1. Research and Privacy Under HIPAA Professor Peter P. Swire Moritz College of Law Ohio State University National Academy of Science Panel on Science, Technology & Law September 13, 2004

2. Overview n History of HIPAA privacy n Privacy rationale for protection n Four ways to share data for research n Next steps, including recruitment

3. I. History of HIPAA n 1996 statute – Administrative simplification – Electronic payments – Build privacy & security at same time n 1999 HHS proposed rule – Numerous meetings on research before & after – 53,000 public comments – My role as Chief Counselor for Privacy at OMB

4. History of HIPAA n 2000 Final Rule – Disclosure for research if: n Patient authorization n IRB approval n De-identification of data n 2002 Revised Final Rule – Added limited data set n Gradual guidance from HHS on research

5. II. Privacy Rationale n Privacy rule philosophy: personal health information should be disclosed from covered entities only if have assurances of privacy protection n Concern #1: Researchers might not be in covered entities – Drug companies usually not covered – Many individual researchers not part of a HIPAA-covered provider

6. Privacy Rationale n Concern #2: research is an elastic term, that can include a patients sense of privacy invasion – Market research on whether a user of an anti- depressant will switch to a different anti- depressant in response to an ad? – A doctor youve never heard of saying that she is studying people on that anti-depressant and wants to enroll you in a study?

7. III. Sharing PHI for Research ¶ Patient authorization: with permission, data can be shared · IRB approval: researcher seeks IRB permission, an ethical check ¸ De-identified data -- can share freely ¹ Limited Data Set n Can include date of treatment & some other identification n Contractual promise to protect data (like a business associate contract)

8. IV. Next Steps on Research n Recognize that sharing of data for research was integral part of HIPAA process n If community hospitals or others are scared to participate, a chief cure is better guidance & education from HHS

9. One topic for attention n Accounting for disclosures now required when have IRB waiver n For decentralized research hospitals, difficult to respond to patient request for accounting – Records held in many places n Accounting is much easier if shift to Electronic Medical Records – Can have entity-wide IT help to manage records n Markle Connecting for Health & David Brailors initiative at HHS seek to spread EMRs

10. Thank you.