501 Vulcano, Rosati [Read-Only] · 5/19/2011 1 Tissue Issues Kristen Rosati, JD Coppersmith Schermer & Brockelman PLC David Vulcano, David Vulcano, LCSW, MBA, CIP, RAC LCSW, MBA,

5/19/2011

1

Tissue Issues

Kristen Rosati, JDKristen Rosati, JDKristen Rosati, JDKristen Rosati, JDCoppersmith Schermer & Brockelman PLC

David Vulcano, David Vulcano, David Vulcano, David Vulcano, LCSW, MBA, CIP, RAC LCSW, MBA, CIP, RAC LCSW, MBA, CIP, RAC LCSW, MBA, CIP, RAC AVP & Responsible Executive, Clinical Research

Clinical Services Group | HCA

HCCA Research Compliance ConferenceJune 14, 2011

Session Overview

Anticipated changes to the HIPAA Privacy Rule to implement the HITECH Act and the Genetic Information Nondiscrimination Act

NCI Best Practices for Biospecimen Resources

Ethical Issues And Public Opinion of Whats Legal

Reference slides:

IRB review and human subject protection

HIPAA compliance

2

5/19/2011

2

Office for Civil Rights HIPAA Compliance

Proposed amendments to the HIPAA rules to implement the HITECH Act*: 75 Fed. Reg. at 40868 (July 14, 2010)

Comments closed September 13, 2010

Final regulations anticipated during the first half of 2011

OCR will not enforce the new regulations until 180 days after the effective date of the final regulations

*American Recovery and Reinvestment Act of 2009 (ARRA) --Division A, Title XIII and Division B, Title IV: Health Information Technology for Economic and Clinical Health Act (HITECH Act)

4

Authorization for future research The OCR sought comment on whether and how to change its interpretation that an authorization may not seek permission for use in unspecified future research

Options considering:

Permitting, if authorization adequately describes future research

Permitting, with certain required elements or statements

Permitting, with limits on sensitive research areas, such as genetic or mental health research

Working with OHRP on consistency with Common Rule

Research Authorizations

5/19/2011

3

5

Compound authorizations Proposed rule would permit compound authorizations, which combine authorization for a clinical trial and authorization to contribute PHI to a research repository, as long as the form provides the individual with an opportunity opt-in to the research repository

[Proposed 45 CFR 164.508(b)]

Potential problem:

Opt-in will reduce participation in research repositories

Research Authorizations

6

Current rule: CE may receive payment for a disclosure of PHI where that disclosure is permitted by the regulations (such as for research)

HITECH Act prohibits indirect or direct receipt of remuneration in exchange for a disclosure of PHI without the individuals authorization (with exceptions) Proposed rule would prohibit indirect or direct remuneration in exchange for a disclosure of PHI without authorization (with exceptions on the next slide)

Remuneration is not defined-- will it include non-financial remuneration?

[HITECH Act 13405(d); Proposed 45 CFR 164.508]

No Sale of PHI

5/19/2011

4

7

For public health purposes

For research, where the only remuneration received by the covered entity is a reasonable cost-based fee to cover the cost to prepare and transmit the PHI

For treatment and payment

For the sale, transfer, merger or consolidation of the covered entity and related due diligence

To or by a business associate to perform activities for the covered entity, where the only remuneration provided is by the covered entity to the business associate for the performance of such activities

To an individual for access or accounting

Where required by law to disclose PHI

Where the only remuneration received is a reasonable cost-based fee to cover the cost to prepare and transmit the PHI, or a fee is otherwise expressly permitted by another law

[Proposed 45 CFR 164.508]

No Sale of PHI-- Exceptions

8

Rule does not apply to disclosures of PHI for research under 164.512(i) (the general rule on research disclosures) or 164.514(e) (disclosures of a Limited Data Set for research), where the only remuneration received by the covered entity is a reasonable cost-based fee to cover the cost to prepare and transmit the [PHI] for such purposes.

