5/19/2011
1
Tissue Issues
Kristen Rosati, JDKristen Rosati, JDKristen Rosati, JDKristen
Rosati, JDCoppersmith Schermer & Brockelman PLC
David Vulcano, David Vulcano, David Vulcano, David Vulcano,
LCSW, MBA, CIP, RAC LCSW, MBA, CIP, RAC LCSW, MBA, CIP, RAC LCSW,
MBA, CIP, RAC AVP & Responsible Executive, Clinical
Research
Clinical Services Group | HCA
HCCA Research Compliance ConferenceJune 14, 2011
Session Overview
Anticipated changes to the HIPAA Privacy Rule to implement the
HITECH Act and the Genetic Information Nondiscrimination Act
NCI Best Practices for Biospecimen Resources
Ethical Issues And Public Opinion of Whats Legal
Reference slides:
IRB review and human subject protection
HIPAA compliance
2
5/19/2011
2
Office for Civil Rights HIPAA Compliance
Proposed amendments to the HIPAA rules to implement the HITECH
Act*: 75 Fed. Reg. at 40868 (July 14, 2010)
Comments closed September 13, 2010
Final regulations anticipated during the first half of 2011
OCR will not enforce the new regulations until 180 days after
the effective date of the final regulations
*American Recovery and Reinvestment Act of 2009 (ARRA)
--Division A, Title XIII and Division B, Title IV: Health
Information Technology for Economic and Clinical Health Act (HITECH
Act)
4
Authorization for future research The OCR sought comment on
whether and how to change its interpretation that an authorization
may not seek permission for use in unspecified future research
Options considering:
Permitting, if authorization adequately describes future
research
Permitting, with certain required elements or statements
Permitting, with limits on sensitive research areas, such as
genetic or mental health research
Working with OHRP on consistency with Common Rule
Research Authorizations
5/19/2011
3
5
Compound authorizations Proposed rule would permit compound
authorizations, which combine authorization for a clinical trial
and authorization to contribute PHI to a research repository, as
long as the form provides the individual with an opportunity opt-in
to the research repository
[Proposed 45 CFR 164.508(b)]
Potential problem:
Opt-in will reduce participation in research repositories
Research Authorizations
6
Current rule: CE may receive payment for a disclosure of PHI
where that disclosure is permitted by the regulations (such as for
research)
HITECH Act prohibits indirect or direct receipt of remuneration
in exchange for a disclosure of PHI without the individuals
authorization (with exceptions) Proposed rule would prohibit
indirect or direct remuneration in exchange for a disclosure of PHI
without authorization (with exceptions on the next slide)
Remuneration is not defined-- will it include non-financial
remuneration?
[HITECH Act 13405(d); Proposed 45 CFR 164.508]
No Sale of PHI
5/19/2011
4
7
For public health purposes
For research, where the only remuneration received by the
covered entity is a reasonable cost-based fee to cover the cost to
prepare and transmit the PHI
For treatment and payment
For the sale, transfer, merger or consolidation of the covered
entity and related due diligence
To or by a business associate to perform activities for the
covered entity, where the only remuneration provided is by the
covered entity to the business associate for the performance of
such activities
To an individual for access or accounting
Where required by law to disclose PHI
Where the only remuneration received is a reasonable cost-based
fee to cover the cost to prepare and transmit the PHI, or a fee is
otherwise expressly permitted by another law
[Proposed 45 CFR 164.508]
No Sale of PHI-- Exceptions
8
Rule does not apply to disclosures of PHI for research under
164.512(i) (the general rule on research disclosures) or 164.514(e)
(disclosures of a Limited Data Set for research), where the only
remuneration received by the covered entity is a reasonable
cost-based fee to cover the cost to prepare and transmit the [PHI]
for such purposes.
What is a reasonable cost-based fee? Comments urged OCR to allow
organizations to recoup investment and other indirect costs in the
fees they charge for PHI
Not permitting recoupment of a wide range of costs may be an
unconstitutional taking of property
Who will determine the appropriate amount and how will that be
done?
