Presentation is loading. Please wait.

Presentation is loading. Please wait.

Tulane Human Research Protection Program (“HRPP”)

Similar presentations

Presentation on theme: "Tulane Human Research Protection Program (“HRPP”)"— Presentation transcript:

1 Overview of HIPAA Privacy & Confidentiality Requirements Related to Research
Tulane Human Research Protection Program (“HRPP”) Present By: Wade Wootan Date: March 2010

2 Objectives Who must comply?
Review applicable federal regulations affecting privacy of research information Health Insurance Portability & Accountability Act Privacy Regulations (HIPAA Privacy or HIPAA) Human subject protection regulations for Department of Health & Human Services (DHHS) and the Food and Drug Administration (FDA) Who must comply? What information is protected? What uses & disclosures are permitted?

3 Tulane HIPAA Policies, Procedures & Guidance
Research policies for HIPAA See Section 16 of Tulane’s HRPP Standard Operating Policies (SOPs) found at HIPAA authorization form found on IRBNet TUMG HIPAA policies & forms found at

4 HIPAA Privacy Rule Purpose and Background
Acknowledges that, in course of conducting research, researchers may create, use, and/or disclose individually identifiable health information (IIHI) Recognizes that research community has legitimate needs to use, access and disclose certain information to carry out a wide range of health research. Establishes minimum standards for protecting the privacy of IIHI Confers certain rights on patients/subjects, including rights to access and amend their health information and obtain a record of when and why their protected health information (PHI) was shared with others Establishes conditions under which covered entities (CE) can provide researchers access to and use of PHI when necessary to conduct research.

5 If a treatment relationship exists, HIPAA Privacy is intended neither to limit access to nor quality of health care It also establishes penalties for covered entities that fail to comply, including money fines and/or imprisonment.

6 Step-by-step analysis
Who must comply? Covered entities Hybrid entities What information is protected? IIHI PHI De-Identified What uses & disclosures are allowed? Treatment, payment & healthcare operations (TPO) Authorization IRB waiver of authorization Limited Data Set Preparatory for research Research of decedents Required by law “Grandfathered” research Sensitive info. Minimum necessary disclosed? Use & Disclosure of Research Information: Accounting requirements for non-routine disclosures

7 To whom does the Privacy Rule apply?
HIPAA Privacy Rule applies only to: Covered entities (CE)(i.e., health care providers, health plans & health clearinghouses) Who electronically transmit any health information that DHHS has adopted standards (eg, transaction & code sets , coordination of benefits, authorizations, etc) Tulane elected to be a hybrid entity for HIPAA compliance purposes. This limits application of the Privacy Rule to only health care operations (i.e., areas that create, use and/or disclose IIHI & electronically bill Federal payors). The following components were designated by Tulane as health care operations covered by the Privacy Rule: TUMG, its physicians, and clinicians TU employees & departments providing management, admin, financial, legal and operational services to TUMG and use IIHI As a matter of policy, Tulane’s HRPP standard operating policies (SOPs) apply HIPAA to human subjects research (See SOPs at section 16) Tulane’s IRB serves as a Privacy Board for HIPAA compliance purposes as it applies to research This is in addition to the IRBs role to safeguard the confidentiality rights of subjects involved in research under DHHS & FDA requirements For healthcare, Tulane’s Privacy Officer is Glenda Folse and Security Officer is Leo Tran [see also “Designation of Healthcare Components & Hybrid Entities (TU P&P GC-101]

8 Comparison—Privacy Rights Under HIPAA & Confidentiality Rights Under DHHS Regulations
Issue HIPAA Privacy Rule (45 CFR Part 160 & 164(A) & (E)) DHHS Protection of Human Subjects (45 CFR Part 46) FDA Protection of Human Subjects (21 CFR Parts 50 and 56) Purpose Establish Federal floor of privacy protections for most IIHI by establishing conditions for its use/disclosure by covered entities --Protect rights & welfare of human subjects involved in research conducted or supported by DHHS --Not specifically a privacy regulation --Protect rights, safety & welfare of subjects involved in clinical investigations regulated by FDA Scope Applies to HIPAA-defined CEs, regardless of source of funding Applies to human subjects research conducted or supported by DHHS --Applies to research involving products regulated by FDA --Federal funding not necessary for FDA regs to apply --If Federally funded, both DHHS & FDA regs apply