What is a reasonable cost-based fee? Comments urged OCR to allow organizations to recoup investment and other indirect costs in the fees they charge for PHI

Not permitting recoupment of a wide range of costs may be an unconstitutional taking of property

Who will determine the appropriate amount and how will that be done?

No Sale of PHI Research Exception

5/19/2011

5

9

Rule did not create an exception for:

Disclosure of research results

Disclosure of Limited Data Sets

LDS expressly added to research and public health exceptions

Quality assurance/ performance improvement activities

Section 13405(d)(2)(G) of the HITECH Act provides authority to the OCR to make additional exceptions for disclosures of PHI that the OCR judges to be similarly necessary and appropriate as the other enumerated statutory exemptions to the sale of PHI


10

No grandfather provision

Past grandfather provision permitted use of PHI to continue if the informed consent/waiver obtained before HIPAA was valid under pre-HIPAA law


5/19/2011

6

11

BAAs required if have third party de-identify PHI or create Limited Data Set

BAAs not required to disclose PHI for research on behalf of the covered entity, because research is not a covered function under HIPAA

The OCR has clarified informally that this applies beyond disclosure to the researcher, and also encompasses research management and other services

Business Associate Agreements in Research

12

Add organizations that provide patient safety activities listed at 42 CFR 3.20 (to implement the Patient Safety and Quality Improvement Act)

Add Health Information Organizations, e-prescribing gateways, or other persons that provide data transmission or other persons that provide data transmission or other persons that provide data transmission or other persons that provide data transmission services, services, services, services, which transmit protected health information (PHI) to a covered entity and require access to that PHI on a routine basis

Add entities that offer a personal health record to individuals on behalf of a covered entity

[HITECH Act 13408; proposed 45 CFR 160.103]

Changes to the Definition of Business Associate

5/19/2011

7

13

Proposed rule: Would protect for only 50 years after death [Proposed 45 CFR 164.502(f)]

Would permit to permit CEs to disclose a decedents PHI to family members and others who were involved in the care or payment for care prior to death, unless inconsistent with an expressed preference of the decedent

This would be a permitted (not required) disclosure, and would not change the authority of the decedents personal representative to act on behalf of the decedent

[Proposed 45 CFR 164.510(b)]

Decedents PHI

14

HITECH Act requires HHS to issue guidance on methods for de-identification of protected health information

OCR March 2010 workshop on de-identification approaches, best practices for implementation and management of the current de-identification standard and potential changes to address policy concerns, see http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/De-identification/deidentificationworkshop2010.html

Future Changes to De-identification?

5/19/2011

8

15

Genetic Information Is Health Information

Section 105 of the Genetic Information Nondiscrimination Act requires HHS to revise the HIPAA Privacy Rule to clarify that genetic information is health information

The Office for Civil Rights (OCR) issued a proposed rule to implement GINA, at 74 Fed. Reg. 51698 (Oct. 7, 2009): Health information includes genetic information Genetic information is defined broadly as including genetic testing of an individual or the individuals family members, fetuses and embryos held for assisted reproductive technology, information about the manifestation of a disease or disorder in family members (i.e., family medical history), and any request for or receipt of genetic services (genetic testing, counseling, education or participation in genetic research)

16

But Is Genetic Information

Protected Health Information?

The OCR has concluded that genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse.

5/19/2011

9

17

Is Genetic Information Individually Identifiable?

Definition: Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and:

(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

(i) That identifies the individual; or (ii)With respect to which there is a reasonable basis to believe the information can be used to identify the individual

18

Is Genetic Information Individually Identifiable?

Under 45 CFR 164.514, a covered entity may determine that health information is not individually identifiable health information only if that information is de-identified by:

(1) Obtaining a statistical certification that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; or

(2) Removing all the identifiers (including biometric identifiers)

5/19/2011

10

19

Is Genetic Information a HIPAA Identifier?

Name; Geographic information below state level; Dates related to a patient; Age if over 89 (unless aggregated into a single category of

age 90 and older);

Various number s related to a patient Full-face photographs and any comparable images; Biometric identifiers, such as fingerprints Any other unique identifying number, characteristic, or code.

