hipaa’s impact on research and clinical · pdf filehipaa’s impact on research and...
TRANSCRIPT
![Page 1: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/1.jpg)
1
HIPAA’s Impact on Research and Clinical Trials
Tom Merchant, Esq., GlaxoSmithKline Leigh-Ann Patterson, Esq., Nixon Peabody LLP
The PharmaCongress • Philadelphia, PA • November 13, 2002 © 2002
![Page 2: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/2.jpg)
2
Overview of Presentation
I. Privacy: Past, Present, and Future
II. How HIPAA Affects Research
A. “HIPAA 101” – in context of research
B. General Rule Governing Research –PHI may be used for research under three specific circumstances
NIXON PEABODY LLPATTORNEYS AT LAW
![Page 3: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/3.jpg)
3
Overview of Presentation (cont.)C. The Three Circumstances
1. Individual Authorization2. Waiver of HIPAA Authorization3. De-identified Data
D. Other Rules 1. Accounting of Disclosures2. Use of Pre-Existing PHI
![Page 4: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/4.jpg)
4
Overview of Presentation (cont.)
III. How to Incorporate HIPAA Into Your Day-to-Day Research Activities
A. What should sponsors do?
B. What should researchers do?
![Page 5: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/5.jpg)
5
I. Privacy: Past, Present, and Future
![Page 6: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/6.jpg)
6
Hippocratic Oath:What I may see or hear in the course of the treatment …
in regard to the life of men, which on no account
one must spread abroad, I will keep to myself,
holding such things shameful to be spoken about.
Hippocrates
400 B.C.
Privacy: Past
![Page 7: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/7.jpg)
7
Privacy Today
• The Common Rule• FDA Human Subject
Protection Regulations
• State Medical Confidentiality Laws
Privacy: Present
![Page 8: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/8.jpg)
8
Privacy in the Future(April 2003)
• The Common Rule• FDA Regulations• State Laws• HIPAA
Privacy: Future
![Page 9: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/9.jpg)
9
HHS Comment to HIPAA Privacy Rule:
“The intent of the Privacy Rule, among other things, is to
supplement these protections by requiring covered entities
to implement specific measures to safeguard the privacy
of individually identifiable health information.”
![Page 10: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/10.jpg)
10
Common Rule
• IRB must determine that, when appropriate, there are adequate provisions to protect the privacy of subject and maintain the confidentiality of data.
• Informed Consent must include a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.
![Page 11: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/11.jpg)
11
FDA Human Subject Regulations
• The confidentiality of records that could identify subjects should be protected, respecting privacy and confidentiality in accordance with regulatory requirements.
• IRB must determine that, where appropriate, there are adequate provisions to protect the privacy of subjects and maintain confidentiality of data.
![Page 12: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/12.jpg)
12
HIPAA Builds Upon Existing Regulations
• Express authorization for use of PHI for research purposes
• Specific requirements for valid HIPAA Authorization
• Different standards of what data is sufficiently de-identified
![Page 13: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/13.jpg)
13
II. How HIPAA Affects Research
“HIPAA 101”
• General Rule:Personal health information may notbe used or disclosed without patient authorization.
![Page 14: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/14.jpg)
14
“HIPAA 101” (cont.)
1. Who is covered?2. What information is
covered?3. How does HIPAA
define “research”?
![Page 15: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/15.jpg)
15
• “Covered entities” are defined as:(a) Health plan(b) Health care clearinghouse(c) Health care provider
• Who is a “covered entity” in the context of research and clinical studies? – Typically those in “health care provider”
category
1. Who is covered by HIPAA?
![Page 16: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/16.jpg)
16
• How to determine if you fall into the “healthcare provider” category?
• Use CMS’s “health care provider flowchart” on its web site
• This site has “decision tools” and “coveredentity charts”
http://www.cms.hhs.gov/hipaa/hipaa2/support/tools/decisionsupport/default.asp
![Page 17: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/17.jpg)
17
CMS’s “health care provider flow chart”
Does the entity furnish, bill, or receive payment
for health care in the normal course of business?
Does the entity conduct “covered
transactions”?
STOP!The entity IS NOTa covered health
care provider
Does it transmit the “covered transactions”
electronically?
No
Yes
STOP!The entity IS
a covered health care provider
Yes
Yes
![Page 18: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/18.jpg)
18
HOT TOPIC
• Do pharmaceutical companies ever qualify as “health care providers”?