No Sale of PHI Research Exception
5/19/2011
5
9
Rule did not create an exception for:
Disclosure of research results
Disclosure of Limited Data Sets
LDS expressly added to research and public health exceptions
Quality assurance/ performance improvement activities
Section 13405(d)(2)(G) of the HITECH Act provides authority to
the OCR to make additional exceptions for disclosures of PHI that
the OCR judges to be similarly necessary and appropriate as the
other enumerated statutory exemptions to the sale of PHI
No Sale of PHI Research Exception
10
No grandfather provision
Past grandfather provision permitted use of PHI to continue if
the informed consent/waiver obtained before HIPAA was valid under
pre-HIPAA law
No Sale of PHI Research Exception
5/19/2011
6
11
BAAs required if have third party de-identify PHI or create
Limited Data Set
BAAs not required to disclose PHI for research on behalf of the
covered entity, because research is not a covered function under
HIPAA
The OCR has clarified informally that this applies beyond
disclosure to the researcher, and also encompasses research
management and other services
Business Associate Agreements in Research
12
Add organizations that provide patient safety activities listed
at 42 CFR 3.20 (to implement the Patient Safety and Quality
Improvement Act)
Add Health Information Organizations, e-prescribing gateways, or
other persons that provide data transmission or other persons that
provide data transmission or other persons that provide data
transmission or other persons that provide data transmission
services, services, services, services, which transmit protected
health information (PHI) to a covered entity and require access to
that PHI on a routine basis
Add entities that offer a personal health record to individuals
on behalf of a covered entity
[HITECH Act 13408; proposed 45 CFR 160.103]
Changes to the Definition of Business Associate
5/19/2011
7
13
Proposed rule: Would protect for only 50 years after death
[Proposed 45 CFR 164.502(f)]
Would permit to permit CEs to disclose a decedents PHI to family
members and others who were involved in the care or payment for
care prior to death, unless inconsistent with an expressed
preference of the decedent
This would be a permitted (not required) disclosure, and would
not change the authority of the decedents personal representative
to act on behalf of the decedent
[Proposed 45 CFR 164.510(b)]
Decedents PHI
14
HITECH Act requires HHS to issue guidance on methods for
de-identification of protected health information
OCR March 2010 workshop on de-identification approaches, best
practices for implementation and management of the current
de-identification standard and potential changes to address policy
concerns, see
http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/De-identification/deidentificationworkshop2010.html
Future Changes to De-identification?
5/19/2011
8
15
Genetic Information Is Health Information
Section 105 of the Genetic Information Nondiscrimination Act
requires HHS to revise the HIPAA Privacy Rule to clarify that
genetic information is health information
The Office for Civil Rights (OCR) issued a proposed rule to
implement GINA, at 74 Fed. Reg. 51698 (Oct. 7, 2009): Health
information includes genetic information Genetic information is
defined broadly as including genetic testing of an individual or
the individuals family members, fetuses and embryos held for
assisted reproductive technology, information about the
manifestation of a disease or disorder in family members (i.e.,
family medical history), and any request for or receipt of genetic
services (genetic testing, counseling, education or participation
in genetic research)
16
But Is Genetic Information
Protected Health Information?
The OCR has concluded that genetic information is health
information protected by the Privacy Rule. Like other health
information, to be protected it must meet the definition of
protected health information: it must be individually identifiable
and maintained by a covered health care provider, health plan, or
health care clearinghouse.
5/19/2011
9
17
Is Genetic Information Individually Identifiable?
Definition: Individually identifiable health information is
information that is a subset of health information, including
demographic information collected from an individual, and:
(1) Is created or received by a health care provider, health
plan, employer, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental
health or condition of an individual; the provision of health care
to an individual; or the past, present, or future payment for the
provision of health care to an individual; and
(i) That identifies the individual; or (ii)With respect to which
there is a reasonable basis to believe the information can be used
to identify the individual
18
Is Genetic Information Individually Identifiable?
Under 45 CFR 164.514, a covered entity may determine that health
information is not individually identifiable health information
only if that information is de-identified by:
(1) Obtaining a statistical certification that the risk is very
small that the information could be used, alone or in combination
with other reasonably available information, by an anticipated
recipient to identify an individual who is a subject of the
information; or
(2) Removing all the identifiers (including biometric
identifiers)
5/19/2011
10
19
Is Genetic Information a HIPAA Identifier?
