used or disclosed in medical research. The following discussion has two objectives.&n= bsp; The first is to provide UTHSC investigators, study coordinators and other research personnel with a comprehensive overview of the requirements = of the Privacy Rule as they pertain to the conduct of medical research. The second is to provide a synopsi= s of IRB policies and procedures as revised to implement the requirements of the Privacy Rule in the research context.

RESEARCH USE OF PHI WITH AUTH= ORIZATION

            The Privacy Rule delineates two basic types of written agreement that are utili= zed to secure the permission of persons for the use and disclosure of PHI. The first type is a general, writt= en consent by individuals for the use and disclosure of their PHI for treatment, payme= nt and health care operations in the non-research setting. This written consent provides a one-time, blanket permission for a covered entity to utilize PHI for various purposes related to the provision of clinical care. The second type of written agreeme= nt involves authorization for the use of PHI for specific purpos= es other than treatment, payment or health care operations. Specific written authorization is required for the use and disclosure of PHI in research studies. Under the regulations, this authorization may be incorporated into consent forms for clinical research = or may be secured via a separate authorization form. The UTHSC IRB is adopting the opti= on of including the authorization in the consent form for research studies.

            The Privacy Rule specifies the basic elements of information that must be provi= ded in writing to prospective subjects in securing authorization for the resear= ch use of their PHI. These items= of information are covered in the UTHSC IRB authorization template in Appendix= A. This template, appropriately adapt= ed for individual studies, must be inserted into the confidentiality section of research consent forms. Accor= ding to the regulations, the following elements must be included in the written authorization and presented in “plain language”:

(1) a description of the informatio= n to be used or disclosed that identifies the information “in a specific a= nd meaningful fashion”;

(2) the name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;

(3) the name or other specific identification of the person(s), or class of persons, to whom the covered entity is permitted to make the requested use or disclosure;

(4) a description of each purpose f= or the requested use or disclosure;

(5) an expiration date or an expira= tion event that relates to the purpose of the use or disclosure; the expiration = date may be specified as “end of the research study”, or as “none” in the event that the PHI will be used for an indefinite period as part of a research database or repository;

(6) a desc= ription of the individual’s right to revoke the authorization in writing, including limitations on this right, and an explanation of how the individu= al may revoke the authorization; in explaining limitations on the right to rev= oke the authorization, investigators must indicate that the Privacy Rule permits the continued research use and disclosure of PHI obtained from the subject prior to the time when the authorization is revoked;

(7) an explanation that the investi= gator may condition research participation on the provision of the authorization = and that subjects who revoke the authorization may be withdrawn from the study;=

(8) the potential for information disclosed pursuant to the authorization to be subject to re-disclosure by t= he recipient and no longer protected by the Privacy Rule; and

(9) when the research includes trea= tment, a statement that the subject’s access to PHI will be temporarily suspended as long as the research is in progress, but will be reinstated up= on completion of the research; this ground for the denial of access does not a= pply to research in which treatment is not provided.

= ;

Several ot= her features of authorizations must also be noted. First, the authorization must be s= igned and dated by the subject or the subject’s personal representative. Second, if the signature is secure= d from the subject’s personal representative, then a description of the representative’s authority to act on the individual’s behalf mu= st also be provided. This latter provision requires that, for studies in which personal representatives may = be providing consent or permission for some subjects, a new line must be inser= ted in the signature section of the research consent form for describing the relationship of the representative to the subject. Third, a copy of the signed authorization form must be provided to the subject or the subject’s personal representative. When= the authorization is included in the consent form for the research study, a cop= y of the consent form must be provided to the subject or the subject’s personal representative. Fina= lly, signed authorization forms or consent forms including the authorization mus= t be retained for at least six years.

RESEARCH USE OF PHI WITHOUT A= UTHORIZATION

            The Privacy Rule permits the use of PHI in medical research without subject authorization under several conditions.&nb= sp; These conditions include review of PHI preparatory to research, rese= arch involving subjects who are decedents, research involving the use of limited data sets, and research in which a waiver or alteration of authorization is granted by the IRB. Requests = to use PHI for research purposes without subject authorization must be submitted to the IRB using Form 8, “Request for the Research Use and Disclosure of Protected Health Information (PHI) Without Subject Authorization”, attached as Appendix C.

