Research-Related Provisions of the Proposed Privacy Regulations

By Mary R. Anderlik
Health Law & Policy Institute

In the November 3, 1999 Federal Register, the Office of the Secretary of Health and Human Services (HHS) published a proposed rule establishing privacy standards for health information. This article reviews provisions of the proposed rule that concern research. A previous article provided an overview of the proposed rule.

A few definitions must be borne in mind in assessing the implications of the draft regulations for research, since these definitions limit the scope of the regulations. The term "covered entity" refers to a health plan, health care clearinghouse, or health care provider that transmits health information electronically to carry out financial or administrative activities related to health care. Under the Health Insurance Portability and Accountability Act, HHS does not have the power to regulate researchers directly unless they fit the definition of health care provider. In the draft regulations, HHS has chosen not to regulate researchers indirectly through standard-setting for contracts between covered entities and researchers receiving protected health information (the strategy HHS uses to regulate "business partners" of covered entities). The term "protected health information" refers to individually identifiable health information that is or has been electronically transmitted or electronically maintained by a covered entity and includes such information in any other form. The regulatory requirements do not apply to health information that is de-identified. Indeed, the proposed rule contains statements encouraging broad dissemination of de-identified information for research purposes.

The key provision affecting research is proposed subsection 164.510(j). Pursuant to this subsection, covered entities are permitted to use or disclose protected health information for research purposes without authorization from the individuals who are the subjects of the information. This is not quite carte blanche, however. Before information can be used or disclosed, the covered entity must obtain written documentation of a waiver of individual authorization approved by either an Institutional Review Board (IRB) or a "privacy board." This requirement would apply to all research for which a covered entity serves as a conduit of protected health information, regardless of funding source. IRBs were established to carry out comprehensive evaluations of federally-funded research with human subjects, pursuant to the body of regulations known as the "Common Rule." A privacy board would be constituted for narrower purposes. Like an IRB, a privacy board would be required to have members with varying backgrounds and appropriate professional competency, include at least one member who is not affiliated with the entity conducting the research or related to a person who is affiliated with such entity, and exclude members from participating in review of any project in which they have a conflict of interest. In connection with each research protocol, an IRB or privacy board would have to determine that waiver of authorization from subjects satisfies a number of criteria. Expedited review would be possible in appropriate cases.

Stepping back, many privacy advocates are troubled by the absence of any control on the part of subjects over the research use of their individually identifiable health information. Although research studies involving the collection and analysis of such information have led to improvements in health, arguably, these benefits do not justify a system that dispenses with even the minimal protection of a provision that allows individuals to "opt-out" by restricting use of their individually identifiable health information in research. Given the arguments HHS itself offers in favor of privacy protection, and the offensiveness of conscripting individuals to participate in research, many believe the burden should be on researchers to provide evidence that an "opt-out" provision would be a significant barrier to the conduct of important research. Placed in the context of a brief explanation of the benefits of research using health information, the principle of "minimum necessary disclosure" (found in subsection 164.506(b)) and the safeguards in place to ensure that individually identifiable health information is disclosed to researchers is not misused, notice of a right to restrict research use should increase public confidence in research.

Some of the finer points addressed in the draft regulations and accompanying preamble may also be of interest to researchers and (potential) research subjects. Section II.B.19 of the preamble discusses some possible exceptions to the restriction on re-identification of health information under subsection 164.506(d). One of the examples concerns research: "[I]f a researcher received de-identified information from a covered entity and the research revealed that a particular patient was misdiagnosed, the covered entity should be permitted to re-identify the patient’s health information so that the patient could be informed of the error and seek appropriate care." The preamble also stresses that the regulations establish a floor rather than a ceiling: "Researchers and others can and are encouraged to continue to use more stringent approaches to protecting information."

Subsection 164.506(f) would extend privacy protections for two years after death, but there is an exception for uses and disclosures for research purposes. Currently, deceased persons do not enjoy protection under the Common Rule, because the definition of "human subject" refers to "living" persons. The drafters of the regulations propose the research exception to subsection 164.506(f) in order to ensure consistency with the Common Rule, while noting that the Common Rule is itself under review by HHS. Section 164.506(g) would give changes in information practices retrospective as well as prospective effect, meaning that a covered entity that had given notice of a "no research disclosures" policy could change that policy, and following notice of the change, could provide researchers with information collected while the original policy was in force. See II.C.7 of the preamble.

Subsection 164.508(a)(iii) would create an exception to the general rule against coerced consent—that a covered entity may not condition treatment or payment on the provision by the individual of a requested authorization for use or disclosure of protected health information—for authorizations requested in connection with clinical trials. There is also a clinical trial exception to the rule that an authorization for use or disclosure for purposes other than treatment or payment must be separate from an authorization for or consent to use or disclosure for treatment or payment. Another significant feature of section 164.508 is the recognition of two special categories of information: psychotherapy notes and research information unrelated to treatment. Information in either category could only be used or disclosed with individual authorization. Research information unrelated to treatment refers to health information received or created in the course of conducting research, for which there is insufficient scientific and medical evidence regarding the validity or utility of the information such that it should not be used for the purpose of providing health care, and with respect to which the covered entity has not requested payment from a third party payor. Subsection II.C.1.d of the preamble states that this requirement would not prohibit the covered entity that creates the information from using it for the intended research purpose.

Finally, section 164.514 would establish that individuals have a right to inspect and obtain a copy of protected health information, subject to a small number of exceptions. One concerns clinical trials, which may be "blinded," meaning subjects do not know whether they are receiving an experimental treatment or standard therapy (or a placebo). Where the individual agreed to a denial of access to the information when consenting to participate in a clinical trial (if the individual’s consent to participate was obtained) and the clinical trial is still in progress, information could be withheld.

Researchers and privacy advocates are sure to disagree over whether HHS strikes the appropriate balance between protecting individual rights and promoting socially beneficial research. All sides should, however, agree upon the advantages of uniform standards and clearer lines of accountability. On November 10, the Agency for Health Care Policy and Research announced that it will develop "guiding national principles" to assist IRBs and privacy boards, building on the findings of an Institute of Medicine study scheduled for completion in the summer of 2000.