The OCR has not provided guidance on whether genetic information is a biometric identifier or a unique identifying characteristic

20

Practical Guidance

Provide enough information in your protocol to support the IRBs conclusion that the genetic information sought or developed through a study is not identifiable (and that there is not a reasonable basis to believe the information can be used to identify an individual)

-or-

Obtain a statistical certification that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information

5/19/2011

11

NCI Best Practices for Biospecimen Resources

Background

First issued in 2007 and online at http://biospecimens.cancer.gov/bestpractices/

Formal draft revisions at http://biospecimens.cancer.gov/practices/2010bp.asp

Comments closed September 21, 2010

Revisions include:

Revised informed consent and privacy recommendations

Using Its Legal to Justify The Ethical

Its legal.

Think of the good it will produce.

The majority of people are for this kind of research.

Lives saved outweigh the lives lost.

Legality of an activity does not necessarily

make it is ethical.

5/19/2011

12

Legal vs. Ethical Issue?

Not Research With Human

Subjects Research With Human Subjects

Research

Consent

As Ethical

Issue

Research

Consent

As Ethical

and Legal

Issue

Privacy as

Legal and

Ethical

Issue

Privacy as

Legal and

Ethical

Issue

Exempt

(OHRP)

Not

Exempt

Research

Consent

As Ethical

Issue

Privacy as

Legal and

Ethical

Issue

Ethical Questions

Is it appropriate to use data/tissue already gathered but from means considered unethical? Does using the data/tissue make one an accessory to the unethical behavior?

What criteria do you use when choosing between one good and another good?

5/19/2011

13

Even Following The Legal Is Difficult

41% studies using tissue collected for treatment purposes did not get IRB approval for the study. Not necessarily exempt as only 5% of these used non-identifying samples

When Consent was not obtained 77% non-IRB approved studies used identified samples

33% IRB approved studies used identified samples

Unclear if Waiver was obtained

By Merz JF, Leonard DG, Miller ER, Science (New York, N.Y.) [Science], ISSN: 0036-8075, 1999 Mar 12; Vol. 283 (5408), pp. 1647-8; PMID: 10189317

Three Ways That Encourage Unethical Deeds

Direct Encouragement Through Agency Wrongdoing is acknowledged but getting someone else to do it for you.

Direct Encouragement Through Acceptance Of The Benefit Someone else (independently) does it and wrongdoing is ignored thus deed is repeated.

Indirect Encouragement Through The Legitimization Of The Practice Someone else did it. Wrongdoing is acknowledged but using the results sends message that will be ok.

Green RM; Bioethics, 2002 Nov; 16 (6): 544-56 (journal article) ISSN: 0269-9702

PMID: 12474822 CINAHL AN: 2002173514

5/19/2011

14

The Human Embryonic Stem Cell (hESC)Research

Recent History

1996: Dickey-Wicker Amendment: prohibits federal funding of research in which human embryos are destroyed.

2001: Presidential decree limited funding to only existing embryonic stem cell lines as of August 9, 2001 (not adult stem cells).

2007: Executive Order 13435: Expanding Approved Stem Cell Lines in Ethically Responsible Ways

Required DHHS funding to find alternate methods of derivation of stem cell research other than destruction of embryos

Focus on perfecting conversion of skin cells into induced pluripotent stem cells (iPSCs) as alternative

hESC Research Saga (Continued)

2009: Executive Order 13505 Removing Barriers to Responsible Scientific Research Involving Human Stem Cells Revokes Bushs 2001 limitations and EO 13435

[DHHS] may support and conduct responsible, scientifically worthy human stem cell research, including human embryonic stem cell research, to the extent permitted by law.

2009-2010 : Lawsuits Challenging EO13505 US Gvt. Sued by various parties based on presidential executive order cannot override law (Dickey-Wicker)

Essentially the court determined institutes using U.S funds to purchase ESCs from destroyed embryos is undifferentiated from using U.S. funds to destroy embryos, thus illegal.

