7/29/2019 Letter to HHS Civil Rights About Possible HIPAA Violations

http://slidepdf.com/reader/full/letter-to-hhs-civil-rights-about-possible-hipaa-violations 1/2

 Center for Bioethics N504 Boynton

410 Church Street 

Minneapolis MN 55455

612-624-9440

Fax: 612-624-9108

www.bioethics.umn.edu 

Susan McAndrew, J.D.

HHS Office for Civil Rights

200 Independence Avenue, SW

Washington, DC 20201

Phone: 202-260-3314

E-mail: Susan.McAndrew@hhs.gov 

March 9, 2013

Dear Ms. McAndrew:

In the fall of 2012, I wrote to the HHS Office of the Inspector General requesting an

investigation of research oversight at the University of Minnesota, with special reference to the

suicide of Dan Markingson in a study titled ““Comparison of Atypicals in First Episode

Psychosis” (NCT00034892). One part of my request concerned possible HIPAA violations. In a

letter dated December 7, 2012, Ms. Jennifer Trussell informed me that this part of my requesthad been forwarded to you. I have received no acknowledgement of receipt from your office,

however.

My reason for writing now is to inform you of a new issue involving the possibility of further

HIPAA violations. As I wrote in my initial request to the HHS Office of the Inspector General,

the medical files for Dan Markingson, who died in the CAFÉ study in 2004, did not contain a

signed HIPAA authorization. When the mother of Mr. Markingson filed a lawsuit against the

university, the university was unable to produce a signed authorization. However, in 2011,

when a family friend of Mr. Markingson filed a complaint with the university, it produced asigned HIPAA authorization, but was unable to say where it had come from, or why it had not

been a part of Mr. Markingson’s medical files.

More recently, I received an unsigned HIPAA authorization from the family of a second subject

in the CAFÉ study. (I have posted that form here.) The absence of a signature on this form

7/29/2019 Letter to HHS Civil Rights About Possible HIPAA Violations

http://slidepdf.com/reader/full/letter-to-hhs-civil-rights-about-possible-hipaa-violations 2/2

suggests that the private health information of this subject may have been provided to the

CAFÉ study sponsors (AstraZeneca and Quintiles) without the consent of the research subject.

Another odd feature appears on the form: a sentence that reads “This authorization does not

have an expiration date.” My understanding of HIPAA requirements is that authorization forms

must specify an expiration date or event. According to the website of your office, all HIPAAauthorizations must “contain either an expiration date or an expiration event that relates to the

individual or the purpose of the use or disclosure.”

At a minimum, a single unsigned form suggests a HIPAA violation. Of course, it is possible that

there is another signed form somewhere, but it has not been provided to this family. The

absence of a signature also raises broader questions, of course. Did the other subjects in the

CAFÉ study authorize the release of their health information, or were their HIPAA forms left

unsigned as well?

The absence of an expiration date suggests a more systemic problem. If the HIPAA forms for

two subjects in the CAFÉ study contain the sentence “This authorization does not have an

expiration date,” it seems possible that all of the HIPAA forms did. And if that is true, then it is

possible that the privacy rights of all 17 of the CAFÉ study subjects were violated, and possibly

subjects in other Department of Psychiatry studies as well.

I hope that you will consider my request seriously. I would be glad to provide you with any of 

the documents that I have, if they would be useful.

I would be grateful if you would let me know when you have received this letter.

Yours sincerely,

Carl Elliott MD PhDProfessor, Center for Bioethics