Reviews of PHI Preparatory to Research

&nb= sp; Investigat= ors may review PHI without authorization in the preparation of a research study, e.g., to assist in the formulation of a study hypothesis. In order to use PHI under this pro= vision of the regulations, the researcher must provide assurances to the covered entity holding the PHI that:

&nb= sp; (1) the use or disclosure of PHI is sought solely for the purpose of preparing a research protocol or for similar purposes preparatory to research;

(2) no PHI= is to be removed from the covered entity by the researcher in the course of the review; and

(3) the PH= I for which use or access is sought is necessary for research purposes. HHS has made clear that this excep= tion to the authorization requirement precludes the electronic transfer of PHI f= rom a covered entity to a researcher’s office. In addition, reviews preparatory to research must not involve making copies of PHI or making notes that include PHI. However, medical records= of interest to investigators in preparing a study may be flagged for future reference.

Research Involving Subjects Who Are Decedents&n= bsp;

Investigators may proceed without authorization when using PHI that is derived entirely f= rom decedents. Qualification unde= r this provision of the Privacy Rule requires that the researcher provide to the covered entity:

(1) assura= nce that the use or disclosure is sought solely for research on the PHI of decedents= ;

(2) documentation, at the request o= f the covered entity, of the death of such individuals; and

(3) assura= nce that use of the PHI is necessary for the research purposes.

Research Involving the Use of Limited Data Sets

The regulations permit covered entities to use or disclose PHI for research pur= poses without subject authorization if the use or disclosure involves only a “limited data set” and the covered entity enters into a data use agreement with the investigator. A “limited data set” is PHI that excludes the following direct identifiers of the individual or of relatives, employers, or household memb= ers of the individual:

(1) names;

(2) postal= address information, other than town or city, state and zip code;

(3) telephone numbers;

(4) fax numbers;

(5) electronic mail addresses;

(6) social security numbers;

(7) medical record numbers;

(8) health= plan beneficiary numbers;

(9) account numbers;

(10) certificate/license numbers;

(11) vehic= le identifiers and serial numbers, including license plate numbers;

(12) device identifiers and serial numbers;

(13) web u= niversal resource locaters (URLs);

(14) internet protocol (IP) address numbers;

(15) biometric identifiers, includi= ng finger and voice prints; and

(16) full face photographic images = and any comparable images.

A limited data set may, however, in= clude other indirect identifiers, especially dates of birth, treatment, discharge= , or death.

= A covered entity may use or disclose a limited data set without subj= ect authorization for research purposes only if it completes a data use agreeme= nt with the researcher who is the recipient of the data. This agreement must include several elements. First, it must spec= ify that the investigator may use or disclose the limited data set only for research purposes. Second, th= e agreement must establish who is permitted to receive and use the limited data set. Third, the agreement must specify = that the recipient investigator will: (1) not use or further disclose the information other than as permitted by the data use agreement or by law; (2) use appropriate safeguards to prevent use or disclosure of the information except for the purposes described in the data use agreement; (3) report to = the covered entity any use or disclosure of the information not addressed by the data use agreement if the investigator becomes aware of such use or disclos= ure; (4) ensure that any agents, including a subcontractor, to whom he or she provides the limited data set agrees to the same restrictions and conditions that apply to the recipient investigator with respect to the information; a= nd (5) not attempt to identify or contact the subjects whose PHI is used.

IRB Waiver of Authorization for Research Use of PHI

The Privacy Rule permits investigators to use PHI in research under an alterati= on or waiver of the authorization requirements when they obtain approval from = an IRB or a “privacy board”. Investigators are required to secure the waiver or alteration of authorization from only one IRB or privacy board, even if they will seek PHI from more than one covered entity maintaining such information. In addition, the committee utilize= d by the investigator is not required to be the IRB or the privacy board of the covered entity that maintains the PHI.&nbs= p; However, covered entities providing PHI are permitted to request that their own IRB or privacy board approve requests for waiver or alteration of authorization prior to allowing use or disclosure of PHI to investigators.<= span style=3D'mso-spacerun:yes'> Because the UTHSC IRB will be used= as the mechanism for reviewing requests from UT investigators for waiver or alteration of authorization, the privacy board mechanism will not be discus= sed here further.

&nb= sp; The criteria for determining whether investigators qualify for a waiver or alteration of authorization are specified in the Privacy Rule. The investigator must provide information about the research study that enables the IRB to determine that three conditions are satisfied:

(1) there must be no more than mini= mal risk to the privacy of individual subjects based on the presence of the following elements: (a) an adequate plan to protect the identifiers from improper use and disclosure; (b) an adequate plan to destroy the identifier= s at the earliest opportunity consistent with the conduct of the research, unless there is a health or research justification for retaining identifiers or su= ch retention is otherwise required by law; and (c) an adequate written assuran= ce that the PHI will not be reused or disclosed to any other person or entity, except as required by law, or for authorized oversight of the research stud= y, or for other research for which the use or disclosure is permitted without authorization;

(2) it must not be practicable to conduct the research without the waiver or alteration of the authorization requirement; and

(3) it must not be practicable to conduct the research without access to and us= e of the PHI for which the waiver or alteration of the authorization requirement= is sought.

