Many other commenters agreed that
the research use and disclosure should not require authorization, but disagreed with the proposed rule's approach and proposed alternative models.
In the final rule we retain identical use and disclosure requirements for
research uses and disclosures of protected health information by covered entities.
Of these commenters, many supported the proposed rule's approach to
research uses and disclosures without authorization, including many from health care provider organizations, the mental health community, and members of Congress.
These ethical principles formed the foundation for the requirements in the Common Rule, on which our proposed requirements for
research uses and disclosures were modeled.
We understand that some covered health care providers and health plans may conclude that the rule's documentation requirements for
research uses and disclosures are too burdensome.
Therefore, we believe it would not be within the scope of the final rule to require informed consent as stipulated by the Common Rule for
research uses and disclosures of protected health information.
Not exact matches
Patrick Ruffini, a co-founder Echelon Insights, a Republican - leaning digital analytics
and research firm, said the public outrage this week over the
disclosures about Cambridge Analytica «feels like a double standard» against the backdrop of how the Obama campaign
and other Democratic
and Republican political operatives sought to
use Facebook data during the 2012
and 2014 election cycles.
The group called for more epidemiological
research and disclosure of chemicals
used in drilling.
With the growing
use of mastectomy, fueled by celebrity
disclosures and growing patient interest, further
research is necessary to monitor whether the short - term employment consequences seen in this study will translate into longer term impacts on these women's employment
and well - being, say the study authors.
I think more
research and disclosure is needed from both parties,
and like I said, I hope that all of us in the real food community will
use this as an opportunity to improve, learn more,
and get to the truth,
and not as an excuse to argue
and divide.
Dr. Mann's results have been extensively applied in climate
research and have been
used for public policy in Canada
and internationally,
and, in our opinion, there is no justification for anything other than the most comprehensive possible
disclosure.
109 See Hazelwood, supra note 19, at 286 — 89 (listing a number of ethical issues surrounding email that legal writing courses could raise, including third - party access / interception, metadata, data retention,
and inadvertent
disclosure); Dragnich, supra note 36 at 15 (discussing how an email assignment could include lessons about confidentiality, attorney - client privilege,
and «contemporary issues such as information security
and removal of metadata prior to transmitting documents»); Tracy Turner, E-mail Etiquette in the Business World, 18 No. 1 Persps.: Teaching Legal
Research & Writing 18, 19 — 20 (2009)(discussing ethical
and professional email issues, including when to
use email versus other forms of communication, forwards
and replies,
and CC
and BCC
use); see also Shapo, supra note 3, at 345 («If you are forwarding a message to another attorney, for example, check that there is nothing in the thread that is not for the eyes of that recipient.
While most civil privacy claims relate to claims of improper
disclosure, the plaintiffs here objected to the unauthorized retention
and use of personal information — specifically, the retention of newborn blood samples for medical purposes
and (secondary)
research purposes that were not disclosed at the time of collection.
To uphold the bargain, with respect to each invention in question, the description in the patent must enable the skilled person to produce the invention
using only the instructions contained in the
disclosure,
and without even a minor
research project.
For example, a covered health care provider that had a treatment relationship with an individual prior to the individual's enrollment in a clinical trial, but that is now providing
research - related treatment to the individual, may elect to request a compound authorization from the individual: an authorization under § 164.508 (d) for the provider to
use the protected health information it created prior to the initiation of the
research that involves treatment, combined with an authorization under § 164.508 (f) regarding
use and disclosure of protected health information the covered provider will create for the purpose of the clinical trial.