5/19/2011

15

2 Lawsuits Challenging E.O.13505

Mary Scott Doe et.al. Vs. Obama

Lower Court Favored Executive Order

2009

James L. Sherley et.al. vs. Kathleen Sibelius in her official capacity as Secretary of the Department of Health and Human Services, et al.,

Lower Court Favored Executive Order

2010

Appeals Court Overturned Lower Court,

Subsequent hearing favored plaintiff, imposing a preliminary injunction halting HHS funding

HHS successfully argued an administrative stay to be able to continue funding studies while appealing.

2011

Preliminary injunction lifted so funding can continue while in appeals.

Still In Appeals

Mary Scott Doe et.al. Vs. Obama

Lower Court Favored Executive

Order

Appeals Court Upheld Lower Court Finding.

No Injury.

To claim future injury, requires it to be

certainly impending.

hESC Research Saga (Continued)

October 2010: Harvard adds themselves to group of agencies identifying a process to create iPSCs from skin.

October 2010: Stem Cell Therapeutic and Research Reauthorization Act of 2010 Passed by Congress, Signed into law October 8, 2010

Extended Stem Cell Therapeutic and Research Act of 2005 Funding of stem cell acquisition and research from cord blood donation

No addressing of Dickey-Wicker Amendments

5/19/2011

16

3 Events in 2010 Highlighting Ethics of Secondary Use

Without Consent/Assent in United States

Texas Newborn Bloodspot Settlement

Havasupai Tribe Settlement

Wide Acceptance of The Immortal Life of Henrietta LacksBook

Event: The Texas Newborn BloodSpot Case

5/19/2011

17

Very Brief Summary of Events

Texas, like many states, requires screening for 27 birth time-sensitive birth disorders upon birth.

By law the blood could be taken without consent by hospitals, birthing centers and midwives. Samples were destroyed after testing.

Beginning 2002, State of Texas began keeping bloodspots from newborns birth defect screening (stored at Texas A&M). Did not inform parents of retention.

Samples used for quality assurance and research

The Controversy

"You have to give permission for them to give your kid formula in the hospital. I don't understand why you don't have to give permission for the state to keep your kid's DNA.

Using the baby DNA spots "to barter with for-profit corporations for lab supplies, test kits and maintenance contracts."

In 2006 and 2007, bioMerieux provided HIV rapid testing kits to DSHS in exchange for de-identified bloodspots used to perform QA for those test kits.

In October 2008, DSHS provided 600 de-identified bloodspots (@$4 per spot) to Avioq for HIV test kit analytical validation for submission to the FDA.

The IRB board appointed to oversee research on the stored bloodspots consists almost entirely of State employees.This is not a true independent professional review board.

5/19/2011

18

Results of Settlement

State to destroy all specimens from 2002 May 27, 2009 (5.3 Million blood spot cards filling 2.5 semi-trucks)

Opt-out form (Directive To Destroy) created for future use.

De-Identified is no longer cause for IRB exemption.

Disclose how samples were used. Later found out that they sent 800 (deidentified) samples to Armed Forces lab to build mitochondrial DNA (mtDNA) registry.

Directive To DestroyAfter testing, blood spot cards are safely stored because they still

have important public health uses.

The main uses are: 1) quality

assurance/quality control, such as

making sure that testing equipment

continues to produce accurate

newborn screening test results for

Texas babies; and 2) medical

research Specific information that

could identify your child and

connect him/her to a particular

blood spot card is not allowed

outside of DSHS without permission

from the childs parent, managing

conservator, or legal guardian unless

otherwise provided by law.If the newborn screening blood spot

card is destroyed, the blood sample

will not be available for any future

needs you may have for the sample.

5/19/2011

19

Did It Make A Difference?

Implemented August 1, 2009

As of 5/10/2010, they reported receipt of 21,210 requests to destroy Approximately 5% of births

In line with U. Michigan 2008 Study on Use of Samples With/Without Permission in a hypothetical study

How willing are you to have your childs blood sample (from their newborn

screening) used for future research studies (WITH/WITHOUT) your permission?

