Publications

Introduction

Recent federal privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) will have a significant impact on how research institutions and hospitals (collectively “research institutions”) use and distribute certain information acquired in the course of conducting a clinical trial. While the HIPAA privacy regulations will not be enforced until the HIPAA compliance date in April 2003, pharmaceutical industry sponsors of clinical research should begin assessing the impact of HIPAA on their relationships with research institutions that conduct clinical trials on their behalf.

HIPAA prohibits covered entities (as defined by HIPAA) from using or disclosing individually identifiable health information (protected health information or PHI) without satisfying HIPAA’s requirements. Although sponsors of research may not be covered entities, research institutions generally will be covered entities subject to HIPAA. (For purposes of this discussion, we have assumed that sponsors are not covered entities.) Sponsors rely on research institutions to obtain for the sponsor the right to use and disclose the clinical data created or acquired during the clinical trial. Accordingly, sponsors should take a proactive approach when negotiating clinical trial agreements with research institutions to ensure that the data generated and disclosed in clinical trials is properly disclosed to, and may be appropriately used by, the sponsor.

HIPAA includes transition provisions (as discussed below) that address use and disclosure issues related to clinical trials that are ongoing as of the HIPAA compliance date. Specifically, sponsors and research institutions may wish to allocate responsibility for obtaining the necessary consents and authorizations for the use and disclosure of clinical trial data.

The Need for an Authorization to Use and Disclose Subjects’ PHI When Conducting Clinical Trials

Research institutions are required to obtain an informed consent form (ICF) from a subject when he or she agrees to participate in a clinical trial. Under HIPAA, when a research institution conducts a clinical trial that includes treatment of subjects, the research institution must obtain an authorization from the subject that permits both the disclosure of the subject’s PHI to the sponsor and the sponsor’s use of the subject’s PHI (Authorization).

Because most clinical trials include treatment, research involving clinical trials generally will require an Authorization. Currently, many sponsors provide a template ICF for each clinical trial; a proactive response to HIPAA suggests that sponsors may wish to provide a template Authorization along with the ICF to ensure that each research subject has properly authorized the sponsor’s receipt and use of the data generated and acquired in the clinical trial, such as the subject’s chart, prior labs, surgical history, etc. The Authorization may, but need not, be combined with the ICF.

The Authorization must be written in plain language and must satisfy specific requirements in the HIPAA privacy regulations. The Authorization for research involving treatment must: 1) describe the extent to which the PHI will be used or disclosed for treatment, payment, or healthcare operations; 2) describe any additional restrictions on the use or disclosure of PHI to be adhered to by the research institution beyond what is required under HIPAA (except that certain disclosures, including those required by law or necessary to avert a threat to health or safety may not be restricted); 3) refer to any applicable consent and/or privacy notice given to the subject and clearly state that the Authorization is binding; and 4) disclose, if applicable, that a financial benefit was given to the research institution by the sponsor in exchange for disclosure of the subject’s PHI to the sponsor.

Exceptions to the Authorization Requirement

There are two relevant exceptions to the requirement for an Authorization. First, research may be performed without an Authorization using health information that has been “de-identified” in accordance with HIPAA. HIPAA lists eighteen specific identifiers, including birth date, admission date, discharge date, and social security number, which must be removed from the health information to be considered “de-identified.” Given the kind of information necessary to make valid conclusions about the safety or efficacy of an investigational drug, it is unlikely that a sponsor could effectively conduct a clinical trial without such identifiers. Accordingly, despite an exception from the Authorization requirement for de-identified data, in most instances an Authorization will be necessary.

Second, research institutions may use or disclose PHI without an Authorization for research not involving treatment in the following situations (provided that detailed criteria and documentation requirements are met): 1) an IRB or privacy board has approved the waiver of the Authorization; 2) the purpose is to prepare a research protocol or other research preparation; or 3) the research involves PHI of decedents. Because most clinical trials involve treatment, these exceptions to the Authorization requirement are of limited relevance to sponsors.

Research Subject Access to PHI

HIPAA provides patients, including subjects receiving treatment as part of a clinical trial, with the right to access their PHI. Pursuant to a special exception under HIPAA, however, the research institution may temporarily suspend a subject’s right to access their PHI for as long as the research is in progress. To impose this exception, the subject must have previously agreed to the denial of access at the time he or she agreed to participate in the clinical trial and must have been informed that the right of access will be reinstated upon the completion of the research. Research into an investigational drug may continue long after the conclusion of a particular clinical trial, and the results of one trial may be combined with other studies for meta-analysis; thus, it is unclear when a subject would be entitled to access his records. It is also uncertain how this provision will affect subject access to randomization information. Sponsors should consider this issue when drafting the template ICF and Authorization.

Revocation of Authorization

Subjects may revoke their Authorization at any time. Research institutions are permitted under HIPAA to condition the provision of research-related treatment on the provision of an Authorization that meets the requirements for research that includes treatment. Once a subject is no longer receiving research-related treatment, however, the subject may revoke his or her Authorization. Some commentators have suggested that sponsors might be able to contractually obligate subjects, who were compensated for their participation in a clinical trial, to agree not to revoke the Authorization for use and disclosure of their PHI. HIPAA does not address whether this is permissible. It is also unclear whether an IRB or privacy board could waive the Authorization requirement in response to a subject’s revocation.

Conclusion

The transition provisions of HIPAA address the use and disclosure of subjects’ PHI in clinical trials that are ongoing as of the HIPAA compliance date. Under these provisions, research institutions are not required to obtain an Authorization from subjects that were enrolled in a clinical trial before the HIPAA compliance date, provided that the subject gave express legal permission to use and disclose his or her PHI for purposes of the clinical trial. Sponsors may rely on a research institution’s representation that it obtained the appropriate permission to use and disclose each subject’s PHI. Research institutions must obtain an Authorization from subjects enrolled in a clinical trial after the HIPAA compliance date. Sponsors should take action now to address the impact of HIPAA on research institutions when drafting their clinical trial agreements to ensure access to, and use of, subjects’ PHI.

www.fdli.org