To avoid this unintended result, the final rule permits covered health care providers
and health plans to
use or disclose protected health information for research if the covered entity obtains from the researcher representations that: (1) Use or disclosure is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research; (2) no protected health information is to be removed from the covered entity by the researcher in the course of the review; and (3) the protected health information for which use or access is sought is necessary for the research purpos
use or disclose protected health information for
research if the covered entity obtains from the researcher representations that: (1)
Use or disclosure is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research; (2) no protected health information is to be removed from the covered entity by the researcher in the course of the review; and (3) the protected health information for which use or access is sought is necessary for the research purpos
Use or
disclosure is sought solely to review protected health information as necessary to prepare a
research protocol or for similar purposes preparatory to
research; (2) no protected health information is to be removed from the covered entity by the researcher in the course of the review;
and (3) the protected health information for which
use or access is sought is necessary for the research purpos
use or access is sought is necessary for the
research purposes.
Uses and disclosures that would have been permitted without individual authorization included uses and disclosures for national priority purposes such as public health, law enforcement, and research (see proposed § 164.510) and uses and disclosures of protected health information, other than psychotherapy notes and research information unrelated to treatment, for purposes of treatment, payment, and health care operations (see proposed § 164.5
Uses and disclosures that would have been permitted without individual authorization included
uses and disclosures for national priority purposes such as public health, law enforcement, and research (see proposed § 164.510) and uses and disclosures of protected health information, other than psychotherapy notes and research information unrelated to treatment, for purposes of treatment, payment, and health care operations (see proposed § 164.5
uses and disclosures for national priority purposes such as public health, law enforcement,
and research (see proposed § 164.510)
and uses and disclosures of protected health information, other than psychotherapy notes and research information unrelated to treatment, for purposes of treatment, payment, and health care operations (see proposed § 164.5
uses and disclosures of protected health information, other than psychotherapy notes
and research information unrelated to treatment, for purposes of treatment, payment,
and health care operations (see proposed § 164.506).
The NPRM would have permitted the
use and disclosure of protected health information of deceased persons for
research without the authorization of a legal representative,
and without the requirement for written documentation of IRB or privacy board approval in proposed § 164.510 (j).
In addition, several commenters asserted that the need for distinguishing
research information unrelated to treatment from other forms of protected health information was not necessary because the proposed rule's general restrictions for the
use and disclosure of protected health information
and the existing protections for
research information were sufficiently strong.
Under the NPRM, the covered entity could have created such a board
and could have relied on it to review
research proposals for
uses and disclosures of protected health information for
research.
Several commenters further recommended that only the following
uses and disclosures be permitted for
research information unrelated to treatment without authorization: (1) For the oversight of the researcher or the
research study; (2) for safety
and efficacy reporting required by FDA; (3) for public health; (4) for emergency circumstances; or (5) for another
research study.
The only proposed exception to this standard allowed for
uses and disclosures of a decedent's protected health information for
research purposes without the authorization of a legal representative
and without the Institutional Review Board (IRB) or privacy board approval required (in proposed § 164.510 (j)-RRB- for most other
uses and disclosures for
research.
Comment: Some commenters explicitly opposed requiring contracts between covered entities
and researchers as a condition of permitting the
use or
disclosure of protected health information for
research purposes.
The intent of this provision is to permit covered entities that conduct
research involving treatment to bind themselves to a more limited scope of
uses and disclosures of
research information than they would otherwise be permitted to make with non-
research information.
The final rule requires at § 164.512 (i)(1)(iii) that covered entities obtain from the researcher (1) representation that the
use or
disclosure is sought solely for
research on the protected health information of decedents; (2) documentation, at the request of the covered entity, of the death of such individuals;
and (3) representation that the protected health information for which
use or
disclosure is sought is necessary for the
research purposes.
They commented that the same concerns regarding
use and disclosure of genetic
and hereditary information for other purposes apply in the
research context.
We believe that the our proposed requirements for the
use or
disclosure of protected health information for
research are consistent with the ethical principles of «respect for persons,» «beneficence,»
and «justice,» which were established by the Belmont Report in 1978,
and are now accepted as the quintessential requirements for the ethical conduct of
research involving human subjects, including
research using individually identifiable health information.
Response: Although we share the concern raised by commenters that the option for the documentation of privacy board approval for an alteration or waiver of authorization may perpetuate the unequal mechanisms of protecting the privacy of human
research subjects for federally - funded versus publically - funded
research, the final rule is limited by HIPAA to addressing only the
use and disclosure of protected health information by covered entities, not the protection of human
research subjects more generally.