(N=3935)

0%

10%

20%

30%

40%

50%

60%

Very Willing Somewhat Willing Somewhat

Unwilling

Very Unwilling

WITH Permission WITHOUT Permission

University of Michigan Health System, 2008

5/19/2011

20

Requestor Title of Study

Baylor College of Medicine Population incidence of mitochondrial mutations associated with aminoglycoside-induced deafness

University of California at Los Angeles, Department of Pediatrics Development of rapid and efficient PCR approach to detect common alpha-thalassemia deletions in

Southeast Asians and Filipinos in newborn screening specimens

University of California at Los Angeles, Department of Pediatrics Development of alternative mutation detection technologies for hemoglobinopathies

University of Texas MD Anderson Cancer Center Role of genetic polymorphisms of glutathione S-transferases and related genes in the pediatric

population

University of California at Los Angeles, Department of Pediatrics Genetic variation in Glycerol Kinase and adjacent genes

Centers for Disease Control and Prevention Using newborn screening dried blood spots to assess the contribution of selected congenital infections

(Cytomegalovirus (CMV), Lymphocytic Choriomeningitis Virus (LCMV) and Toxoplasmosis gondii) to the

etiology of hydrocephalus

PerkinElmer Life and Analytic Sciences Preliminary development of immunoassay to identify hemoglobin variants

Armed Forces Institute of Pathology Precursor study to Enhancing the size, sampling, and quality of forensic mtDNA databases

Armed Forces Institute of Pathology Enhancing the size, sampling, and quality of forensic mtDNA databases

Centers for Disease Control and Prevention Technical evaluation of cytokine measurements in dried blood spots

Centers for Disease Control and Prevention Technical evaluation of cytokine measurements in dried blood spots (follow-up)

Centers for Disease Control and Prevention Technical evaluation of cytokine measurements in dried blood spots (2nd follow-up)

National Institutes of Health; University of California at San Francisco Investigation of inherited immune disorders

University of Texas Health Science Center at Houston Pilot study for association study of genetic markers and Idiopathic Talipes Equinovarus (club foot)

University of Texas Health Science Center at Houston Association study of genetic study markers and Idiopathic Talipes Equinovarus (ITEV)

University of Minnesota Neonatal blood spot bank for childhood cancer studies

Centers for Disease Control and Prevention Development of reference ranges for use in screening newborns for X-linked adrenoleukodystrophy

Baylor College of Medicine Precursor study to identify genetic markers for selected cardiovascular birth defects

Texas A&M University Feasibility of using stored Texas newborn screening dried blood spots for childhood cancer

epidemiological research

Centers for Disease Control and Prevention Development of a method to determine concentrations of polyfluoroalkyl compounds (PFC) in dried blood

spots

University of California at Los Angeles, Department of Pediatrics Development of a newborn screening test for severe combined immunodeficiency using ELISA and dried

blood spots

University of Texas Health Science Center at Houston Candidate gene testing in nonsyndromic cleft lip and palate

Department of State Health Services Assessing the role of prenatal lead exposure on infant blood lead levels

PerkinElmer Life and Analytical Sciences Development of a biotinidase screening assay

Deafness

Inherited Immune

Disorders

Club Foot

Childhood Cancer

Cleft Lip/Palate

Prenatal lead

exposure

Cardiovascular

Defects

Event: Havasupai Tribe Settlement

5/19/2011

21

Summary of Issue

200 of 650 member tribe consented to give blood for research on Type 2 Diabetes, prevalent in their tribe.

Consents said could be used to study the causes of behavioral/medical disorders.

Years later, discovered blood was used for items inconsistent with tribal beliefs/values such as: Schizophrenia

Genealogy of Tribe (Crossed Bering Straight vs. indigenous)

Effects of Inbreeding

Public Outcry

People got degrees and grants, and they never asked our permission.

The research bore no resemblance to the diabetes research I pictured when I gave my blood years ago.

