"Exempt" Research after the Privacy Rule

Abstract

he Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) restricts the ways in which (health care providers that transmit health electronically in connection with certain covered transactions, health plans, and healthcare clearinghouses) can use and disclose protected health information (PHI) for purposes. Covered entities may not use or disclose PHI for purposes except as follows: (1) with the authorization of each subject; (z) after an IRB or privacy board approves a waiver of authorization; (3) for reviews preparatory to (e.g., to assess the feasibility of a study); (4) for on the PHI of decedents; (5) as part of a limited data set (stripped of the direct identifiers); or (6) where the data are de-identified under HIPAA's standards. As of HIPAA's compliance date, April 14, zoo3, covered entities conducting research (which is given the same meaning under HIPAA as under the Common Rule) must be in compliance with HIPAA's requirements in addition to existing federal and state laws and regulations. HIPAA's transition provisions address the applicability of the regulations to studies that have enrolled subjects both before and after HIPAA's compliance date (45 CFR 164.532). A covered entity may continue to use or disclose PHI from subjects enrolled in a study prior to HIPAA's compliance date assuming that, prior to April 14, 2oo3, the covered entity obtained (1) informed consent from the subjects to participate in the study, (2) IRB waiver of informed consent, or (3) other express legal permission from the subjects to use or disclose the PHI for the study. No additional HIPAA authorization or IRB waiver of the authorization requirement is required in order for the covered entity to continue to use or disclose PHI from these subjects who were enrolled prior to April 14, zoo3, unless the subjects are re-consented after the compliance date. Subjects who are enrolled after April 14, zoo3 will be required to give an authorization that meets HIPAA's requirements in addition to informed consent to participate in the study, unless the IRB granted waiver of informed consent prior to April 14, zoo3 (in which case the entire study is grandfathered after April 14, zoo3, unless circumstances change and the investigator is subsequently required to obtain informed consent from subjects enrolled after the compliance date). Under the Common certain types of are from the Common Rule's requirements. For example, is exempt from the regulatory requirements if it involves the study of existing data and the is recorded by the investigator in such a manner that subjects cannot be identified, either directly or through identifiers linked to the subjects. Yet ongoing that is exempt from the Common Rule is not necessarily exempt from the requirements of HIPAA, because of a glitch in the transition rules. Research that is determined to be exempt from the Common Rule's requirements does not require subject informed consent or IRB waiver of informed consent because it is, by definition, outside of the Common Rule's requirements. As a result, for exempt studies that straddle HIPAA's compliance date, there is generally no basis to invoke HIPAA's transition provisions and grandfather-in subjects who were enrolled prior to April 14, zoo3. It is therefore critical that covered entities like hospitals and academic medical centers identify all on-going exempt as soon as possible and obtain subject authorization, or IRB waiver of authorization, for subjects enrolled prior to HIPAA's compliance date. Otherwise, the use or disclosure of such subjects' PHI for purposes of the study should cease immediately. This diligence has been accomplished in many hospitals and institutions by sending a memorandum to all investigators asking them to identify any ongoing that is exempt from IRB review, the date Mark Barnes and Katherine E. Gallin, 'Exempt' Research after the Privacy Rule, IRB: Ethics & Human Research 25, no. 4 (200oo3): 5-6.