Once the IRB has approved the waiver or alteration of authorization, the investigator must provide the covered entity maintaining the PHI with documentation from the IRB that establishes its approval. This approval letter from the IRB = must include the following elements. First, it must identify the IRB and provide the date on which the wa= iver or alteration of authorization was approved. Second, it must include a statemen= t that the IRB has determined that the waiver or alteration satisfies the criteria described above. Third, the approval letter must provide a brief description of the PHI for which use or access has been determined to be necessary by the IRB. Fourth, the letter must describe w= hether the request for waiver or alteration of the authorization requirements was reviewed under full board or expedited review procedures. Finally, the approval letter must = be signed by the chair of the IRB or his/her designee.

Waiver of authorization may be sought for three specific research uses of PHI:= to identify potential research subjects through review of their PHI; to contact potential subjects in order to determine their interest in research participation; and to receive or collect PHI during the conduct of research studies.

Identification of= Potential Subjects

Although investigators can use PHI in activities that are preparatory to research without authorization and without a waiver (as described above, under “Reviews of PHI Preparatory to Research”), such use must not involve either removing records from facilities or copying PHI from these records. If investigators nee= d to copy or remove information from medical records in order to identify potent= ial subjects, then they must secure a waiver of authorization to examine these medical records if they are not staff members of the institution or are not direct care providers for the individuals whose records will be reviewed. However, if investigators are staff members of the institution holding the records or are direct care providers= for the individuals whose records will be reviewed, then a waiver of authorizat= ion is not required.

Recruitment of Pot= ential Subjects

Once potential research subjects have been identified, they must be contacted in accord with the provisions of the regulations. Personnel from the institution hol= ding the records may use PHI to make the initial contact, without prior authoriz= ation from potential subjects, to determine their interest in participating in a research study. Similarly, di= rect care providers may communicate with their current or past patients about research opportunities without prior authorization of these patients. However, an investigator may not u= se the PHI maintained by another provider or facility in order to make the initial contact with individuals about participation in a research study, unless th= ose individuals have given prior authorization for such a contact or the IRB has provided a waiver of authorization to the investigator.

Use Of Pro= tected Health Information in the Conduct of<= /u> Research Studies

&= nbsp; After subjects are identified and recruited, the study itself will involve the disclosure to investigators of PHI maintained by covered entities and/or the creation of PHI pertaining to the performance and results of study procedures. Investigators may obtain a waiver or alteration of prior authorization by subjects if the research use of their PHI meets the conditions described above for approval= by the IRB. This option will nor= mally be relevant only to studies in which waiver or alteration of informed conse= nt for research participation is also being sought. The most common use of the waiver = option will relate to retrospective studies of PHI associated with existing medical records and specimens.

USE OF DE-IDENTIFIED DATA IN = MEDICAL RESEARCH

&= nbsp; Health information that provides no reasonable basis for identifying individuals is not PHI according to the regulatory definition. It may be used in medical research without subject authorization or an IRB waiver. The Privacy Rule refers to such he= alth information as “de-identified data”.

The regulations provide two mechani= sms for determining that PHI has been transformed into “de-identified data”. First, health information may be considered to be “de-identified” if a person, who possesses appropriate knowledge and experience in using accepted statis= tical and scientific principles and methods for rendering information not individually identifiable, determines that the risk is very small that the information could be used by the recipient, alone or in combination with ot= her information, to identify individual subjects. When this mechanism is used for determining that PHI has been de-identified, the individual providing the assessment must document the methods and results of the analysis that justi= fy his/her determination that the health information is properly de-identified. Second, health information can be considered de-identified provided that the following identifiers of the individual or of relatives, employers or household membe= rs of the individual are removed:

(1) names;

(2) all geographic subdivisions sma= ller than a state, including street address, city, county, precinct, and their equivalent geocodes, except for the initial three digits of a zip code if t= he geographic unit represented by these three initial digits contains more than 20,000 people;

(3) all elements of dates (except y= ear) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, and all ages over 89 and all elements = of dates indicative of age over 89, except that such ages and elements may be aggregrated into a single category of age 90 or older;

(4) telephone numbers;

(5) fax numbers;

(6) electronic mail addresses;

(7) social security numbers;

(8) medical record numbers;

(9) health plan beneficiary numbers= ;

(10) account numbers;

(11) certificate/license numbers;

(12) vehicle identifiers and serial numbers, including license plate numbers;

(13) device identifiers and serial numbers;

(14) web universal resource locators (URLs);

(15) internet protocol (IP) address numbers;

(16) biometric identifiers, includi= ng finger and voice prints;

(17) full face photographic images and any comparable images; and

(18) any other unique identifying number, characteristic, or code.