5/19/2011

22

Settlement with Arizona State University

ASU agreed to pay $700,000 to 41 of the tribes members

Return the 151 remaining blood samples Were buried in accordance with tribal customs.

Provide other forms of assistance to Havasupai Assisting in building a clinic and high school

Scholarship eligibility to tribe members

Event: Publication of The Immortal Life of

Henrietta Lacks

5/19/2011

23

Major Contributions Timeline of HeLa Cells

From: Henrietta Everlasting: 1950s Cells Still Alive, Helping Science. Wired Magazine. January 25, 2010.

The Controversy

. . . if our mother cells done so much for medicine, how come her family cant afford to see no doctors? Dont make no sense. People got rich off my mother without us even knowin about them takin her cells, now we dont get a dime.

Lacks's family today are unable to afford the healthcare treatments their mother's cells helped to make possible.

She doesnt even have a tombstone, just an indentation in the ground.

5/19/2011

24

Minor Recognition Preceding Book

Hometown Celebrates Henrietta Lacks Day (Feb 1st)

1996: Atlanta Mayor proclaims Oct 11 as Henrietta Lacks Day

1997: Congressional resolution in her honor (filed by her hometown congressman)

1998: BBC Documentary 1998, Modern Times: The Way of All Flesh

Current Public Response

Critical acclaim of book Wellcome Trust Book Prize, 2010

Salon Book Award, 2010

The New York Times 100 Notable Books of the Year

Publishers Weekly Top 10 Books of 2010

The Chicago Tribune Heartland Prize

And more

Popular acceptance of book Paperback currently #18 on Amazon Top 100, Hardcover spent Almost 1 year in Top 100.

Currently #2 in NY Times (Paperback Non-Fiction), and #5 (Combined Print & E-Book non-Fiction)

#53 in USA Todays Top 150 (all categories), > 40 weeks in Top 150 All Books

Oprah producing HBO movie

Growing funds in newly created Henrietta Lacks Foundation benefitting Lacks family, initial awards in 2010

Full tuition and books for five descendants of Henrietta Lacks starting fall semester 2010

Health care and emergency needs grants for two members of her immediate family

5/19/2011

25

Receives Tombstone Almost 60 Years Post-Burial

Henrietta Lacks, August 01, 1920-October 04, 1951. In loving memory of a phenomenal woman, wife and mother who touched the lives of many. Here lies Henrietta Lacks (HeLa). Her immortal cells will continue to help

mankind forever. Eternal Love and Admiration, From Your Family

Summary Of Ethics Portion

Know The Legal Maze

Know That Navigating The Legal Maze Is Not Your Endpoint To Conduct Research

Principles of Belmont Report Apply To Non-Interventional Research As Well Respect For Persons

Beneficence

Justice

50

5/19/2011

26

REFERENCE SLIDES

51

52

IRB Review and Human Subject Protection

Applying the Common Rule Evaluating when IRB review is required Approving research protocols involving biospecimens Creating informed informed consent documents Communicating research findings to participants

5/19/2011

27

53

When Does the Common Rule Apply?

The Common Rule applies to federally-funded research and to research if an institution voluntarily extends the scope of its Federalwide Assurance

4. Applicability(a) This Institution assures that whenever it engages in human subjects research conducted or supported by any federal department or agency that has adopted the Common Rule.

(b) Optional: This Institution elects to apply the following to all of its human subjects research regardless of the source of support, except for research that is covered by a separate assurance:[ ] The Common Rule (see section 3 of the Terms of the FWA for Institutions Within the United States for a list of departments and agencies that have adopted the Common Rule and the applicable citations to the Code of Federal Regulations)[ ] The Common Rule and subparts B, C, and D of the HHS regulations at 45 CFR part 46

54

When Is IRB Approval Required?

45 C.F.R. 46.102 requires IRB approval for non-exempt human subject research

Research: a systematic investigationdesigned to develop or contribute to generalizable knowledge

Human subject: a living individual about whom an investigator conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information

Intervention: physical procedures to gather data or manipulation of environment

Interaction: communication or interpersonal contact

5/19/2011

28

55

When Is IRB Approval Required?

