Human Subjects Update E. Wethington, Chair, UCHS

Health Insurance Portability and Accountability Act, 1996 Not administered by the Office of Human Research Protection, but by the U.S. Office of Civil Rights and the U.S. Department of Justice Sets standards for privacy and confidentiality that differ from those in federal human subjects regulations (aka. The Common Rule)

Privacy requirements, in effect HIPAA privacy requirements apply to all research involving the use or disclosure of “Protected Health Information” by “Covered Entities,” regardless of the funding source for the research. Therefore, even privately-sponsored research, conducted by private physicians in their private offices, is subject to the Privacy Rule, as long as the physicians are considered “Covered Entities.” (The regulatory definition includes almost all providers of healthcare services.)

What Does the HIPAA Privacy Rule Do? Gives people more control over their health information Establishes safeguards to protect the privacy of health information Sets rules for the use and release of health information and records Creates civil and criminal penalties for violations of privacy standards

Rights of Research Subjects and Patients Restricts the use and disclosure of their health information to particular situations, except as specifically authorized by the subject-patient Limits the use and disclosure of their health information to the minimum reasonably needed Provides for an accounting of how their health information has been used and disclosed Proves the right to examine and obtain a copy of their health records and request corrections

Impact on Research Investigators Requires either an Authorization from the patient-subject or a waiver by an Institutional Review Board (IRB) or a Privacy Board to use of disclose Protected Health Information Requires methodical tracking of disclosures of Protected Information (“Covered entities” are required to furnish a “Notice of Privacy Practices” to all research subjects.)

Research consents acquired prior to April 14, 2003 Protected Health Information may continue to be used, received or disclosed for research after if one of the following has been obtained prior to the 4/13/03 deadline: Express legal permission or authorization from the individual to use PHI for research purposes Informed consent of the individual to take part in research Approval by the relevant IRB of a waiver of informed consent requirements (DHHS 45 CFR 46)

The Penalties Are Substantial Civil penalties $100 per violation, up to $25,000 per patient/subject, per year for each requirement or prohibition violated Criminal penalties, e.g. “knowingly obtaining protected health information in violation of the law” Up to $100,000 and up to 5 years in prison if the offenses are committed under “false pretenses”

If you obtain individually identifiable health information from a “covered entity” you will be affected by HIPAA Signed contracts on data security Signed contracts restricting data analyses and uses If you obtain anonymized health information from a “covered entity” you are probably okay You should register it with UCHS You should practice strong data security habits

Cornell Procedures Cornell-Ithaca is not a “Covered Entity.” Cornell Medical College is a hybrid entity. UCHS is the HIPAA “Privacy Board” for CU-Ithaca Cornell Medical College Privacy Manual is being adapted for use here at CU-Ithaca UCHS and the IRB at Cornell Medical will coordinate on PHI transfer between institutions UCHS must review all incoming projects involving Protected Health Information We must see documentation of authorizations; any other reviews done by an IRB or Privacy Board at a “covered entity.” We must review the importation of “limited datasets” containing protected health information released to CU researchers. (Security guidelines must be followed.) Projects will qualify for “exemption” or “expedited” review.

More Useful Information NIH has recently posted guidelines on addressing the HIPAA Privacy Rule in grant applications NIH will follow the Common Rule HIPAA applies only to domestic (U.S.) research No one knows how this is going to work out… Some institutional IRBs are adopting HIPAA standards for other types of research