9 What health information is protected by the Privacy Rule?
The Privacy Rule applies to protected health information (PHI) created or maintained by a CE (and a CEs business associates) What is PHI? What is IIHI Individually identifiable health information (IIHI) AND Transmitted or maintained in any form or medium (i.e, oral, paper or electronic) Information that relates to past, present or future physical or mental health or condition; healthcare; or payment for healthcare AND Identifies an individual or can reasonably can be used to identify Created or received by a covered entity (healthcare provider, health plan, or clearinghouse) Note: IIHI can include PHI created in research

10 18 Types of IIHI Look for the existence of any one of the following:
More obvious identifiers Names Address SSN phone Fax full face photo Less obvious identifiers any dates MRN health plan # account #’s license # VIN device # URL’s IP address finger/voice print Any other unique identifying numbers, characteristics or codes

11 Comparison—Definition of Individually Identifiable Information
Issue HIPAA Privacy Rule DHHS Protection of Human Subjects FDA Protection of Human Subjects Identifiable Information --Defines PHI as individually identifiable health information (IIHI) transmitted or maintained in any form or medium by a CE (or its BA) --See list of 18 types of IIHI --Private information must be individually identifiable for obtaining it to constitute “research involving human subjects” --”Individually identifiable” means the identity of subject is or may be reasonably ascertained by investigator or associated with information No definition of individually identifiable information

12 What is not covered under HIPAA?
De-identified health information (i.e, no IIHI) & thus not protected by HIPAA Studies that do not involve health information or healthcare (e.g. anthropology) IIHI held by anyone other than a CE (eg, an independent researcher)

13 De-Identifying PHI CEs may use/disclose health information that is de-Identified. Before disclosing, confirm de-ID through either: By removing all 18 IIHI identifiers The CE does not have actual knowledge that info could be used alone or in combination with other documents to identify an individual who is a subject of the info OR Statistical verification of de-ID; A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering info not individually identifiable determines that risk is very small that info could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the info Document the methods and results of the analysis justifying determination (b)

14 De-Identifying PHI Statistical Verification of De-ID
DHHS guidance to generally accepted statistical and scientific principles and methods: Statistical Policy Working Paper 22 - Report on Statistical Disclosure Limitation Methodology ( (prepared by the Subcommittee on Disclosure Limitation Methodology, Federal Committee on Statistical Methodology, Office of Management and Budget) and Checklist on Disclosure Potential of Proposed Data Releases ( (prepared by the Confidentiality and Data Access Committee, Federal Committee on Statistical Methodology, Office of Management and Budget). DHHS commentary to 45 CFR (b)

15 De-Identifying PHI Re-Identification
Question: Can a code be used to re-ID information that previously was de-ID? Answer: Yes. A CE may assign a code or other means of record identification to allow de-identified information to be re-identified by the CE, provided that: The code or other means of record identification is not derived from or related to info about the individual and is not otherwise capable of being translated so as to identify the individual; and The CE does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification. (c) Re-Identification

16 De-Identification Coded data
Privacy Rule allows a CE to code data and then disclose it as “de-identified” The code is secured and not distributed with the data Codes cannot be derived from IIHI (e.g. last 4 digits of SSN) Common Rule considers coded data with agreement/policy that PI can’t access code to not involve human subjects When PI codes data it is not de-identified but it may be Common Rule exempt if PI does not hold the code

17 De-Identified vs Anonymous
De-identified health information is not PHI and, thus, is not protected by Privacy Rule “Anonymous” is a DHHS/IRB term. Identity of the subject may not readily be ascertained Anonymous can refer to fact that identifying information was never collected If collected, anonymous data may or may not be de-identified

18 How PHI can be used or disclosed?
Use = Internal sharing, exam, analysis of PHI within a CE Disclosure = external release, transfer or divulging of PHI by a CE If the Privacy Rule applies, then a CE can use/disclose PHI for: TPO: treatment, payment and healthcare operations (TPO), even without subject permission Research: With individual HIPAA authorization [45 CFR ] IRB approved waiver or alteration of authorization [ (i)(1)(i)] Limited data sets with Data Use Agreement [ ] Preparatory to Research [ (i)(1)(ii)] Research of Decedents [ (i)(1)(iii)] “Grandfathered” Research Required by Law [ ]