Name; Geographic information below state level; Dates related to
a patient; Age if over 89 (unless aggregated into a single category
of
age 90 and older);
Various number s related to a patient Full-face photographs and
any comparable images; Biometric identifiers, such as fingerprints
Any other unique identifying number, characteristic, or code.
The OCR has not provided guidance on whether genetic information
is a biometric identifier or a unique identifying
characteristic
20
Practical Guidance
Provide enough information in your protocol to support the IRBs
conclusion that the genetic information sought or developed through
a study is not identifiable (and that there is not a reasonable
basis to believe the information can be used to identify an
individual)
-or-
Obtain a statistical certification that the risk is very small
that the information could be used, alone or in combination with
other reasonably available information, by an anticipated recipient
to identify an individual who is a subject of the information
5/19/2011
11
NCI Best Practices for Biospecimen Resources
Background
First issued in 2007 and online at
http://biospecimens.cancer.gov/bestpractices/
Formal draft revisions at
http://biospecimens.cancer.gov/practices/2010bp.asp
Comments closed September 21, 2010
Revisions include:
Revised informed consent and privacy recommendations
Using Its Legal to Justify The Ethical
Its legal.
Think of the good it will produce.
The majority of people are for this kind of research.
Lives saved outweigh the lives lost.
Legality of an activity does not necessarily
make it is ethical.
5/19/2011
12
Legal vs. Ethical Issue?
Not Research With Human
Subjects Research With Human Subjects
Research
Consent
As Ethical
Issue
Research
Consent
As Ethical
and Legal
Issue
Privacy as
Legal and
Ethical
Issue
Privacy as
Legal and
Ethical
Issue
Exempt
(OHRP)
Not
Exempt
Research
Consent
As Ethical
Issue
Privacy as
Legal and
Ethical
Issue
Ethical Questions
Is it appropriate to use data/tissue already gathered but from
means considered unethical? Does using the data/tissue make one an
accessory to the unethical behavior?
What criteria do you use when choosing between one good and
another good?
5/19/2011
13
Even Following The Legal Is Difficult
41% studies using tissue collected for treatment purposes did
not get IRB approval for the study. Not necessarily exempt as only
5% of these used non-identifying samples
When Consent was not obtained 77% non-IRB approved studies used
identified samples
33% IRB approved studies used identified samples
Unclear if Waiver was obtained
By Merz JF, Leonard DG, Miller ER, Science (New York, N.Y.)
[Science], ISSN: 0036-8075, 1999 Mar 12; Vol. 283 (5408), pp.
1647-8; PMID: 10189317
Three Ways That Encourage Unethical Deeds
Direct Encouragement Through Agency Wrongdoing is acknowledged
but getting someone else to do it for you.
Direct Encouragement Through Acceptance Of The Benefit Someone
else (independently) does it and wrongdoing is ignored thus deed is
repeated.
Indirect Encouragement Through The Legitimization Of The
Practice Someone else did it. Wrongdoing is acknowledged but using
the results sends message that will be ok.
Green RM; Bioethics, 2002 Nov; 16 (6): 544-56 (journal article)
ISSN: 0269-9702
PMID: 12474822 CINAHL AN: 2002173514
5/19/2011
14
The Human Embryonic Stem Cell (hESC)Research
Recent History
1996: Dickey-Wicker Amendment: prohibits federal funding of
research in which human embryos are destroyed.
2001: Presidential decree limited funding to only existing
embryonic stem cell lines as of August 9, 2001 (not adult stem
cells).
2007: Executive Order 13435: Expanding Approved Stem Cell Lines
in Ethically Responsible Ways
Required DHHS funding to find alternate methods of derivation of
stem cell research other than destruction of embryos
Focus on perfecting conversion of skin cells into induced
pluripotent stem cells (iPSCs) as alternative
hESC Research Saga (Continued)
2009: Executive Order 13505 Removing Barriers to Responsible
Scientific Research Involving Human Stem Cells Revokes Bushs 2001
limitations and EO 13435
[DHHS] may support and conduct responsible, scientifically
worthy human stem cell research, including human embryonic stem
cell research, to the extent permitted by law.
2009-2010 : Lawsuits Challenging EO13505 US Gvt. Sued by various
parties based on presidential executive order cannot override law
(Dickey-Wicker)
Essentially the court determined institutes using U.S funds to
purchase ESCs from destroyed embryos is undifferentiated from using
U.S. funds to destroy embryos, thus illegal.