To the extent the entity includes
uses or
disclosures in the
research authorization that are otherwise not permissible under the rule
and the entity's consent
and notice of information practices, the entity must include all of the elements required by § § 164.508 (c)
and (d) in the
research - related authorization.
The following are examples of valid compound authorizations: an authorization for the
disclosure of information created for clinical
research combined with a consent for the
use or
disclosure of other protected health information to carry out treatment, payment,
and health care operations,
and the informed consent to participate in the clinical
research; an authorization for
disclosure of psychotherapy notes for both treatment
and research purposes;
and an authorization for the
disclosure of the individual's demographic information for both marketing
and fundraising purposes.
In addition, for the
use and disclosure of protected health information created by a covered entity for the purpose, in whole or in part, of
research that includes treatment of the individual, the covered entity must meet the requirements of § 164.508 (f).
Moreover, a covered entity doing
research, or another entity requesting
disclosure of Start Printed Page 82771protected health information for
research that is not currently subject to IRB review (
research that is 100 percent privately funded
and which takes place in institutions which do not have «multiple project assurances») may need to seek IRB or privacy board approval if they want to avoid the requirement to obtain authorization for
use or
disclosure of protected health information for
research, thereby creating the need for additional IRBs
and privacy boards that do not currently exist.
They argued that fewer allowable
disclosures should be permitted for
research information because the clinical utility of the
research information is most often unknown,
and thus, it is unsuitable for
use in clinical decision making.
Specifically, the final rule requires that the covered entity obtain representation that the
use or
disclosure is sought solely for
research on the protected health information of decedent,
and representation that the protected health information for which
use or
disclosure is sought is necessary for the
research purposes.
In the final rule, we eliminate the special rules for this category of information
and, instead, require covered entities to obtain an authorization for the
use or
disclosure of protected health information the covered entity creates for the purpose of
research that includes treatment of individuals, except as otherwise permitted by § 164.512 (i).
(i) Standard:
Uses and disclosures for
research purposes.
One contract specifies that the issuer may
use and disclose protected health information about the participants in the group health plan for
research purposes without authorization (subject to the requirements of this rule)
and one contract specifies that the issuer must always obtain authorizations for these
uses and disclosures.
A study with such a purpose would meet the rule's definition of
research,
and use or
disclosure of protected health information would have to meet the requirements of § § 164.508 or 164.512 (i).
(f) Implementation specifications: Authorizations for
uses and disclosures of protected health information created for
research that includes treatment of the individual.
For such
uses and disclosures of protected health information, the final rule requires that the covered entity obtain from the researcher representations that
use or
disclosure is sought solely to review protected health information as necessary to prepare a
research protocol or for similar purposes preparatory to
research, no protected health information is to be removed from the covered entity by the researcher in the course of the review,
and the protected health information for which
use or access is sought is necessary for the
research purposes.
We retain the exception for
uses and disclosures for
research purposes, now part of § 164.512 (i), but also require that the Start Printed Page 82500covered entity take certain verification measures prior to release of the decedent's protected health information for such purposes (see § § 164.514 (h)
and 164.512 (i)(1)(iii)-RRB-.
The intent of this provision is to permit covered entities that participate in
research to bind themselves to a more limited scope of
uses and disclosures for all or identified subsets of
research information generated from
research that involves the delivery of treatment than it may apply to other protected health information.
Comment: Many of the comments supported the proposed rule's provision that would have imposed the same requirements for both
research uses and research disclosures of protected health information.
The proposed requirements established conditions for the
use of protected health information by covered entities for
research and the
disclosure of protected health information by covered entities to researchers.
For
research that relies on the
use or
disclosure of protected health information by covered entities without authorization, the final rule applies the Common Rule's principles for protecting
research subjects by, in most instances, requiring documentation of independent board review,
and a finding that specified criteria designed to protect the privacy of prospective
research subjects have been met.