19 HIPAA Authorization for Research Use & Disclosures Required Elements
A HIPAA Authorization is individual’s signed permission that contains: Specific information to be used/disclosed By whom and to whom (may be classes of persons) Purpose of use/disclosure Be specific – cannot authorize future unspecified research How long the authorization is valid (“end of study” or “forever” are okay if justified by research) Potential risks of re-disclosure (eg, if data shared with non-HIPAA covered entity) Signed & dated Do not condition treatment on signing authorization Right of individual to revoke authorization (pro-actively) Authorization may be combined with study informed consent. Tulane does not allow combination of HIPAA authorization with any other consent/documents to avoid subject confusion

20 Comparison—Research permissions
Issue HIPAA Privacy Rule DHHS Human Subjects Regs FDA Human Subjects Regs Permission for Research Authorization Informed Consent (IC) IC IRB/ Privacy Officer Duties --CE must obtain authorization for research use/ disclosure of PHI unless HIPAA exception exists --Neither IRB nor Privacy Officer reviews authorization form --IRB must ensure that IC is sought from & documented for each prospective subject per DHHS regs. --If DHHS regs. met, IRB may waive either obtaining IC or documented IC. --IRB must review/ approve HIPAA authorization form if combined with IC --Privacy Officer has no authority --Same as DHHS requirements

21 IRB-approved waiver of HIPAA authorization
When de-identification is impractical or is not feasible for researchers to obtain signed authorizations for all PHI the researcher needs to obtain, the Privacy Rule permits obtaining IRB approval for waiver or alterations of the authorization requirement regarding uses & disclosures Section (i); see also Use & Disclosure of PHI for Research (TU P&P GC-012)

22 IRB-approved waiver of authorization (cont.)
IRB must determine Minimal risk to privacy Research couldn’t be conducted without access and without waiver Written assurance PHI won’t be re-disclosed or re-used except as required/permitted by law Limited to minimum necessary IRB need only review request to waive or alter authorization (vs actual authorization) IRB waiver of authorization documented in IRB approval letter

23 Partial waivers of Authorization & alterations to Authorization approved by IRB
Recruitment may require access to PHI but no patient contact Phone eligibility screens where no written authorization possible Can waive authorization for these initial research processes and then subjects consented later No provisions for waiving documentation only

24 Q&A: Tissue banks & old tissue samples
Question: We have a freezer full of old tissue blocks that have built up over the years and we want to use them for our new research. Is this human subjects research & is a HIPAA authorization needed? Answer: It depends if human subjects research exists. Look to investigator intent: Systematic investigation On a living individual about whom the investigation is being conducted About whom the investigator conducting research obtains Data through intervention or interaction with the individual; or Individually identifiable private information That is designed To develop or contribute to “generalizable knowledge” If human subjects research, then samples repository & IRB approved protocol regarding use & maintenance of samples Was there consent/authorization to keep the samples when they were collected? Was there informed consent/authorization for future activities? Is the proposed use consistent with any prior consent/authorization? Otherwise, access requires an IRB waiver for use or disclosure of information 1. Authorization must be for specific purpose 2. Banks do not know at time of collection how data/specimens will be used. Therefore, can’t obtain valid authorization for research uses 3. Can get authorization to bank 4. Access then requires a waiver for the use or disclosure of the information thereafter

25 Comparison—Cooperative Research & Waiver/Alteration of HIPAA Authorization
For multi-site research or research requiring use/disclosure of PHI created or maintained by multiple CEs or where multiple IRBs may be involved, review by 1 IRB is okay HIPAA Privacy Rule DHHS Protection of Human Subjects FDA Protection of Human Subjects --Requests to waiver or alter authorization requirement are reviewed/ approved by IRB --A CE may reasonably rely on IRB decision --Each institution is responsible for safeguarding rights & welfare of human subjects & complying w/ DHHS protection of human subject regulations --With DHHS approval, an institution participating in a cooperative project may enter into a joint review arrangement, rely upon review of another qualified IRB or make similar arrangements to avoid duplicative effort Cooperative research/ multi-institution studies may use joint review, reliance upon review of another qualified IRB, or similar arrangement aimed at avoiding duplicative effort

