Protecting Privacy and Encouraging Research - Pharmaceutical Executive


Protecting Privacy and Encouraging Research
Are these two goals conflicting or complementary?

Pharmaceutical Executive

For epidemiological or laboratory research from databases, repositories of tissue samples, or other clinical data, critical threshold issues are posed for the entity that holds that information. Under what terms did they receive permission to compile the data? Can they simply provide access to researchers upon request? Generally, the initial authorization to collect the data will determine the extent to which it can be disclosed.

When Can PHI Be Used? There are three circumstances in which PHI can be used for research:

  • when the information has been de-identified (so it's no longer PHI)
  • with the patient's written permission (authorization)
  • under certain other limited exceptions that encourage research.

De-identification De-identification is a helpful concept, but de-identifying is difficult, because HIPAA requires the elimination of 18 separate elements that could be used to identify the individual—including name, address, social security number, birth date, admission and discharge dates, and zip code.

If a study requires only a patient's age range (under 89), sex, and general area of the country, de-identification may be an option because this kind of general demographic information is not considered PHI. Thus, the covered entity could disclose it to an unaffiliated researcher or sponsor without any other HIPAA requirements or obligations. If the covered entity has developed a method of coding additional protected information about the individual from whom the de-identified information was obtained, however, the code itself cannot be disclosed.

Patient authorization Authorizations are by far the most common method of facilitating access to PHI. Authorizations are specific permissions by the individual under HIPAA for use or disclosure of PHI for a particular purpose. The authorization for research must pertain to a specific study, or to the creation of a research repository or database. It must be in writing and signed by the individual, and the actual uses and disclosures must be described to the extent possible.

At a minimum, an authorization must express the following: "Because you are participating in a research study of a drug being developed by Company A, information about you and your treatment with this drug will be provided to Company A. By signing this authorization, you agree to the disclosure of your PHI to Company A."

There are three different types of consent that a patient must give as part of the research process:

  • consent to treatment
  • consent to participation in research, which has many required elements under federal law
  • HIPAA authorization in which the patient consents to the use and disclosure to others of healthcare information that could be used to identify him or her.

These three different consents may be combined in a single document or treated separately. As a practical matter, it generally is easier for a patient to be confronted with one document rather than three.

The original privacy regulations required that the authorization have a specific expiration date. But the revised regulations permit the use of the word "none" or "end of research study" to satisfy that element of the authorization. This is particularly applicable to the creation of databases and repositories.

There are other required statements that must appear in authorizations. For example, authorizations must contain a statement of the individual's right to revoke the authorization, with an explanation of how that can be done. Fortunately, information already used or disclosed does not have to be retracted when an authorization is revoked; any information on which the researcher already is relying for completion of the research, or that already has been provided to the research sponsor, can continue to be used. Going forward, the revocation only will affect disclosure of information that has not become integral to the research project.

There must be a statement about whether participation in the research study is conditioned on the signing of the authorization, which is often the case. Permitting this use of the authorization encourages research. By contrast, medical treatment for a patient not participating in a research study cannot be conditioned upon the signing of an authorization for any other purpose.


blog comments powered by Disqus

Source: Pharmaceutical Executive,
Click here