Private information: information provided for specific purposes by an individual, which the individual can reasonably expect will not be made public

Identifiable: an individuals identity is or may be readily ascertained by the investigator

56

Compare with HIPAA De-Identification

Two ways to de-identify protected health information under HIPAA:

Strip all HIPAA identifiers for safe harbor protection

Have a qualified determine that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information

5/19/2011

29

57

HIPAA Identifiers

Name; Street address, city, county, precinct, or zip code (unless only the first three digits of

the zip code are used and the area has more than 20,000 residents);

The month and day of dates directly related to an individual, such as birth date, admission date, discharge date, dates of service, or date of death;

Age if over 89 (unless aggregated into a single category of age 90 and older); Telephone numbers; Fax numbers; Email addresses; Social security numbers; Medical record numbers; Health plan beneficiary numbers; Account numbers; Certificate/license numbers; Vehicle identifiers, serial numbers, and license plate numbers; Device identifiers and serial numbers; Web Universal Resource Locators (URLs) and Internet Protocol (IP) addresses; Biometric identifiers, such as fingerprints Full-face photographs and any comparable images; or Any other unique identifying number, characteristic, or code.

58

And if specimen is for an FDA-regulated study.

FDA prohibits use of de-identified specimens, except if: In-vitro diagnostic device study meets IDE exemption criteria The study uses leftover specimens (i) originally collected for

clinical purposes, (ii) originally collected for unrelated research, or (iii) from a repository;

Specimens not individually identifiable to investigator, sponsor or others associated with study;

Individuals caring for patients are different from and do not share information with those associated with study;

Supplier of specimens (e.g., repository) has policy that prohibits release of identifiers; and

Protocol is reviewed by an IRB

FDA uses enforcement discretion not to require informed consent for these studies

5/19/2011

30

59

When Is Coded Information Not Identifiable?

OHRP Guidance on Research Involving Coded Private Information or Biological Specimens (http://www.hhs.gov/ohrp/humansubjects/guidance/cdebiol.htm)

Coded means that identifiable private information is replaced with a number, symbols, etc., and a key to decipher the code exists to allow linkage

Coded information is not identifiable if it cannot be linked to specific information by the investigators (anyone involved in conducted the research) either directly or indirectly through coding systems. Specifically:

60

When Is Coded Information Not Identifiable?

Coded information is not identifiable if:(a) the investigators and the holder of the key enter into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased (note that the HHS regulations do not require the IRB to review and approve this agreement);

(b) there are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigators under any circumstances, until the individuals are deceased; or

(c) there are other legal requirements prohibiting the release of the key to the investigators, until the individuals are deceased.

5/19/2011

31

61

HIPAA Has Different Rules for Coding

Coded information is not protected health information if the code is not derived from or related to patient identifiers (e.g., patient initials, mixed SSN or medical record number) and the code cant be translated to identify the individual

Disclosure of the key = disclosure of PHI

62

When Is Biospecimen Research Exempt?

45 CFR 46.101(b)(4):

collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens; and

if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects

Codes dont count!

5/19/2011

32

63

Is Expedited Review Possible?

Expedited review is permitted if the research: Involves no more than minimal risk; and

Involves research in permitted categories (see http://www.hhs.gov/ohrp/humansubjects/guidance/expedited98.htm), including:

Certain blood collection

Collection of biospecimens or data by noninvasive means

Research involving biospecimens or data that have been collected or will be collected for non-research purposes

64

Who Must Get IRB Approval?

Is the Institution Engaged in Research?