5/19/2011
15
2 Lawsuits Challenging E.O.13505
Mary Scott Doe et.al. Vs. Obama
Lower Court Favored Executive Order
2009
James L. Sherley et.al. vs. Kathleen Sibelius in her official
capacity as Secretary of the Department of Health and Human
Services, et al.,
Lower Court Favored Executive Order
2010
Appeals Court Overturned Lower Court,
Subsequent hearing favored plaintiff, imposing a preliminary
injunction halting HHS funding
HHS successfully argued an administrative stay to be able to
continue funding studies while appealing.
2011
Preliminary injunction lifted so funding can continue while in
appeals.
Still In Appeals
Mary Scott Doe et.al. Vs. Obama
Lower Court Favored Executive
Order
Appeals Court Upheld Lower Court Finding.
No Injury.
To claim future injury, requires it to be
certainly impending.
hESC Research Saga (Continued)
October 2010: Harvard adds themselves to group of agencies
identifying a process to create iPSCs from skin.
October 2010: Stem Cell Therapeutic and Research Reauthorization
Act of 2010 Passed by Congress, Signed into law October 8, 2010
Extended Stem Cell Therapeutic and Research Act of 2005 Funding
of stem cell acquisition and research from cord blood donation
No addressing of Dickey-Wicker Amendments
5/19/2011
16
3 Events in 2010 Highlighting Ethics of Secondary Use
Without Consent/Assent in United States
Texas Newborn Bloodspot Settlement
Havasupai Tribe Settlement
Wide Acceptance of The Immortal Life of Henrietta LacksBook
Event: The Texas Newborn BloodSpot Case
5/19/2011
17
Very Brief Summary of Events
Texas, like many states, requires screening for 27 birth
time-sensitive birth disorders upon birth.
By law the blood could be taken without consent by hospitals,
birthing centers and midwives. Samples were destroyed after
testing.
Beginning 2002, State of Texas began keeping bloodspots from
newborns birth defect screening (stored at Texas A&M). Did not
inform parents of retention.
Samples used for quality assurance and research
The Controversy
"You have to give permission for them to give your kid formula
in the hospital. I don't understand why you don't have to give
permission for the state to keep your kid's DNA.
Using the baby DNA spots "to barter with for-profit corporations
for lab supplies, test kits and maintenance contracts."
In 2006 and 2007, bioMerieux provided HIV rapid testing kits to
DSHS in exchange for de-identified bloodspots used to perform QA
for those test kits.
In October 2008, DSHS provided 600 de-identified bloodspots (@$4
per spot) to Avioq for HIV test kit analytical validation for
submission to the FDA.
The IRB board appointed to oversee research on the stored
bloodspots consists almost entirely of State employees.This is not
a true independent professional review board.
5/19/2011
18
Results of Settlement
State to destroy all specimens from 2002 May 27, 2009 (5.3
Million blood spot cards filling 2.5 semi-trucks)
Opt-out form (Directive To Destroy) created for future use.
De-Identified is no longer cause for IRB exemption.
Disclose how samples were used. Later found out that they sent
800 (deidentified) samples to Armed Forces lab to build
mitochondrial DNA (mtDNA) registry.
Directive To DestroyAfter testing, blood spot cards are safely
stored because they still
have important public health uses.
The main uses are: 1) quality
assurance/quality control, such as
making sure that testing equipment
continues to produce accurate
newborn screening test results for
Texas babies; and 2) medical
research Specific information that
could identify your child and
connect him/her to a particular
blood spot card is not allowed
outside of DSHS without permission
from the childs parent, managing
conservator, or legal guardian unless
otherwise provided by law.If the newborn screening blood
spot
card is destroyed, the blood sample
will not be available for any future
needs you may have for the sample.
5/19/2011
19
Did It Make A Difference?
Implemented August 1, 2009
As of 5/10/2010, they reported receipt of 21,210 requests to
destroy Approximately 5% of births
In line with U. Michigan 2008 Study on Use of Samples
With/Without Permission in a hypothetical study
How willing are you to have your childs blood sample (from their
newborn
screening) used for future research studies (WITH/WITHOUT) your
permission?