• Privacy rule recognizes situations in which the answer is “yes”
![Page 19: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/19.jpg)
19
ANOTHER HOT TOPIC
• Are pharmaceutical companies who sponsor clinical trials the “business associates” of the site/investigators?
• Depends on what the company does in a particular study
• Depends on who you ask
![Page 20: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/20.jpg)
20
2. What information is covered by HIPAA?PHI, which is a subset of IIHI, which is a subset of
HIIndividually Identifiable Health Information
Health Information
Protected Health Information
![Page 21: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/21.jpg)
21
3. How does HIPAA define “research”?
• Same as Common Rule
• A “systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge”
![Page 22: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/22.jpg)
22
HIPAA’s General Rule Covering Research
Covered entities may only use or disclose PHI for researchpurposes in threecircumstances.
![Page 23: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/23.jpg)
23
Three circumstances:
1. Individual Authorization
2. Waiver of Authorization
3. De-identified data and
“limited data sets”
![Page 24: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/24.jpg)
24
1. Individual Authorization
The Rule: PHI may beused for research if individual authorization is obtained from thesubject.
![Page 25: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/25.jpg)
25
Requirements for valid HIPAA Authorization:
• 6 “core elements” PLUS
• 3 additional “statements” PLUS
• Authorization is written in plain language PLUS
• Give subject signed copy of Authorization
![Page 26: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/26.jpg)
26
The Six “Core Elements”1. Describe type of PHI to be used in the study 2. Describe the person or class of people who can
use the PHI (consider identifying pharma here)3. Describe the person or class of people to whom
the PHI may be disclosed (consider identifying pharma)
4. Describe the purpose of the use or disclosure5. State whether or not there is an expiration date6. Have the subject sign and date Authorization
![Page 27: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/27.jpg)
27
The Three Additional Mandatory “Statements”
Must tell the subject:1. About the right to revoke the authorization2. Whether treatment, payment, enrollment or
eligibility for benefits is conditioned on giving the authorization
a. Sometimes permissibleb. Sometimes not
3. About the potential for re-disclosure by authorized recipient; then no protection
![Page 28: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/28.jpg)
28
• Plain language requirement – Write the Authorization in plain English using easy-to -understand words.
• Copy to individual – Covered entity must provide the individual with a copy of the signed authorization.
![Page 29: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/29.jpg)
29
Notable changes from prior version of Rule
• New Rule eliminates distinction between research-related treatment and other forms of research.
• New Rule eliminates separate authorization requirement.
• New Rule eliminates expiration requirement.
![Page 30: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/30.jpg)
30
2. Waiver of AuthorizationThe Rule: PHI may beused for research withoutIndividual Authorization from the subject if you obtain waiver of HIPAAAuthorization from IRB or HIPAA Privacy Board.
![Page 31: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/31.jpg)
31
Waiver Criteria in Final Rule
1. Use or disclosure of PHI in research involves only “minimal risk” to individual’s privacy.
2. Research couldn’t “practicably” be conducted without waiver.
3. Research couldn’t “practicably” be conducted without access to this particular PHI.
![Page 32: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/32.jpg)
32
• “Minimum necessary” requirement applies to use of PHI in study.
• Note: “Minimum necessary” requirement does not apply when acting pursuant to an authorization.
![Page 33: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/33.jpg)
33
3. De-Identified Data and Limited Data Sets
• The Rule: PHI may be used for research without obtaining HIPAA authorization from subject if the PHI is properly de-identified.
![Page 34: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/34.jpg)
34
When does HIPAA consider data properly “de-identified”?
1. When it doesn’t identify an individual (no key to re-identify)
2. When there is no reason to believe recipient could identify individual alone or in combination with other information
![Page 35: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/35.jpg)
35
Two ways to make the de-identificationdetermination:
1. Have statistician do it, or
2. Remove all 18 specific identifiers (this creates a presumption of de-identification)
![Page 36: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/36.jpg)
36
Does a covered entity need authorization in order to remove the specific identifiers and create de-identified data?
![Page 37: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/37.jpg)
37
• Criticisms of de-identification standard – data is virtually useless!
• Leads to more waiver requests, which leads to the paradoxical effect of disclosing more PHI than if researcher had used de-identified data.
• HHS created “limited data sets” to address this paradoxical effect.
