Report of Subcommittee on Harmonization

1. Report of Subcommittee on Harmonization Recommended Comment on HITECH Notice of Proposed Rulemaking David Forster, JD Mark Barnes, JD, LLM Susan Stayn, JD October 19, 2010

2. Why Comment? • History of SACHRP leadership on the need to harmonize HIPAA privacy requirements with federal research regulations • 2004 SACHRP recommendations to Secretary • Significant developments in HITECH that directly affect the research enterprise and merit attention • Value of clarifications to promote consistent interpretation across research entities • Direction to individual institutions, sponsors, sites in multi-center clinical trials, data bank directors & others

3. SOH Process of Developing Recommended Comment • July 2010: NPRM issued • August 2010: SOH discussion of proposed new rules and interpretations in NPRM that affect research • September 2010: SOH discussions of research-related proposals; identification of priority areas; development of comments; group review and revision of comments • October 2010: SOH recommended comment to SACHRP for consideration

4. Five Topics • Compound authorizations • Future/secondary research • Minimum necessary standard • Business associates • Restrictions on the sale of protected health information (PHI)

5. Compound Authorizations • Scenario: Principal Investigator is conducting clinical trial and would like to bank specimens that remain after the trial • Current rule: Need two completely separate HIPAA authorizations: one for the clinical trial PHI, and one for banking PHI • NPRM: Would allow one joint HIPAA authorization to include permission for handling clinical trial and banking PHI • Accepts SACHRP’s recommendation from 2004 • Supports harmonization goal

6. Compound Authorization Recommended Comments: • Support the proposal, with its harmonization goal • Clarify when this applies (outside of a clinical trial with banking option) • For example, one study and related sub-study should be able to use a joint HIPAA authorization for both studies • Support proposal to give entities flexibility in implementation • 3 models offered, with request to confirm acceptability • Confirm proposal does not affect use of waivers of authorization, so that waivers continue to be available

7. Compound Authorization Recommended Comments: • Clarify effect of revoking one part of the combined authorization • Recommend that HHS engage in ongoing dialogue with covered entities on best practices to satisfy new rule • Clarify timing of compliance & approaches for approved, ongoing studies and new studies

8. Future/Secondary Research • Scenario: Principal Investigator requests informed consent to secondary research; this is allowed by the Common Rule • Current interpretation: HIPAA authorization cannot cover future/secondary research, but can only relate to a specific study • This is a fundamental discontinuity between CR and HIPAA • NPRM: New interpretation would allow an authorization for future/secondary research • Accepts SACHRP’s recommendation from 2004 • Supports harmonization goal

9. Future/Secondary Research Recommended Comments: • Support the proposal, with its harmonization goal • Consistent with informed consent under the Common Rule, an authorization should be reasonably specific such that individuals are aware of the types of future or secondary research that may be conducted • Clarify flexibility of existing authorization requirements, when applied to future research • Request consultation with FDA to determine if consent/authorization to future research meets FDA consent standards

10. Future/Secondary Research • Grandfather existing, ongoing studies that involve possible future research, if IRB-approved consent reasonably informed individuals of how their health information could be used or shared • Clarify timing of compliance and permissible approaches for new studies

11. Minimum Necessary Standard Recommended comment: • As HHS develops required guidance on the minimum-necessary standard, support the flexibility of the existing standard as it applies to research

12. Business Associates • Scenario: An academic medical center decides to use an external IRB for research review, approval, and continued oversight. Is the external IRB a business associate? Recommended comment: • Clarify that external IRB is not a business associate • Harmonization goal: federal policy is encouraging the use of central IRBs; a business associate requirement for use of external IRBs could complicate and deter use of such IRBs

13. No Sale of PHI/Research Exception • HITECH: A covered entity or business associate cannot receive direct or indirect remuneration in exchange for disclosing protected health information, without authorization • HITECH research exception: A covered entity may receive a reasonable, cost-based fee to cover costs of preparing and transmitting information for research purposes

14. No Sale of PHI/Research Exception • Recommended comment: Clarify how this applies in practice • Scenario: A covered entity discloses protected health information to a business associate that performs quality benchmarking services. The business associate asks for the right to use the information to create “limited data sets” and to make those available to third parties for separate, unrelated research, for a fee payable to that business associate.

15. Conclusion • Harmonization is important in principle and in practice • SOH recommends that SACHRP support several proposals in the NPRM, and request clarification or confirmation with respect to select topics • SOH respectfully recommends that SACHRP submit the proposed comments to the Office for Civil Rights