26 Comparison—Waivers of Authorization or IC Requirements
HIPAA Privacy Rule DHHS Protection of Human Subjects FDA Protection of Human Subjects Allows waiver or alteration of authorization when IRB or Privacy Officer/Privacy Board deems following are met: Use/disclosure involves no more than minimal risk to privacy because the following exist: Adequate plan to protect IIHI from improper use or disclosure An adequate plan to destroy IIHI at earliest opportunity absent health or research justification or legal req. to keep them Adequate written assurances that PHI will not be used or disclosed to 3rd party except as req’d by law, for authorized oversight of research of other permitted uses or disclosures Research could not practicably be conducted without waiver or alteration; AND c. Research could not practicably be conducted w/o access to & use of PHI Permits IRB to waive some/all elements of IC, or to waive need to obtain IC, if IRB finds & documents : Research involves no more than minimal risk to subject Waiver or alteration will not adversely affect rights or welfare of subjects Research could not practically be carried out w/o waiver or alteration When appropriate, subjects will be given pertinent info after participation --Permits FDA to waive IRB review requirement --Permits IRB to approve clinical investigation w/o subjects’ IC in certain circumstances (see 21 CFR & 21 CFR 50.24). These include: Immediate use of test article is, in investigator’s opinion, needed to preserve life of subject & in sufficient time exists to get IC Emergency research

27 Limited Data Sets Background
Privacy Rule permits disclosure of limited data sets (“almost” identified) by a CE and researcher to another researcher for research, public health or healthcare operations Receiving researcher must have a signed Data Use Agreement with CE No need for authorization or IRB waiver Does not require accounting for disclosures

28 Limited Data Sets 16 Identifiers (versus 18 IIHI)
For a limited data set to exist, remove the following IIHI: More obvious identifiers Names Address (except town, city, state & zip) SSN phone Fax full face photo Less obvious identifiers any dates MRN health plan # account #’s license # VIN device # URL’s IP address finger/voice print Any other unique identifying numbers, characteristics or codes

29 Limited Data Sets Data Use Agreements
Because limited data sets contain IHI (ie, potentially 2 categories), they are PHI and a Data Use Agreement is required under the Privacy Rule A Data Use Agreement is a way for a CE to set boundaries for the use and disclosure of limited data sets for researchers for PHI they received

30 Limited Data Sets Elements to Include in Data Use Agreements
Establish permitted use/disclosure of limited data set by recipient, consistent with purpose of research; no use/ disclosure by recipient that would violate Privacy Rule if done by disclosing CE; and Limit who can use/disclose PHI received; and Recipient stipulates Not to use/disclose info other than as permitted by data use agreement or as required by law Use safeguards to prevent use/disclosure of info not allowed by data use agreement Report to CE any use/disclosure of info not allowed by data use agreement Ensure that any agent’s/contractors of recipient who receive info agree to data use agreement requirements Not identify the info or contact the subjects

31 When to use Data Use Agreements?
Use Data Use Agreements if limited data set recipient/researcher: Is an employee or workforce member of another covered entity Is another covered entity “Internal” data use scenario where recipient is TU employee or not part of TUMG [See TU Data Use Agreement Policy (GC-018)]

32 Preparatory to Research
An investigator may use/disclose PHI to prepare a research protocol, design a study, assess study feasibility, grant prep, etc Investigator must certify (orally/writing) that: Use/disclosure of PHI is solely preparatory to research, PHI will not be removed from CE, and PHI sought is necessary for research

33 Research of Decedents An investigator may use/disclose PHI of decedent for research Investigator must certify that: Use/disclosure of PHI is solely to research PHI on decedent, PHI sought is necessary, & Proof of death (if CE requests proof of death)

34 “Grandfathered” Research
Under the Privacy Rule’s transition provisions, a CE may use/disclose PHI for research purposes if one of the following was obtained before the 4/14/2003 HIPAA Privacy compliance deadline: Individual authorization or other express legal permission to use/disclose PHI for research; Subject provided IC to participate in research; or IRB waiver of IC

