Microsoft PowerPoint - 501 Vulcano, Rosati [Read-Only]Kristen Rosati, JDKristen Rosati, JDKristen Rosati, JDKristen Rosati, JD Coppersmith Schermer & Brockelman PLC
David Vulcano, David Vulcano, David Vulcano, David Vulcano, LCSW, MBA, CIP, RAC LCSW, MBA, CIP, RAC LCSW, MBA, CIP, RAC LCSW, MBA, CIP, RAC AVP & Responsible Executive, Clinical Research
Clinical Services Group | HCA
Session Overview
• Anticipated changes to the HIPAA Privacy Rule to implement the HITECH Act and the Genetic Information Nondiscrimination Act
• NCI Best Practices for Biospecimen Resources
• Ethical Issues And Public Opinion of What’s Legal
Reference slides:
• HIPAA compliance
Office for Civil Rights – HIPAA Compliance
• Proposed amendments to the HIPAA rules to implement the HITECH Act*: 75 Fed. Reg. at 40868 (July 14, 2010)
– Comments closed September 13, 2010
– Final regulations anticipated during the first half of 2011
– OCR will not enforce the new regulations until 180 days after the effective date of the final regulations
*American Recovery and Reinvestment Act of 2009 (ARRA) -- Division A, Title XIII and Division B, Title IV: Health Information Technology for Economic and Clinical Health Act (HITECH Act)
4
• Authorization for future research – The OCR sought comment on whether and how to change its interpretation that an authorization may not seek permission for use in unspecified future research
– Options considering:
• Permitting, if authorization adequately describes future research
• Permitting, with certain required elements or statements
• Permitting, with limits on sensitive research areas, such as genetic or mental health research
– Working with OHRP on consistency with Common Rule
Research Authorizations
5/19/2011
3
5
• “Compound authorizations” – Proposed rule would permit compound authorizations, which combine authorization for a clinical trial and authorization to contribute PHI to a research repository, as long as the form provides the individual with an opportunity opt-in to the research repository
[Proposed 45 CFR § 164.508(b)]
Research Authorizations
6
• Current rule: CE may receive payment for a disclosure of PHI where that disclosure is permitted by the regulations (such as for research)
• HITECH Act prohibits indirect or direct receipt of remuneration in exchange for a disclosure of PHI without the individual’s authorization (with exceptions) – Proposed rule would prohibit indirect or direct remuneration in exchange for a disclosure of PHI without authorization (with exceptions on the next slide)
– “Remuneration” is not defined-- will it include non-financial remuneration?
[HITECH Act § 13405(d); Proposed 45 CFR § 164.508]
No Sale of PHI
– For public health purposes
– For research, “where the only remuneration received by the covered entity is a reasonable cost-based fee to cover the cost to prepare and transmit” the PHI
– For treatment and payment
– For the sale, transfer, merger or consolidation of the covered entity and related due diligence
– To or by a business associate to perform activities for the covered entity, where “the only remuneration provided is by the covered entity to the business associate for the performance of such activities”
– To an individual for access or accounting
– Where required by law to disclose PHI
– Where the only remuneration received is a reasonable cost-based fee to cover the cost to prepare and transmit the PHI, or a fee is otherwise expressly permitted by another law
[Proposed 45 CFR § 164.508]
8
– Rule does not apply to disclosures of PHI for research under § 164.512(i) (the general rule on research disclosures) or § 164.514(e) (disclosures of a Limited Data Set for research), “where the only remuneration received by the covered entity is a reasonable cost- based fee to cover the cost to prepare and transmit the [PHI] for such purposes.”
– What is a “reasonable cost-based fee”? • Comments urged OCR to allow organizations to recoup investment and other indirect costs in the fees they charge for PHI
• Not permitting recoupment of a wide range of costs may be an unconstitutional taking of property
• Who will determine the appropriate amount and how will that be done?