(N=3935)
0%
10%
20%
30%
40%
50%
60%
Very Willing Somewhat Willing Somewhat
Unwilling
Very Unwilling
WITH Permission WITHOUT Permission
University of Michigan Health System, 2008
5/19/2011
20
Requestor Title of Study
Baylor College of Medicine Population incidence of mitochondrial
mutations associated with aminoglycoside-induced deafness
University of California at Los Angeles, Department of
Pediatrics Development of rapid and efficient PCR approach to
detect common alpha-thalassemia deletions in
Southeast Asians and Filipinos in newborn screening
specimens
University of California at Los Angeles, Department of
Pediatrics Development of alternative mutation detection
technologies for hemoglobinopathies
University of Texas MD Anderson Cancer Center Role of genetic
polymorphisms of glutathione S-transferases and related genes in
the pediatric
population
University of California at Los Angeles, Department of
Pediatrics Genetic variation in Glycerol Kinase and adjacent
genes
Centers for Disease Control and Prevention Using newborn
screening dried blood spots to assess the contribution of selected
congenital infections
(Cytomegalovirus (CMV), Lymphocytic Choriomeningitis Virus
(LCMV) and Toxoplasmosis gondii) to the
etiology of hydrocephalus
PerkinElmer Life and Analytic Sciences Preliminary development
of immunoassay to identify hemoglobin variants
Armed Forces Institute of Pathology Precursor study to Enhancing
the size, sampling, and quality of forensic mtDNA databases
Armed Forces Institute of Pathology Enhancing the size,
sampling, and quality of forensic mtDNA databases
Centers for Disease Control and Prevention Technical evaluation
of cytokine measurements in dried blood spots
Centers for Disease Control and Prevention Technical evaluation
of cytokine measurements in dried blood spots (follow-up)
Centers for Disease Control and Prevention Technical evaluation
of cytokine measurements in dried blood spots (2nd follow-up)
National Institutes of Health; University of California at San
Francisco Investigation of inherited immune disorders
University of Texas Health Science Center at Houston Pilot study
for association study of genetic markers and Idiopathic Talipes
Equinovarus (club foot)
University of Texas Health Science Center at Houston Association
study of genetic study markers and Idiopathic Talipes Equinovarus
(ITEV)
University of Minnesota Neonatal blood spot bank for childhood
cancer studies
Centers for Disease Control and Prevention Development of
reference ranges for use in screening newborns for X-linked
adrenoleukodystrophy
Baylor College of Medicine Precursor study to identify genetic
markers for selected cardiovascular birth defects
Texas A&M University Feasibility of using stored Texas
newborn screening dried blood spots for childhood cancer
epidemiological research
Centers for Disease Control and Prevention Development of a
method to determine concentrations of polyfluoroalkyl compounds
(PFC) in dried blood
spots
University of California at Los Angeles, Department of
Pediatrics Development of a newborn screening test for severe
combined immunodeficiency using ELISA and dried
blood spots
University of Texas Health Science Center at Houston Candidate
gene testing in nonsyndromic cleft lip and palate
Department of State Health Services Assessing the role of
prenatal lead exposure on infant blood lead levels
PerkinElmer Life and Analytical Sciences Development of a
biotinidase screening assay
Deafness
Inherited Immune
Disorders
Club Foot
Childhood Cancer
Cleft Lip/Palate
Prenatal lead
exposure
Cardiovascular
Defects
Event: Havasupai Tribe Settlement
5/19/2011
21
Summary of Issue
200 of 650 member tribe consented to give blood for research on
Type 2 Diabetes, prevalent in their tribe.
Consents said could be used to study the causes of
behavioral/medical disorders.
Years later, discovered blood was used for items inconsistent
with tribal beliefs/values such as: Schizophrenia
Genealogy of Tribe (Crossed Bering Straight vs. indigenous)
Effects of Inbreeding
Public Outcry
People got degrees and grants, and they never asked our
permission.
The research bore no resemblance to the diabetes research I
pictured when I gave my blood years ago.
5/19/2011
22
Settlement with Arizona State University
ASU agreed to pay $700,000 to 41 of the tribes members
Return the 151 remaining blood samples Were buried in accordance
with tribal customs.