35 Required by Law Privacy Rules permits use/disclosure of PHI required by law (Federal or State), even if no express individual permission exists. Examples include a CE disclosing PHI (as legally required): To cancer registries (or other registries) To public health authorities re. preventing or controlling disease, injury or disability or public health surveillance, investigations and interventions To a person subject to FDA jurisdiction (eg, a sponsor) re. FDA-regulated product/ activity for which that person has responsibility re. QA, safety or effectiveness of FDA-regulated product/ activity Includes adverse event reporting; FDA-product tracking; post-market surveillance; & enabling product recalls, repairs, replacements, etc To health oversight agencies (eg, Federal, State, accreditation, etc)

36 Certificates of Confidentiality (CoC) Background
CoCs are issued by NIH, FDA & CDC to protect identifiable information on IRB-approved research from forced disclosure Protect against subpoena, court order or request from any Federal, State or local proceeding (ie, civil, criminal, administrative, legislative, etc) Allow investigators & others with access to research records to not disclosure information that could ID research subjects if the disclosure could have adverse consequences for subjects (eg, subject’s financial standing, employability, insurability, reputation, etc) [42 USC 241(d) (with DHHS authority delegated to respective Federal agencies)]

37 Certificates of Confidentiality (CoC) Adverse Consequences
Examples of research with potential adverse consequences for subjects: Collecting genetic information Collecting information on psychological well-being of subjects Collecting information on sexual attitudes, preferences or practices Collecting data on substance abuse or other illegal risk behaviors Studies where subjects may be involved in litigation related to exposures under study (eg, breast implants, environmental or occupational exposures)

38 Certificates of Confidentiality (CoC) Potential Recipients
Issued for single, well-defined research projects CoCs granted to Institutions based on PI’s application May be issued for cooperative multi-site projects Must have a coordinating center or “lead” institution responsible for ensuring that all institutions conform to application assurances Lead institution can apply on behalf of all associated institutions

39 Certificates of Confidentiality (CoC) Assurances
Lead institution is responsible for ensuring that all institutions conform to application assurances & agree to: Protect against compelled disclosure and support/defend authority of CoC against legal challenges Comply with Federal regs re. human subject protection No represent the CoC as an endorsement of the study by Federal Government or use/coerce participation Inform subjects re. existence of CoC, its protections & limitations

40 Certificates of Confidentiality (CoC) Limits of Protection
CoC protects data maintained during any time the CoC is in effect Protects that data in perptuity Does not eliminate need to disclosure to Government for study audits & investigations Does not protect against disclosures reportable by law: Child/elder abuse Threat of harm to self/others Communicable diseases CoC does not eliminate need for data security, which is essential to protection of research subjects’ privacy Researchers should safeguard research data & findings from unauthorized use & disclosures

41 Projects Not Eligible for CoC
Not research Not collecting personally identifiable information No IRB review/approval Collecting information that, if disclosed, would not significantly harm or damage subject

42 Minimum Necessary Privacy Rule limits the non-routine use, disclosure, or requesting of PHI to the minimum amount of info necessary to accomplish the purpose of the use or disclosure. Non-routine disclosures do not include the following : De-identified information Limited data set information Made pursuant to a HIPAA authorization For TPO If required by law Example: authorization to disclose just CBC and panel information (versus entire file) [See Minimum Necessary Standard (TU GC-005)]

43 Accounting for Non-Routine Disclosures
HIPAA requires accounting for: Non-routine disclosures AND Disclosures of PHI involving 50 or more subjects on a study. The accounting may provide: Name of protocol or other research activity; Description of research protocol or other research activity, including the purpose of research and criteria for selecting particular records; Brief description of type of PHI disclosed; Date or period of time during which such disclosures occurred, or may have occurred; Name, address, and phone of research sponsored and of researcher to whom the information was disclosed; and Statement that the PHI of the individual may or may not have been disclosed for a particular protocol or other research activity. (b)

44 Recap

Download ppt "Tulane Human Research Protection Program (“HRPP”)"

Similar presentations

Ads by Google