![Page 38: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/38.jpg)
38
• Limited Data Set
• Special data set that doesn’t include certain direct identifiers
• Does include zip codes, geocodesand DOB
![Page 39: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/39.jpg)
39
• Limited Data Set (cont.)
• May only be used for research, public health, and health care operations
• Must have Data Use Agreement
• Subject to “minimum necessary”
![Page 40: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/40.jpg)
40
How HIPAA Relates to FDA Regulations
HIPAA’s Privacy Rule does not override the Common Rule or FDA’s Human
Subjects Regulations.
![Page 41: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/41.jpg)
41
Other Aspects of Research Affected by HIPAA
Accounting for Research
Disclosures
![Page 42: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/42.jpg)
42
Accounting for Research Disclosures
• When required• When not required • New simplified accounting
procedures when research involves more than 50 subjects (e.g., large database research)
![Page 43: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/43.jpg)
43
Other Aspects of Research Affected by HIPAA
GrandfatherProvision for
Pre-Existing PHI
![Page 44: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/44.jpg)
44
Use of Pre-Existing PHI
• A change from prior version of rule • Now there is no distinction among
various types of legal permission for research use of PHI
![Page 45: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/45.jpg)
45
Use of Pre-Existing PHI (cont.)
• What is the significance of this change?
• Allows researchers to rely upon any type of legal permission to continue using pre-existing PHI in their possession after April 2003 (i.e., they don’t need to re-consent subjects to continue to use PHI).
![Page 46: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/46.jpg)
46
Use of Pre-Existing PHI (cont.)
• But if you never obtained any legal permission before, then you must obtain authorization (or waiver of authorization) to continue using pre-existing PHI after April 2003.
![Page 47: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/47.jpg)
47
Uses and Disclosures Regarding FDA Regulated Products and Activities
• Rule: No HIPAA Authorization is required to disclose PHI to a “person subject to the jurisdiction of the [FDA]” for public health purposes related to the quality, safety, or effectiveness of FDA regulated products or activities.
![Page 48: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/48.jpg)
48
Who is a “person subject to the jurisdiction of the [FDA]”?
• Final rule makes this clear
• Includes manufacturers of FDA regulated drugs and devices that have reporting obligations
![Page 49: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/49.jpg)
49
What are “quality, safety, or effectiveness”purposes?
• Reporting adverse events• Post-market surveillance of products• Product tracking• Recalling dangerous or defective
products
![Page 50: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/50.jpg)
50
An example of what is not a “quality,safety, or effectiveness” purpose
• Evaluating effectiveness of pharma’smarketing program
![Page 51: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/51.jpg)
51
• All disclosures under the “FDA regulated products or activities” exception are subject to the “minimum necessary” requirement.
![Page 52: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/52.jpg)
52
III. How to Incorporate HIPAA Into Your Day-To-Day Research
• What should sponsors do?
• What should other researchers do?
![Page 53: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/53.jpg)
53
What Should Sponsors Do?
• Protect PHI• Assure IRB Investigator• Education and awareness efforts• Amend clinical study documents
![Page 54: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/54.jpg)
54
Which Documents Might Need To BeAmended?
• Clinical Study Agreement Template• Informed Consent Template• SOPs:
• Informed Consent• Preparation of Case Report Forms• Corporate Privacy Policy
• Clinical Investigator Agreement Template• CRO Agreements
![Page 55: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/55.jpg)
55
What Should Researchers Do?• Epidemiology/Outcomes Research
• Assure records are de-identified or• Use limited data set with data use agreement • Also assure there is no other HIPAA violation
• Post-Marketing Surveillance • Expect refusals to supply Adverse Event information• The Rule not intended to hinder safety monitoring• Expect to be subject to "minimum necessary“
requirement
![Page 56: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/56.jpg)
56
IV. Questions
![Page 57: HIPAA’s Impact on Research and Clinical · PDF fileHIPAA’s Impact on Research and Clinical Trials Tom Merchant ... • Use CMS’s “health care provider flow chart” on its](https://reader036.vdocuments.us/reader036/viewer/2022070607/5a9f80d17f8b9a0d158ceedc/html5/thumbnails/57.jpg)
57
How to Reach Us
Leigh-Ann Patterson, Esq.Boston • 617-345-1258New York City • [email protected]
Tom Merchant, Esq. Philadelphia • [email protected]
NIXON PEABODY LLPATTORNEYS AT LAW