No Sale of PHI– Research Exception
5/19/2011
5
9
• Disclosure of research results
– LDS expressly added to research and public health exceptions
• Quality assurance/ performance improvement activities
– Section 13405(d)(2)(G) of the HITECH Act provides authority to the OCR to make additional exceptions for disclosures of PHI that the OCR judges to be “similarly necessary and appropriate” as the other enumerated statutory exemptions to the sale of PHI
No Sale of PHI– Research Exception
10
– No grandfather provision
– Past grandfather provision permitted use of PHI to continue if the informed consent/waiver obtained before HIPAA was valid under pre-HIPAA law
No Sale of PHI– Research Exception
5/19/2011
6
11
• BAAs required if have third party de-identify PHI or create Limited Data Set
• BAAs not required to disclose PHI for research on behalf of the covered entity, because research is not a “covered function” under HIPAA
– The OCR has clarified informally that this applies beyond disclosure to the researcher, and also encompasses research management and other services
Business Associate Agreements in Research
12
• Add organizations that provide patient safety activities listed at 42 CFR § 3.20 (to implement the Patient Safety and Quality Improvement Act)
• Add Health Information Organizations, e-prescribing gateways, or other persons that provide “data transmission or other persons that provide “data transmission or other persons that provide “data transmission or other persons that provide “data transmission services,” services,” services,” services,” which transmit protected health information (PHI) to a covered entity and require access to that PHI on a routine basis
• Add entities that offer a personal health record to individuals on behalf of a covered entity
[HITECH Act § 13408; proposed 45 CFR § 160.103]
Changes to the Definition of Business Associate
5/19/2011
7
13
• Proposed rule: Would protect for only 50 years after death [Proposed 45 CFR § 164.502(f)]
• Would permit to permit CEs to disclose a decedent’s PHI to family members and others who were involved in the care or payment for care prior to death, unless inconsistent with an expressed preference of the decedent
– This would be a permitted (not required) disclosure, and would not change the authority of the decedent’s personal representative to act on behalf of the decedent
[Proposed 45 CFR § 164.510(b)]
14
• HITECH Act requires HHS to issue guidance on methods for de- identification of protected health information
• OCR March 2010 workshop on de-identification approaches, best practices for implementation and management of the current de- identification standard and potential changes to address policy concerns, see http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentiti es/De-identification/deidentificationworkshop2010.html
Future Changes to De-identification?
Genetic Information Is “Health Information”
• Section 105 of the Genetic Information Nondiscrimination Act requires HHS to revise the HIPAA Privacy Rule to clarify that genetic information is health information
• The Office for Civil Rights (OCR) issued a proposed rule to implement GINA, at 74 Fed. Reg. 51698 (Oct. 7, 2009): – Health information includes genetic information – Genetic information is defined broadly as including genetic testing of an individual or the individual’s family members, fetuses and embryos held for assisted reproductive technology, information about the manifestation of a disease or disorder in family members (i.e., family medical history), and any request for or receipt of genetic services (genetic testing, counseling, education or participation in genetic research)
16
“Protected Health Information”?
• The OCR has concluded that “genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse.”
5/19/2011
9
17
Definition: “Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and:
– (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
– (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
• (i) That identifies the individual; or • (ii)With respect to which there is a reasonable basis to believe the information can be used to identify the individual”
18
Is Genetic Information Individually Identifiable?
Under 45 CFR 164.514, a covered entity may determine that health information is not individually identifiable health information only if that information is de-identified by:
(1) Obtaining a statistical certification that “the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information”; or
(2) Removing all the identifiers (including biometric identifiers)
5/19/2011
10
19
• Name;
• Geographic information below state level;
• Dates related to a patient;
• Age if over 89 (unless aggregated into a single category of age 90 and older);
• Various number s related to a patient
• Full-face photographs and any comparable images;
• Biometric identifiers, such as fingerprints
• Any other unique identifying number, characteristic, or code.
The OCR has not provided guidance on whether genetic information is a “biometric identifier” or a “unique identifying characteristic”
20
Practical Guidance
• Provide enough information in your protocol to support the IRB’s conclusion that the genetic information sought or developed through a study is not identifiable (and that there is not a reasonable basis to believe the information can be used to identify an individual)
-or-
• Obtain a statistical certification that “the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information”
5/19/2011
11
• Background
– Formal draft revisions at http://biospecimens.cancer.gov/practices/2010bp.asp
– Comments closed September 21, 2010
• Revisions include:
Using “It’s Legal” to Justify The Ethical
• “It’s legal”.
• “The majority of people are for this kind of research.”
• “Lives saved outweigh the lives lost.”
Legality of an activity does not necessarily
make it is ethical.