Covered enti= ties may assign code numbers to individual records to allow de-identified informatio= n to be re-identified, provided that the code is not derived from information ab= out the individuals and the covered entity does not disclose the mechanism for re-identification.

<= /o:p>

TRANSITION REQUIREMENTS

&= nbsp; The Privacy Rule also includes provisions addressing the transition period duri= ng which the new privacy regulations are implemented. For subjects who have entered rese= arch studies prior to the compliance date of April 14, 2003, and who have provid= ed informed consent to participate in research, or have been entered in a rese= arch study with an IRB waiver or alteration of consent, or who have otherwise authorized the use of their PHI in the research, investigators and other covered entities may continue to use or disclose the PHI of these subjects without meeting the provisions of the regulations, whether this PHI is crea= ted or received before or after the compliance date. However, for subjects who enter re= search studies on or after the compliance date, the provisions of the Privacy Rule described above must be satisfied.

<= /o:p>

REVISION OF IRB POLICIES AND = PROCEDURES

&= nbsp; Implementation of the privacy regulations requires revision in IRB policies and procedures. These changes aff= ect all new applications and previous= ly approved studies, provided that at least some of the subjects will be accru= ed on or after April 14, 2003. In addition, the provisions of the privacy rule must be satisfied for both stu= dies in which informed consent is required and those in which informed consent h= as been altered or waived.

New Applications <= /p>

For all new studies received in the= IRB office after February 15,2003 and in which some subjects will be accrued on= or after April 14, 2003, the application must specify in the section on confidentiality either that the research use and disclosure of PHI will be = undertaken with authorization, or that the research use or disclosure satisfies one of= the conditions under which subject authorization is not required under the priv= acy regulations.

For studies in which subject authorization for the use and disclosure of PHI is required, the confidentiality section of the subject consent form must incl= ude the required authorization disclosure.&nbs= p; The required disclosure is provided in appendix A. The authorization language in the consent form must conform precisely to the te= mplate provided in Appendix A. T= he model confidentiality section, as revised to include the authorization for = the use of PHI, is provided in Appendix B.&nbs= p; The investigator will receive approval for the authorization disclos= ure in a separate paragraph of the final approval letter for the study.

For studies in which the use or disclosure of PHI may satisfy one of the conditions under which subject authorization is not required under the privacy regulations, the investigat= or must submit UTHSC IRB Form 8, “Request for Research Use and Disclosur= e of Protected Health Information Without Subject Authorization” (see Appe= ndix C). The investigator will rec= eive a separate approval letter for the use and disclosure of PHI without subject authorization. This approval = letter can be presented to the entity maintaining the PHI, if separate from the investigator, to establish that the IRB has reviewed the proposed use and disclosure of PHI without subject authorization and has determined that it satisfies the regulatory requirements.&nbs= p; If the PHI is maintained by the investigator, the letter should simp= ly be retained as confirmation that the regulatory requirements have been satisfied for using or disclosing PHI in research without subject authorization.

Previously Approved Studies

For all previously approved studie= s in which some of the subjects will be accrued on or after the compliance date of April 14, 2003 and for which the informed consent of subjects is required, subject consent forms must be revised to include the required authorization language as provided in Appendix A. The authorization language = in the consent form must conform precisely to the template provided. The revision should be submitted u= sing Form 2. This requirement appl= ies to studies that have received full board or expedited review, as well as to studies that have received exempt status with informed consent required. No subjects may be accrued on or after April 14 until the revised consent form= is reviewed and approved by the IRB.

For all previously approved studies in which some subjects will be accrued on or after the compliance date of April 14, 2003 and for which informed consent was altered or waived, a request to use and disclose PHI without subject authorization should be submitted using Form 8. This requirement applies to studie= s that have received full board or expedited approval, as well as exempt studies.<= span style=3D'mso-spacerun:yes'> No subjects may be accrued on or after April 14 until the Form 8 application is reviewed and approved by the IRB.

Submission to the IRB of the revised consent documents or Form 8 for all previously approved studies in which so= me subjects will be accrued on or after April 14, 2003 should be completed by = February 15, 2003 in order to ass= ure that IRB review and approval is completed by the compliance date.



<= /o:p>







        &= nbsp;