The final rule retains the NPRM's proposed framework for permitting
uses and disclosures of protected health information for
research purposes, although we are making several important changes for the final rule.
To the extent that the entity limits itself to a subset of
uses or
disclosures that are otherwise permissible under the rule
and the entity's notice, the entity is bound by the statements made in the
research authorization.
The new § 164.512 includes paragraphs on:
Uses and disclosures required by law; uses and disclosures for public health activities; disclosures about victims of abuse, neglect, or domestic violence; uses and disclosures for health oversight activities; disclosures for judicial and administrative proceedings; disclosures for law enforcement purposes; uses and disclosures about decedents; uses and disclosures for cadaveric donation of organs, eyes, or tissues; uses and disclosures for research purposes; uses and disclosures to avert a serious threat to health or safety (which we had called «emergency circumstances» in the NPRM); uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM); and disclosures to comply with workers» compensation l
Uses and disclosures required by law;
uses and disclosures for public health activities; disclosures about victims of abuse, neglect, or domestic violence; uses and disclosures for health oversight activities; disclosures for judicial and administrative proceedings; disclosures for law enforcement purposes; uses and disclosures about decedents; uses and disclosures for cadaveric donation of organs, eyes, or tissues; uses and disclosures for research purposes; uses and disclosures to avert a serious threat to health or safety (which we had called «emergency circumstances» in the NPRM); uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM); and disclosures to comply with workers» compensation l
uses and disclosures for public health activities;
disclosures about victims of abuse, neglect, or domestic violence;
uses and disclosures for health oversight activities; disclosures for judicial and administrative proceedings; disclosures for law enforcement purposes; uses and disclosures about decedents; uses and disclosures for cadaveric donation of organs, eyes, or tissues; uses and disclosures for research purposes; uses and disclosures to avert a serious threat to health or safety (which we had called «emergency circumstances» in the NPRM); uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM); and disclosures to comply with workers» compensation l
uses and disclosures for health oversight activities;
disclosures for judicial
and administrative proceedings;
disclosures for law enforcement purposes;
uses and disclosures about decedents; uses and disclosures for cadaveric donation of organs, eyes, or tissues; uses and disclosures for research purposes; uses and disclosures to avert a serious threat to health or safety (which we had called «emergency circumstances» in the NPRM); uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM); and disclosures to comply with workers» compensation l
uses and disclosures about decedents;
uses and disclosures for cadaveric donation of organs, eyes, or tissues; uses and disclosures for research purposes; uses and disclosures to avert a serious threat to health or safety (which we had called «emergency circumstances» in the NPRM); uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM); and disclosures to comply with workers» compensation l
uses and disclosures for cadaveric donation of organs, eyes, or tissues;
uses and disclosures for research purposes; uses and disclosures to avert a serious threat to health or safety (which we had called «emergency circumstances» in the NPRM); uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM); and disclosures to comply with workers» compensation l
uses and disclosures for
research purposes;
uses and disclosures to avert a serious threat to health or safety (which we had called «emergency circumstances» in the NPRM); uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM); and disclosures to comply with workers» compensation l
uses and disclosures to avert a serious threat to health or safety (which we had called «emergency circumstances» in the NPRM);
uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM); and disclosures to comply with workers» compensation l
uses and disclosures for specialized government functions (referred to as «specialized classes» in the NPRM);
and disclosures to comply with workers» compensation laws.
(ii) If the consent, authorization, or other express legal permission obtained from an individual is a general consent to participate in the project,
and a covered entity is conducting or participating in the
research, such covered entity may, with respect to protected health information that it created or received as part of the project before or after the applicable compliance date of this subpart, make a
use or
disclosure for purposes of that project, provided that the covered entity complies with all limitations placed by the consent, authorization, or other express legal permission obtained from an individual.
With regard to
uses and disclosures for
research, the researcher must provide covered entities with appropriate documentation of proof of death, the burden is not on the covered entity.