Research
Consent
Ethical Questions
• Is it appropriate to use data/tissue already gathered but from means considered unethical? – Does using the data/tissue make one an “accessory” to the unethical behavior?
• What criteria do you use when choosing between one good and another good?
5/19/2011
13
Even Following The “Legal” Is Difficult
• 41% studies using tissue collected for treatment purposes did not get IRB approval for the study. – Not necessarily exempt as only 5% of these used “non-identifying” samples
• When Consent was not obtained – 77% non-IRB approved studies used “identified samples”
– 33% IRB approved studies used “identified” samples
• Unclear if Waiver was obtained
By Merz JF, Leonard DG, Miller ER, Science (New York, N.Y.) [Science], ISSN: 0036-8075, 1999 Mar 12; Vol. 283 (5408), pp. 1647-8; PMID: 10189317
Three Ways That Encourage Unethical Deeds
• Direct Encouragement Through Agency – Wrongdoing is acknowledged but getting someone else to do it for you.
• Direct Encouragement Through Acceptance Of The Benefit – Someone else (independently) does it and wrongdoing is ignored thus deed is repeated.
• Indirect Encouragement Through The Legitimization Of The Practice – Someone else did it. Wrongdoing is acknowledged but using the results sends message that will be ok.
Green RM; Bioethics, 2002 Nov; 16 (6): 544-56 (journal article) ISSN: 0269-9702
PMID: 12474822 CINAHL AN: 2002173514
5/19/2011
14
Recent History
• 1996: Dickey-Wicker Amendment: “prohibits federal funding of research in which human embryos are destroyed.”
• 2001: Presidential decree limited funding to only existing embryonic stem cell lines as of August 9, 2001 (not adult stem cells).
• 2007: Executive Order 13435: “Expanding Approved Stem Cell Lines in Ethically Responsible Ways”
– Required DHHS funding to find alternate methods of derivation of stem cell research other than destruction of embryos
– Focus on perfecting conversion of skin cells into induced pluripotent stem cells (iPSCs) as alternative
hESC Research Saga (Continued)
• 2009: Executive Order 13505 “Removing Barriers to Responsible Scientific Research Involving Human Stem Cells ” – Revokes Bush’s 2001 limitations and EO 13435
– “[DHHS] may support and conduct responsible, scientifically worthy human stem cell research, including human embryonic stem cell research, to the extent permitted by law.”
• 2009-2010 : Lawsuits Challenging EO13505 – US Gvt. Sued by various parties based on presidential executive order cannot override law (Dickey-Wicker)
– Essentially the court determined institutes using U.S funds to purchase ESCs from destroyed embryos is undifferentiated from using U.S. funds to destroy embryos, thus illegal.
5/19/2011
15
•Lower Court Favored Executive Order
2009
• James L. Sherley et.al. vs. Kathleen Sibelius in her official capacity as Secretary of the Department of Health and Human Services, et al.,
• Lower Court Favored Executive Order
2010
• Subsequent hearing favored plaintiff, imposing a preliminary injunction halting HHS funding
• HHS successfully argued an “administrative stay” to be able to continue funding studies while appealing.
2011
• Preliminary injunction lifted so funding can continue while in appeals.
• Still In Appeals
• Lower Court Favored Executive
• “No Injury”.
‘certainly impending’.
hESC Research Saga (Continued)
• October 2010: Harvard adds themselves to group of agencies identifying a process to create iPSCs from skin.
• October 2010: “Stem Cell Therapeutic and Research Reauthorization Act of 2010” – Passed by Congress, Signed into law October 8, 2010
– Extended Stem Cell Therapeutic and Research Act of 2005 • Funding of stem cell acquisition and research from cord blood donation
– No addressing of Dickey-Wicker Amendments
5/19/2011
16
Without Consent/Assent in United States
• Texas Newborn Bloodspot Settlement
• Wide Acceptance of “The Immortal Life of Henrietta Lacks” Book
Event: The Texas Newborn BloodSpot Case
5/19/2011
17
Very Brief Summary of Events
• Texas, like many states, requires screening for 27 birth time-sensitive birth disorders upon birth.
• By law the blood could be taken without consent by hospitals, birthing centers and midwives. Samples were destroyed after testing.
• Beginning 2002, State of Texas began keeping bloodspots from newborns’ birth defect screening (stored at Texas A&M). Did not inform parents of retention.