OHRP Guidance on Engagement of Institutions in Human Subject Research (2008) (http://www.hhs.gov/ohrp/policy/engage08.html )

Institution is engaged in human subjects research if its employees or agents:

Perform invasive or noninvasive procedures for the research

Interact with participants for the research, such as interviewing

Obtain informed consent

5/19/2011

33

65



Institution is engaged in human subjects research if its employees or agents:

Obtain for research purposes identifiable private information or identifiable biological specimens from any source (even if there is no interaction with the participants)

If the specimens are coded, they are identifiable only if the investigators have the key

66



The institution is not engaged in human subjects research if its employees or agents:

Collect specimens from patients as a service to the investigators, if they will not receive publication privileges, the service typically is performed for non-research purposes, and they do not administer any study intervention being tested

Release identifiable private information or identifiable specimens to investigators at another institution

Obtain coded information or specimens, but have no access to the key

Watch HIPAA compliance!Watch HIPAA compliance!Watch HIPAA compliance!Watch HIPAA compliance!

5/19/2011

34

67

Creating Informed Informed Consent Documents

Regulations (45 C.F.R. 46.116(a)(1)) require: Explanation of the purposes of the research

Description of the procedures

Description of any reasonably foreseeable risks

OHRP Guidance on Research Use of Stored Data or Tissues (1997) (http://www.hhs.gov/ohrp/policy/reposit.html) requires clear description of: Operation of repository;

Specific types of research to be conducted;

Conditions under which data and specimens will be released to recipient-investigators; and

Procedures for protecting privacy of subjects and confidentiality of data

Operation of the Repository

and Types of Research

Who holds the repository? How has access to the samples and data for repository management?

How long will samples or data be retained? What types of research might the samples be used for?

Any research?

Research about participants disease only?

Genetic research?

Tiered consents do they work, and what kind of infrastructure must an institution have in place to ensure that subjects wishes are respected?

68

5/19/2011

35

69

What Specimens and Data Will

Be Released to Investigators?

Will identifiers be on samples?

Will samples be labeled with a code, and if so, who will hold the key?

Are the reasonably foreseeable risks to participating discussed?

NCI suggested language: The greatest risk to you is the release of information from your health records. We will do our best to make sure that your personal information will be kept private. The chance that this information will be given to someone else is very small.

Alternative language: The [entity] has extensive precautions in place to prevent any unauthorized disclosure of personally identifiable information. However, if there is an inadvertent or accidental disclosure of clinical data or data obtained from the study about you, this could have adverse effects on your insurability, employment or social standing. [If the study involves genetic information] It could also involve DNA typing, which may support paternity determinations and affect your family relationships. There may be unforeseeable risks that are not known at this time. However, you will be informed of any new risk as they become known.

5/19/2011

36

The Genetic Information Nondiscrimination Act

Prohibits discrimination based on genetic information in health insurance and employment

Doesnt cover life, disability or long term care insurance

Doesnt cover employers under 15 employees

Genetic information includes:

Genetic testing of individual or family member

Family history

Individual or family member request for genetic services (testing, counseling or education), including in clinical research

OHRP Suggested GINA Language

A new Federal law, called the Genetic Information Nondiscrimination Act (GINA), generally makes it illegal for health insurance companies, group health plans, and most employers to discriminate against you based on your genetic information. This law generally will protect you in the following ways: Health insurance companies and group health plans may not request your genetic information that we get from this research.

Health insurance companies and group health plans may not use your genetic information when making decisions regarding your eligibility or premiums.

Employers with 15 or more employees may not use your genetic information that we get from this research when making a decision to hire, promote, or fire you or when setting the terms of your employment.

5/19/2011

37

OHRP Suggested GINA Language

All health insurance companies and group health plans must follow this law by May 21, 2010. All employers with 15 or more employees must follow this law as of November 21, 2009.

Be aware that this new Federal law does not protect you against genetic discrimination by companies that sell life insurance, disability insurance, or long-term care insurance.

If research involves determining whether individuals have a manifested disease, consider telling subjects that this information is not protected

74

Certificates of Confidentiality

Certificates of Confidentiality available from NIH for sensitive research information where disclosure of identifying information could damage subjects financial standing, employability, insurability or reputation

Research collecting information related to genetics, psychological well being, sexual behavior, drug use, criminal activities

Research where subjects may be involved in litigation related to exposures under study