Protecting Privacy and Encouraging Research - Pharmaceutical Executive


Protecting Privacy and Encouraging Research
Are these two goals conflicting or complementary?

Pharmaceutical Executive

Preparation research Another encouragement of research is an exception to the need for authorization or waiver for the purpose of permitting a researcher to see PHI in order to prepare a research protocol or study. If the covered entity obtains a representation from the researcher that the PHI is needed solely to be reviewed in preparation for developing a research protocol, that the information will be viewed on the premises of the covered entity, and that it is necessary to plan the research, the PHI may be disclosed.

Decedents In the case in which the individual whose PHI is needed is deceased, the regulations provide that the researcher need only represent to the covered entity that the use or disclosure is only for research purposes —and is necessary for the research—and the disclosure will be permitted by the covered entity.

There are additional permitted uses and disclosures that may tangentially affect research uses. For instance, PHI may be disclosed, without an authorization, to a person or entity that has a responsibility to report information to the FDA. In the research context, this rule may permit disclosure of the results of a research study to manufacturers during and following clinical trials. Those manufacturers, in turn, may be required to report the data to the FDA.

Patients' Rights In addition to protecting privacy through such restrictions, HIPAA also provides to patients affirmative rights that implicate the area of research.

The first such right is the patient's right of access to PHI. HIPAA grants patients the right to see their medical records at a convenient time and place. There is an exception to this right during a clinical trial, because it may affect the validity of the trial if patients are able to determine, for example, whether they are in a control group or receiving the drug being studied. In order for the suspension of this right to be effective, however, it must be stated in the authorization so that the patient agrees to this by signing the authorization. The individual also must be informed that the right of access will be restored at the conclusion of the clinical trial.

The individual is entitled only to records in a designated record set. The covered entity doesn't have to comb its files for every last scrap about a patient or research subject. This is particularly helpful to researchers, who may have extracted particular information about a multitude of patients, and collected that information within a larger database. Those records would not be available to an individual patient who simply requests access to his file.

Under HIPAA, the individual is entitled to an accounting of disclosures of PHI that the covered entity makes. Disclosure, in this case, means communicating PHI outside the covered entity, so it does not refer to anything that occurs, for example, between the covered entity and members of its workforce. The requirement to maintain records sufficient to permit a covered entity to respond to a request for an accounting means that some pharmaceutical company sponsors' information, including the number of times study data was provided to the manufacturer, will be made available to the patient.

Certain disclosures need not be accounted for. Most important for research purposes is the accounting exception for any disclosure that the patient has authorized. Also, disclosures of PHI as part of a limited data set (PHI with the most obvious identifiers eliminated), under a data use agreement, do not need to be in the accounting. This is another way in which the limited data set is such a useful device for research.

An accounting must include information about what PHI was disclosed, to whom it was disclosed, the reason, and so on. If multiple disclosures have been made to the same person or entity, the disclosure information can be grouped in a reasonable way. Where disclosures concern 50 or more individuals, which may happen in the course of a large clinical trial, the accounting request may be satisfied by providing the information about the study more generally (providing basic information that describes the protocol, the researcher's name and contact information, and the time period of the study). In this way, a standard response can be available for any study participants who request an accounting.

Congress and regulatory agencies are attempting to balance the rights of patients to control the use of their identifiable health information with the need for medical progress to continue through human subject research. Because of the accommodation to research in HIPAA, there are many routes by which a desired research goal can be accomplished—without unduly jeopardizing the patient's privacy.

Philip H. Lebowitz is a partner in the Health Care Practice of law firm Duane Morris. He can be reached at


blog comments powered by Disqus

Source: Pharmaceutical Executive,
Click here