• Samples used for “quality assurance” and “research”
The Controversy
• "You have to give permission for them to give your kid formula in the hospital. I don't understand why you don't have to give permission for the state to keep your kid's DNA.“
• Using the baby DNA spots "to barter with for-profit corporations for lab supplies, test kits and maintenance contracts."
– In 2006 and 2007, bioMerieux provided HIV rapid testing kits to DSHS in exchange for de-identified bloodspots used to perform QA for those test kits.
– In October 2008, DSHS provided 600 de-identified bloodspots (@$4 per spot) to Avioq for HIV test kit analytical validation for submission to the FDA.
• “The IRB board appointed to oversee research on the stored bloodspots consists almost entirely of State employees….This is not a true independent professional review board.”
5/19/2011
18
Results of Settlement
• State to destroy all specimens from 2002 – May 27, 2009 (5.3 Million blood spot cards filling 2.5 semi-trucks)
• Opt-out form (“Directive To Destroy”) created for future use.
• De-Identified is no longer cause for IRB exemption.
• Disclose how samples were used. – Later found out that they sent 800 (deidentified) samples to Armed Forces lab to build mitochondrial DNA (mtDNA) registry.
“Directive To Destroy”After testing, blood spot cards are
safely stored …because they still
have important public health uses.
The main uses are: 1) quality
assurance/quality control, such as
continues to produce accurate
research …Specific information that
blood spot card is not allowed
outside of DSHS without permission
from the child’s parent, managing
conservator, or legal guardian unless
otherwise provided by law.If the newborn screening blood spot
card is destroyed, the blood sample
will not be available for any future
needs you may have for the sample.
5/19/2011
19
• Implemented August 1, 2009
• As of 5/10/2010, they reported receipt of 21,210 requests to destroy – Approximately 5% of births
– In line with U. Michigan 2008 Study on Use of Samples With/Without Permission in a hypothetical study
“How willing are you to have your child’s blood sample (from their newborn
screening) used for future research studies (WITH/WITHOUT) your permission?”
(N=3935)
Unwilling
5/19/2011
20
Baylor College of Medicine Population incidence of mitochondrial mutations associated with aminoglycoside-induced deafness
University of California at Los Angeles, Department of Pediatrics Development of rapid and efficient PCR approach to detect common alpha-thalassemia deletions in
Southeast Asians and Filipinos in newborn screening specimens
University of California at Los Angeles, Department of Pediatrics Development of alternative mutation detection technologies for hemoglobinopathies
University of Texas MD Anderson Cancer Center Role of genetic polymorphisms of glutathione S-transferases and related genes in the pediatric
population
University of California at Los Angeles, Department of Pediatrics Genetic variation in Glycerol Kinase and adjacent genes
Centers for Disease Control and Prevention Using newborn screening dried blood spots to assess the contribution of selected congenital infections
(Cytomegalovirus (CMV), Lymphocytic Choriomeningitis Virus (LCMV) and Toxoplasmosis gondii) to the
etiology of hydrocephalus
PerkinElmer Life and Analytic Sciences Preliminary development of immunoassay to identify hemoglobin variants
Armed Forces Institute of Pathology Precursor study to “Enhancing the size, sampling, and quality of forensic mtDNA databases”
Armed Forces Institute of Pathology Enhancing the size, sampling, and quality of forensic mtDNA databases
Centers for Disease Control and Prevention Technical evaluation of cytokine measurements in dried blood spots
Centers for Disease Control and Prevention Technical evaluation of cytokine measurements in dried blood spots (follow-up)
Centers for Disease Control and Prevention Technical evaluation of cytokine measurements in dried blood spots (2nd follow-up)
National Institutes of Health; University of California at San Francisco Investigation of inherited immune disorders
University of Texas Health Science Center at Houston Pilot study for association study of genetic markers and Idiopathic Talipes Equinovarus (club foot)
University of Texas Health Science Center at Houston Association study of genetic study markers and Idiopathic Talipes Equinovarus (ITEV)
University of Minnesota Neonatal blood spot bank for childhood cancer studies
Centers for Disease Control and Prevention Development of reference ranges for use in screening newborns for X-linked adrenoleukodystrophy
Baylor College of Medicine Precursor study to identify genetic markers for selected cardiovascular birth defects
Texas A&M University Feasibility of using stored Texas newborn screening dried blood spots for childhood cancer
epidemiological research
Centers for Disease Control and Prevention Development of a method to determine concentrations of polyfluoroalkyl compounds (PFC) in dried blood
spots
University of California at Los Angeles, Department of Pediatrics Development of a newborn screening test for severe combined immunodeficiency using ELISA and dried
blood spots
University of Texas Health Science Center at Houston Candidate gene testing in nonsyndromic cleft lip and palate
Department of State Health Services Assessing the role of prenatal lead exposure on infant blood lead levels
PerkinElmer Life and Analytical Sciences Development of a biotinidase screening assay
Deafness
Summary of Issue
• 200 of 650 member tribe consented to give blood for research on Type 2 Diabetes, prevalent in their tribe.