Provide other forms of assistance to Havasupai Assisting in
building a clinic and high school
Scholarship eligibility to tribe members
Event: Publication of The Immortal Life of
Henrietta Lacks
5/19/2011
23
Major Contributions Timeline of HeLa Cells
From: Henrietta Everlasting: 1950s Cells Still Alive, Helping
Science. Wired Magazine. January 25, 2010.
The Controversy
. . . if our mother cells done so much for medicine, how come
her family cant afford to see no doctors? Dont make no sense.
People got rich off my mother without us even knowin about them
takin her cells, now we dont get a dime.
Lacks's family today are unable to afford the healthcare
treatments their mother's cells helped to make possible.
She doesnt even have a tombstone, just an indentation in the
ground.
5/19/2011
24
Minor Recognition Preceding Book
Hometown Celebrates Henrietta Lacks Day (Feb 1st)
1996: Atlanta Mayor proclaims Oct 11 as Henrietta Lacks Day
1997: Congressional resolution in her honor (filed by her
hometown congressman)
1998: BBC Documentary 1998, Modern Times: The Way of All
Flesh
Current Public Response
Critical acclaim of book Wellcome Trust Book Prize, 2010
Salon Book Award, 2010
The New York Times 100 Notable Books of the Year
Publishers Weekly Top 10 Books of 2010
The Chicago Tribune Heartland Prize
And more
Popular acceptance of book Paperback currently #18 on Amazon Top
100, Hardcover spent Almost 1 year in Top 100.
Currently #2 in NY Times (Paperback Non-Fiction), and #5
(Combined Print & E-Book non-Fiction)
#53 in USA Todays Top 150 (all categories), > 40 weeks in Top
150 All Books
Oprah producing HBO movie
Growing funds in newly created Henrietta Lacks Foundation
benefitting Lacks family, initial awards in 2010
Full tuition and books for five descendants of Henrietta Lacks
starting fall semester 2010
Health care and emergency needs grants for two members of her
immediate family
5/19/2011
25
Receives Tombstone Almost 60 Years Post-Burial
Henrietta Lacks, August 01, 1920-October 04, 1951. In loving
memory of a phenomenal woman, wife and mother who touched the lives
of many. Here lies Henrietta Lacks (HeLa). Her immortal cells will
continue to help
mankind forever. Eternal Love and Admiration, From Your
Family
Summary Of Ethics Portion
Know The Legal Maze
Know That Navigating The Legal Maze Is Not Your Endpoint To
Conduct Research
Principles of Belmont Report Apply To Non-Interventional
Research As Well Respect For Persons
Beneficence
Justice
50
5/19/2011
26
REFERENCE SLIDES
51
52
IRB Review and Human Subject Protection
Applying the Common Rule Evaluating when IRB review is required
Approving research protocols involving biospecimens Creating
informed informed consent documents Communicating research findings
to participants
5/19/2011
27
53
When Does the Common Rule Apply?
The Common Rule applies to federally-funded research and to
research if an institution voluntarily extends the scope of its
Federalwide Assurance
4. Applicability(a) This Institution assures that whenever it
engages in human subjects research conducted or supported by any
federal department or agency that has adopted the Common Rule.
(b) Optional: This Institution elects to apply the following to
all of its human subjects research regardless of the source of
support, except for research that is covered by a separate
assurance:[ ] The Common Rule (see section 3 of the Terms of the
FWA for Institutions Within the United States for a list of
departments and agencies that have adopted the Common Rule and the
applicable citations to the Code of Federal Regulations)[ ] The
Common Rule and subparts B, C, and D of the HHS regulations at 45
CFR part 46
54
When Is IRB Approval Required?
45 C.F.R. 46.102 requires IRB approval for non-exempt human
subject research
Research: a systematic investigationdesigned to develop or
contribute to generalizable knowledge
Human subject: a living individual about whom an investigator
conducting research obtains (1) data through intervention or
interaction with the individual, or (2) identifiable private
information
Intervention: physical procedures to gather data or manipulation
of environment
Interaction: communication or interpersonal contact
5/19/2011
28
55
When Is IRB Approval Required?
