Preparation research Another encouragement of research is an exception to the need for authorization or waiver for the purpose of permitting a
researcher to see PHI in order to prepare a research protocol or study. If the covered entity obtains a representation from
the researcher that the PHI is needed solely to be reviewed in preparation for developing a research protocol, that the information
will be viewed on the premises of the covered entity, and that it is necessary to plan the research, the PHI may be disclosed.
Decedents In the case in which the individual whose PHI is needed is deceased, the regulations provide that the researcher need only
represent to the covered entity that the use or disclosure is only for research purposes —and is necessary for the research—and
the disclosure will be permitted by the covered entity.
There are additional permitted uses and disclosures that may tangentially affect research uses. For instance, PHI may be disclosed,
without an authorization, to a person or entity that has a responsibility to report information to the FDA. In the research
context, this rule may permit disclosure of the results of a research study to manufacturers during and following clinical
trials. Those manufacturers, in turn, may be required to report the data to the FDA.
In addition to protecting privacy through such restrictions, HIPAA also provides to patients affirmative rights that implicate
the area of research.
The first such right is the patient's right of access to PHI. HIPAA grants patients the right to see their medical records
at a convenient time and place. There is an exception to this right during a clinical trial, because it may affect the validity
of the trial if patients are able to determine, for example, whether they are in a control group or receiving the drug being
studied. In order for the suspension of this right to be effective, however, it must be stated in the authorization so that
the patient agrees to this by signing the authorization. The individual also must be informed that the right of access will
be restored at the conclusion of the clinical trial.
The individual is entitled only to records in a designated record set. The covered entity doesn't have to comb its files for
every last scrap about a patient or research subject. This is particularly helpful to researchers, who may have extracted
particular information about a multitude of patients, and collected that information within a larger database. Those records
would not be available to an individual patient who simply requests access to his file.
Under HIPAA, the individual is entitled to an accounting of disclosures of PHI that the covered entity makes. Disclosure,
in this case, means communicating PHI outside the covered entity, so it does not refer to anything that occurs, for example,
between the covered entity and members of its workforce. The requirement to maintain records sufficient to permit a covered
entity to respond to a request for an accounting means that some pharmaceutical company sponsors' information, including the
number of times study data was provided to the manufacturer, will be made available to the patient.
Certain disclosures need not be accounted for. Most important for research purposes is the accounting exception for any disclosure
that the patient has authorized. Also, disclosures of PHI as part of a limited data set (PHI with the most obvious identifiers
eliminated), under a data use agreement, do not need to be in the accounting. This is another way in which the limited data
set is such a useful device for research.
An accounting must include information about what PHI was disclosed, to whom it was disclosed, the reason, and so on. If multiple
disclosures have been made to the same person or entity, the disclosure information can be grouped in a reasonable way. Where
disclosures concern 50 or more individuals, which may happen in the course of a large clinical trial, the accounting request
may be satisfied by providing the information about the study more generally (providing basic information that describes the
protocol, the researcher's name and contact information, and the time period of the study). In this way, a standard response
can be available for any study participants who request an accounting.
Congress and regulatory agencies are attempting to balance the rights of patients to control the use of their identifiable
health information with the need for medical progress to continue through human subject research. Because of the accommodation
to research in HIPAA, there are many routes by which a desired research goal can be accomplished—without unduly jeopardizing
the patient's privacy.
Philip H. Lebowitz is a partner in the Health Care Practice of law firm Duane Morris. He can be reached at firstname.lastname@example.org