• Consents said “could be used to study the causes of behavioral/medical disorders”.
• Years later, discovered blood was used for items inconsistent with tribal beliefs/values such as: – Schizophrenia
– Genealogy of Tribe (Crossed Bering Straight vs. indigenous)
– Effects of Inbreeding
Public Outcry
• “People got degrees and grants, and they never asked our permission”.
• “The research bore no resemblance to the diabetes research I pictured when I gave my blood years ago”.
5/19/2011
22
Settlement with Arizona State University
• ASU agreed to pay $700,000 to 41 of the tribe’s members
• Return the 151 remaining blood samples – Were buried in accordance with tribal customs.
• Provide other forms of assistance to Havasupai – Assisting in building a clinic and high school
– Scholarship eligibility to tribe members
Event: Publication of “The Immortal Life of
Henrietta Lacks”
From: Henrietta Everlasting: 1950s Cells Still Alive, Helping Science. Wired Magazine. January 25, 2010.
The Controversy
• “. . . if our mother cells done so much for medicine, how come her family can’t afford to see no doctors? Don’t make no sense. People got rich off my mother without us even knowin about them takin her cells, now we don’t get a dime.”
• “Lacks's family today are unable to afford the healthcare treatments their mother's cells helped to make possible.”
• “She doesn’t even have a tombstone, just an indentation in the ground.”
5/19/2011
24
• 1996: Atlanta Mayor proclaims Oct 11 as Henrietta Lacks Day
• 1997: Congressional resolution in her honor (filed by her hometown congressman)
• 1998: BBC Documentary 1998, Modern Times: The Way of All Flesh
Current Public Response
– Salon Book Award, 2010
– The New York Times 100 Notable Books of the Year
– Publishers Weekly Top 10 Books of 2010
– The Chicago Tribune Heartland Prize
– And more
• Popular acceptance of book – Paperback currently #18 on Amazon Top 100, Hardcover spent Almost 1 year in Top 100.
– Currently #2 in NY Times (Paperback Non-Fiction), and #5 (Combined Print & E-Book non- Fiction)
– #53 in USA Today’s Top 150 (all categories), > 40 weeks in Top 150 All Books
• Oprah producing HBO movie
• Growing funds in newly created Henrietta Lacks Foundation benefitting Lacks family, initial awards in 2010
– Full tuition and books for five descendants of Henrietta Lacks starting fall semester 2010
– Health care and emergency needs grants for two members of her immediate family
5/19/2011
25
Receives Tombstone Almost 60 Years Post-Burial
Henrietta Lacks, August 01, 1920-October 04, 1951. In loving memory of a phenomenal woman, wife and mother who touched the lives of many. Here lies Henrietta Lacks (HeLa). Her immortal cells will continue to help
mankind forever. Eternal Love and Admiration, From Your Family
Summary Of Ethics Portion
• Know The Legal Maze
• Know That Navigating The Legal Maze Is Not Your Endpoint To Conduct Research
• Principles of Belmont Report Apply To Non-Interventional Research As Well – Respect For Persons
– Beneficence
– Justice
50
5/19/2011
26
• Applying the Common Rule • Evaluating when IRB review is required • Approving research protocols involving biospecimens • Creating “informed” informed consent documents • Communicating research findings to participants
5/19/2011
27
53
When Does the Common Rule Apply?