Private information: information provided for specific purposes
by an individual, which the individual can reasonably expect will
not be made public
Identifiable: an individuals identity is or may be readily
ascertained by the investigator
56
Compare with HIPAA De-Identification
Two ways to de-identify protected health information under
HIPAA:
Strip all HIPAA identifiers for safe harbor protection
Have a qualified determine that the risk is very small that the
information could be used, alone or in combination with other
reasonably available information, by an anticipated recipient to
identify an individual who is a subject of the information
5/19/2011
29
57
HIPAA Identifiers
Name; Street address, city, county, precinct, or zip code
(unless only the first three digits of
the zip code are used and the area has more than 20,000
residents);
The month and day of dates directly related to an individual,
such as birth date, admission date, discharge date, dates of
service, or date of death;
Age if over 89 (unless aggregated into a single category of age
90 and older); Telephone numbers; Fax numbers; Email addresses;
Social security numbers; Medical record numbers; Health plan
beneficiary numbers; Account numbers; Certificate/license numbers;
Vehicle identifiers, serial numbers, and license plate numbers;
Device identifiers and serial numbers; Web Universal Resource
Locators (URLs) and Internet Protocol (IP) addresses; Biometric
identifiers, such as fingerprints Full-face photographs and any
comparable images; or Any other unique identifying number,
characteristic, or code.
58
And if specimen is for an FDA-regulated study.
FDA prohibits use of de-identified specimens, except if:
In-vitro diagnostic device study meets IDE exemption criteria The
study uses leftover specimens (i) originally collected for
clinical purposes, (ii) originally collected for unrelated
research, or (iii) from a repository;
Specimens not individually identifiable to investigator, sponsor
or others associated with study;
Individuals caring for patients are different from and do not
share information with those associated with study;
Supplier of specimens (e.g., repository) has policy that
prohibits release of identifiers; and
Protocol is reviewed by an IRB
FDA uses enforcement discretion not to require informed consent
for these studies
5/19/2011
30
59
When Is Coded Information Not Identifiable?
OHRP Guidance on Research Involving Coded Private Information or
Biological Specimens
(http://www.hhs.gov/ohrp/humansubjects/guidance/cdebiol.htm)
Coded means that identifiable private information is replaced
with a number, symbols, etc., and a key to decipher the code exists
to allow linkage
Coded information is not identifiable if it cannot be linked to
specific information by the investigators (anyone involved in
conducted the research) either directly or indirectly through
coding systems. Specifically:
60
When Is Coded Information Not Identifiable?
Coded information is not identifiable if:(a) the investigators
and the holder of the key enter into an agreement prohibiting the
release of the key to the investigators under any circumstances,
until the individuals are deceased (note that the HHS regulations
do not require the IRB to review and approve this agreement);
(b) there are IRB-approved written policies and operating
procedures for a repository or data management center that prohibit
the release of the key to the investigators under any
circumstances, until the individuals are deceased; or
(c) there are other legal requirements prohibiting the release
of the key to the investigators, until the individuals are
deceased.
5/19/2011
31
61
HIPAA Has Different Rules for Coding
Coded information is not protected health information if the
code is not derived from or related to patient identifiers (e.g.,
patient initials, mixed SSN or medical record number) and the code
cant be translated to identify the individual
Disclosure of the key = disclosure of PHI
62
When Is Biospecimen Research Exempt?
45 CFR 46.101(b)(4):
collection or study of existing data, documents, records,
pathological specimens, or diagnostic specimens; and
if these sources are publicly available or if the information is
recorded by the investigator in such a manner that subjects cannot
be identified, directly or through identifiers linked to the
subjects
Codes dont count!
5/19/2011
32
63
Is Expedited Review Possible?
Expedited review is permitted if the research: Involves no more
than minimal risk; and
Involves research in permitted categories (see
http://www.hhs.gov/ohrp/humansubjects/guidance/expedited98.htm),
including:
Certain blood collection
Collection of biospecimens or data by noninvasive means
Research involving biospecimens or data that have been collected
or will be collected for non-research purposes
64
Who Must Get IRB Approval?
Is the Institution Engaged in Research?
OHRP Guidance on Engagement of Institutions in Human Subject
Research (2008) (http://www.hhs.gov/ohrp/policy/engage08.html )
Institution is engaged in human subjects research if its
employees or agents:
Perform invasive or noninvasive procedures for the research
Interact with participants for the research, such as
interviewing
Obtain informed consent
5/19/2011
33
65
Who Must Get IRB Approval?
Is the Institution Engaged in Research?
