1. December 8, 2014 Healthcare/Privacy Current Law Affecting Uses of Health Data Melissa Bianchi Partner

2. www.hoganlovells.com Laws affecting secondary uses of health data HIPAA –Research Requirements Human Subjects Research Regulations – Common Rule/FDA Other Federal and State Laws –Part 2 substance abuse regulations –FERPA –State laws (e.g., protecting genetic, mental health data) 2

3. www.hoganlovells.com 3 What does HIPAA allow? The Privacy Rule –Restricts the use and disclosure of PHI except as permitted or required by the regulation, for example: Treatment, payment, health care operations –Health care operations: focused on internal activities, such as quality improvement Public health disclosures (fairly limited) Disclosures required by law –De-identified data (specific standards) –Limited Data sets (more robust than de-identified – how useful is the data?) –Pursuant to Authorization

4. www.hoganlovells.com 4 Research parameters for secondary data Research: systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge Permissible research mechanisms under HIPAA: –an individual’s written authorization –a waiver of authorization by an Institutional Review Board (“IRB”) or privacy board, –a data use agreement regarding a limited data set, –de-identified information –a certification for data reviews preparatory to research, or –special provisions for research using decedent’s information.

5. www.hoganlovells.com 5 Permission for Future Research Following the HITECH Rule, a HIPAA authorization may permit future research if the authorization adequately describes the future research such that it would be reasonable for the individual to expect that his/her PHI could be used or disclosed for that purpose. –Does this facilitate research? –How does this work in practice? –How does the compound authorization requirement affect the ability of entities to obtain authorization for future research?

6. www.hoganlovells.com 6 Research: Compound Authorization The Privacy Rule prohibits compound authorization for use/disclosure of PHI that authorizes (i) research activities for which treatment is conditioned on signing the authorization (“conditioned”) and (ii) research activities for which treatment is not conditioned on signing the authorization (“unconditioned”). The Final Rule permits such compound authorizations provided: –(1) the authorization clearly differentiates between the conditioned and unconditioned research components; –(2) the authorization provides a clear opportunity for individuals to opt- in to the unconditioned component; and –(3) the research does not involve psychotherapy notes

7. www.hoganlovells.com Human Subjects Research Regulations – Common Rule/FDA Rule What does it apply to? –Common Rule: any entity conducting federally funded research and institutions obligated under a Federal Wide Assurance (FWA) to adhere to Common Rule restriction, regardless of funding source any research involving a living individual about whom an investigator obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information –FDA: clinical investigations that support applications for research or marketing permits for products regulated by the FDA any experiment that involves a test article and one or more human subjects 7

8. Hogan Lovells has offices in: Abu Dhabi Alicante Amsterdam Baltimore Beijing Berlin Brussels Budapest* Caracas Colorado Springs Denver Dubai Dusseldorf Frankfurt Hamburg Hanoi Ho Chi Minh City Hong Kong Houston Jeddah* London Los Angeles Madrid Miami Milan Moscow Munich New York Northern Virginia Paris Philadelphia Prague Riyadh* Rome San Francisco Shanghai Silicon Valley Singapore Tokyo Ulaanbaatar Warsaw Washington DC Zagreb* "Hogan Lovells" or the "firm" is an international legal practice that includes Hogan Lovells International LLP and Hogan Lovells US LLP. The word "partner" is used to refer to a member of Hogan Lovells International LLP or a partner of Hogan Lovells US LLP, or an employee or consultant with equivalent standing and qualifications, and to a partner, member, employee or consultant in any of their affiliated businesses who has equivalent standing. Where case studies are included, results achieved do not guarantee similar outcomes for other clients. Attorney Advertising. For more information see www.hoganlovells.com. © Hogan Lovells 2012. All rights reserved. *Associated offices www.hoganlovells.com