The Common Rule applies to federally-funded research and to research if an institution voluntarily extends the scope of its Federalwide Assurance
“4. Applicability (a) This Institution assures that whenever it engages in human subjects research conducted or supported by any federal department or agency that has adopted the … Common Rule….
(b) Optional: This Institution elects to apply the following to all of its human subjects research regardless of the source of support, except for research that is covered by a separate assurance: [ ] The Common Rule (see section 3 of the Terms of the FWA for Institutions Within the United States for a list of departments and agencies that have adopted the Common Rule and the applicable citations to the Code of Federal Regulations) [ ] The Common Rule and subparts B, C, and D of the HHS regulations at 45 CFR part 46”
54
When Is IRB Approval Required?
• 45 C.F.R. 46.102 requires IRB approval for non-exempt human subject research
– Research: “a systematic investigation…designed to develop or contribute to generalizable knowledge”
– Human subject: “a living individual about whom an investigator … conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information”
– Intervention: physical procedures to gather data or manipulation of environment
– Interaction: communication or interpersonal contact
5/19/2011
28
55
– Private information: information provided for specific purposes by an individual, which the individual can reasonably expect will not be made public
– Identifiable: an individual’s identity is or may be readily ascertained by the investigator
56
• Strip all HIPAA identifiers for “safe harbor” protection
• Have a qualified determine that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information
5/19/2011
29
57
• Name;
• Street address, city, county, precinct, or zip code (unless only the first three digits of the zip code are used and the area has more than 20,000 residents);
• The month and day of dates directly related to an individual, such as birth date, admission date, discharge date, dates of service, or date of death;
• Age if over 89 (unless aggregated into a single category of age 90 and older);
• Telephone numbers;
• Fax numbers;
• Email addresses;
• Device identifiers and serial numbers;
• Web Universal Resource Locators (URLs) and Internet Protocol (IP) addresses;
• Biometric identifiers, such as fingerprints
• Full-face photographs and any comparable images; or
• Any other unique identifying number, characteristic, or code.
58
• FDA prohibits use of de-identified specimens, except if: • In-vitro diagnostic device study meets IDE exemption criteria
• The study uses leftover specimens (i) originally collected for clinical purposes, (ii) originally collected for unrelated research, or (iii) from a repository;
• Specimens not individually identifiable to investigator, sponsor or others associated with study;
• Individuals caring for patients are different from and do not share information with those associated with study;
• Supplier of specimens (e.g., repository) has policy that prohibits release of identifiers; and
• Protocol is reviewed by an IRB
– FDA uses “enforcement discretion” not to require informed consent for these studies
5/19/2011
30
59
• OHRP Guidance on Research Involving Coded Private Information or Biological Specimens (http://www.hhs.gov/ohrp/humansubjects/guidance/cdebiol.htm)
• Coded means that identifiable private information is replaced with a number, symbols, etc., and a key to decipher the code exists to allow linkage
• Coded information is not identifiable if it cannot be linked to specific information by the investigators (anyone involved in conducted the research) either directly or indirectly through coding systems. Specifically:
60
When Is Coded Information Not Identifiable?
• Coded information is not identifiable if: (a) the investigators and the holder of the key enter into an agreement prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased (note that the HHS regulations do not require the IRB to review and approve this agreement);
(b) there are IRB-approved written policies and operating procedures for a repository or data management center that prohibit the release of the key to the investigators under any circumstances, until the individuals are deceased; or
(c) there are other legal requirements prohibiting the release of the key to the investigators, until the individuals are deceased.
5/19/2011
31
61
HIPAA Has Different Rules for Coding…
• Coded information is not protected health information if the code is not derived from or related to patient identifiers (e.g., patient initials, mixed SSN or medical record number) and the code can’t be translated to identify the individual
• Disclosure of the key = disclosure of PHI
62
• 45 CFR 46.101(b)(4):
– collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens; and
– if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects
• Codes don’t count!
Is Expedited Review Possible?
• Expedited review is permitted if the research: – Involves no more than minimal risk; and
– Involves research in permitted categories (see http://www.hhs.gov/ohrp/humansubjects/guidance/expedited 98.htm), including:
• Certain blood collection
• Collection of biospecimens or data by noninvasive means
• Research involving biospecimens or data that have been collected or will be collected for non-research purposes
64
Is the Institution “Engaged” in Research?