Institution is engaged in human subjects research if its
employees or agents:
Obtain for research purposes identifiable private information or
identifiable biological specimens from any source (even if there is
no interaction with the participants)
If the specimens are coded, they are identifiable only if the
investigators have the key
66
Who Must Get IRB Approval?
Is the Institution Engaged in Research?
The institution is not engaged in human subjects research if its
employees or agents:
Collect specimens from patients as a service to the
investigators, if they will not receive publication privileges, the
service typically is performed for non-research purposes, and they
do not administer any study intervention being tested
Release identifiable private information or identifiable
specimens to investigators at another institution
Obtain coded information or specimens, but have no access to the
key
Watch HIPAA compliance!Watch HIPAA compliance!Watch HIPAA
compliance!Watch HIPAA compliance!
5/19/2011
34
67
Creating Informed Informed Consent Documents
Regulations (45 C.F.R. 46.116(a)(1)) require: Explanation of the
purposes of the research
Description of the procedures
Description of any reasonably foreseeable risks
OHRP Guidance on Research Use of Stored Data or Tissues (1997)
(http://www.hhs.gov/ohrp/policy/reposit.html) requires clear
description of: Operation of repository;
Specific types of research to be conducted;
Conditions under which data and specimens will be released to
recipient-investigators; and
Procedures for protecting privacy of subjects and
confidentiality of data
Operation of the Repository
and Types of Research
Who holds the repository? How has access to the samples and data
for repository management?
How long will samples or data be retained? What types of
research might the samples be used for?
Any research?
Research about participants disease only?
Genetic research?
Tiered consents do they work, and what kind of infrastructure
must an institution have in place to ensure that subjects wishes
are respected?
68
5/19/2011
35
69
What Specimens and Data Will
Be Released to Investigators?
Will identifiers be on samples?
Will samples be labeled with a code, and if so, who will hold
the key?
Are the reasonably foreseeable risks to participating
discussed?
NCI suggested language: The greatest risk to you is the release
of information from your health records. We will do our best to
make sure that your personal information will be kept private. The
chance that this information will be given to someone else is very
small.
Alternative language: The [entity] has extensive precautions in
place to prevent any unauthorized disclosure of personally
identifiable information. However, if there is an inadvertent or
accidental disclosure of clinical data or data obtained from the
study about you, this could have adverse effects on your
insurability, employment or social standing. [If the study involves
genetic information] It could also involve DNA typing, which may
support paternity determinations and affect your family
relationships. There may be unforeseeable risks that are not known
at this time. However, you will be informed of any new risk as they
become known.
5/19/2011
36
The Genetic Information Nondiscrimination Act
Prohibits discrimination based on genetic information in health
insurance and employment
Doesnt cover life, disability or long term care insurance
Doesnt cover employers under 15 employees
Genetic information includes:
Genetic testing of individual or family member
Family history
Individual or family member request for genetic services
(testing, counseling or education), including in clinical
research
OHRP Suggested GINA Language
A new Federal law, called the Genetic Information
Nondiscrimination Act (GINA), generally makes it illegal for health
insurance companies, group health plans, and most employers to
discriminate against you based on your genetic information. This
law generally will protect you in the following ways: Health
insurance companies and group health plans may not request your
genetic information that we get from this research.
Health insurance companies and group health plans may not use
your genetic information when making decisions regarding your
eligibility or premiums.
Employers with 15 or more employees may not use your genetic
information that we get from this research when making a decision
to hire, promote, or fire you or when setting the terms of your
employment.
5/19/2011
37
OHRP Suggested GINA Language
All health insurance companies and group health plans must
follow this law by May 21, 2010. All employers with 15 or more
employees must follow this law as of November 21, 2009.
Be aware that this new Federal law does not protect you against
genetic discrimination by companies that sell life insurance,
disability insurance, or long-term care insurance.
If research involves determining whether individuals have a
manifested disease, consider telling subjects that this information
is not protected
74
Certificates of Confidentiality
Certificates of Confidentiality available from NIH for sensitive
research information where disclosure of identifying information
could damage subjects financial standing, employability,
insurability or reputation
Research collecting information related to genetics,
psychological well being, sexual behavior, drug use, criminal
activities
Research where subjects may be involved in litigation related to
exposures under study