• OHRP Guidance on “Engagement of Institutions in Human Subject Research” (2008) (http://www.hhs.gov/ohrp/policy/engage08.html )
– Institution is “engaged” in human subjects research if its employees or agents:
• Perform invasive or noninvasive procedures for the research
• Interact with participants for the research, such as interviewing
• Obtain informed consent
Is the Institution “Engaged” in Research?
– Institution is “engaged” in human subjects research if its employees or agents:
• Obtain for research purposes identifiable private information or identifiable biological specimens from any source (even if there is no interaction with the participants)
– If the specimens are coded, they are identifiable only if the investigators have the key
66
Is the Institution “Engaged” in Research?
– The institution is not “engaged” in human subjects research if its employees or agents:
• Collect specimens from patients as a service to the investigators, if they will not receive publication privileges, the service typically is performed for non- research purposes, and they do not administer any study intervention being tested
• Release identifiable private information or identifiable specimens to investigators at another institution
• Obtain coded information or specimens, but have no access to the key
Watch HIPAA compliance!Watch HIPAA compliance!Watch HIPAA compliance!Watch HIPAA compliance!
5/19/2011
34
67
Creating “Informed” Informed Consent Documents
• Regulations (45 C.F.R. 46.116(a)(1)) require: – Explanation of the purposes of the research
– Description of the procedures
• OHRP Guidance on “Research Use of Stored Data or Tissues” (1997) (http://www.hhs.gov/ohrp/policy/reposit.html) requires clear description of: – Operation of repository;
– Specific types of research to be conducted;
– Conditions under which data and specimens will be released to recipient-investigators; and
– Procedures for protecting privacy of subjects and confidentiality of data
Operation of the Repository
and Types of Research
• Who holds the repository? • How has access to the samples and data for repository management?
• How long will samples or data be retained? • What types of research might the samples be used for?
– Any research?
– Genetic research?
– “Tiered consents” – do they work, and what kind of infrastructure must an institution have in place to ensure that subjects’ wishes are respected?
68
5/19/2011
35
69
Be Released to Investigators?
• Will identifiers be on samples?
• Will samples be labeled with a code, and if so, who will hold the key?
• Are the reasonably foreseeable risks to participating discussed?
NCI suggested language: “The greatest risk to you is the release of information from your health records. We will do our best to make sure that your personal information will be kept private. The chance that this information will be given to someone else is very small.”
Alternative language: “The [entity] has extensive precautions in place to prevent any unauthorized disclosure of personally identifiable information. However, if there is an inadvertent or accidental disclosure of clinical data or data obtained from the study about you, this could have adverse effects on your insurability, employment or social standing. [If the study involves genetic information] It could also involve DNA typing, which may support paternity determinations and affect your family relationships. There may be unforeseeable risks that are not known at this time. However, you will be informed of any new risk as they become known.”
5/19/2011
36
Prohibits discrimination based on genetic information in health insurance and employment
Doesn’t cover life, disability or long term care insurance
Doesn’t cover employers under 15 employees
Genetic information includes:
Family history
Individual or family member request for genetic services (testing, counseling or education), including in clinical research
OHRP Suggested GINA Language
A new Federal law, called the Genetic Information Nondiscrimination Act (GINA), generally makes it illegal for health insurance companies, group health plans, and most employers to discriminate against you based on your genetic information. This law generally will protect you in the following ways: Health insurance companies and group health plans may not request your genetic information that we get from this research.
Health insurance companies and group health plans may not use your genetic information when making decisions regarding your eligibility or premiums.
Employers with 15 or more employees may not use your genetic information that we get from this research when making a decision to hire, promote, or fire you or when setting the terms of your employment.
5/19/2011
37
OHRP Suggested GINA Language
All health insurance companies and group health plans must follow this law by May 21, 2010. All employers with 15 or more employees must follow this law as of November 21, 2009.
Be aware that this new Federal law does not protect you against genetic discrimination by companies that sell life insurance, disability insurance, or long-term care insurance.
If research involves determining whether individuals have a manifested disease, consider telling subjects that this information is not protected
74
• Certificates of Confidentiality available from NIH for “sensitive” research information where disclosure of identifying information could damage subjects’ financial standing, employability, insurability or reputation
– Research collecting information related to genetics, psychological well being, sexual behavior, drug use, criminal activities