The Omnibus Final Rule (Final Rule) entitled "Modifications of the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the HITECH Act" became effective on March 26, 2013.
Editor's Note: Part I of this article can be viewed here.
The Omnibus Final Rule (Final Rule) entitled “Modifications of the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the HITECH Act” became effective on March 26, 2013.
The Final Rule has created major modifications with compliance and enforcement implications which will affect stakeholders involved in transactions for the use and disclosure of protected health information (PHI) and the conduct of clinical research.
Here are some of the modifications which are subject to enforcement by the Office of Civil Rights (OCR) and requiring compliance by September 23, 2013.
Modifications
Business Associates are directly impacted by the modifications to the Privacy and Security Rules, and both Covered Entities and Business Associates are directly impacted by the modifications to the Breach Notification Rule.
Covered Entities are directly impacted by the modifications to the Privacy Rule relating to compound authorizations, authorization for future research use and the use of a deceased person’s PHI.
OCR can enforce any breach under the modified HIPAA Rules.
Privacy and Security Rules: Transactions involving PHI
Privacy Rule: Clinical Research
Breach Notification Rule
Enforcement Rule
Compliance
Covered Entities and Business Associates must amend their BAAs by the September date. Existing BAAs have the benefit of a transition period until September 22, 2014.
To successfully come into compliance, Covered Entities considers it as a joint effort with Business Associates. “The Covered Entity and Business Associate must work together to ensure that privacy is seamless throughout the process,” states Raymond Braeunig, Chief Compliance and Privacy Officer, Rowan University School of Osteopathic Medicine.
“Not only does the Business Associate has more responsibilities but the Covered Entity must ensure those responsibilities are understood and the Covered Entity must verify the Business Associate has the security measures in place in accordance with the rules.”
To reflect this increase in responsibilities, each BAA must be modified to:
In addition to modifying the BAAs, “the next step is for the Covered Entity to outline a risk assessment for the Business Associate and perform a walkthrough of the Business Associate’s operation(s) as well as any Business Associate subcontractor to ensure the privacy and security measures are in place, as the Covered Entity will be ultimately responsible as well to ensure compliance with the rules,” concludes Braeunig.
Covered Entities must also amend their policies and procedures by the September date “in order to take advantage of the enhanced efficiency in research initiatives that the Final Rule provides and to come into compliance with the requirements of the Final Rule,” states Elan Czeisler, Director, Institutional Review Board (IRB) and Human Research Protection Program, NYU Langone Medical Center.
“In collaboration with the Office of Research Compliance and Office of Legal Counsel, we are in the process of amending our policies and procedures to be compliant with the Final Rule and reflect changes relating to compound authorizations, authorization for future research use and the use of a deceased person’s PHI."
In addition to these amendments, training is key to sensitize the workforce to the requirements of the Final Rule and Covered Entities need to ensure that their workforce understands the new HIPAA Rules. “We plan to conduct training for all of our clinical personnel to sensitize them to the new requirements and the increased level of scrutiny and potential enforcement by OCR,” states Braeunig.
Going Forward
The changes to the HIPAA Rules are likely to have an impact on the conduct of clinical research and transactions involving PHI. The relationships between Covered Entities, Business Associates and OCR are also likely to be redefined requiring continuous monitoring.
The territory is uncharted and future regulatory developments may come into play.
“We plan to remain on the lookout for future regulatory developments and guidance on these and other issues,” concludes Czeisler.
Future regulatory developments and guidance may be found on http://www.hhs.gov/ocr/office/index.html.
View the related blog here.
Lina Genovesi, PhD, JD www.linagenovesi.com
Merck Launches Phase III Trials of Once-Monthly Oral HIV PrEP Candidate MK-8527
July 14th 2025In the new EXPrESSIVE clinical trial program, Merck will evaluate MK-8527, a once-monthly, oral PrEP therapy, in populations at high risk of HIV-1 infection, including adolescent girls and women in sub-Saharan Africa.
Unifying Industry to Better Understand GCP Guidance
May 7th 2025In this episode of the Applied Clinical Trials Podcast, David Nickerson, head of clinical quality management at EMD Serono; and Arlene Lee, director of product management, data quality & risk management solutions at Medidata, discuss the newest ICH E6(R3) GCP guidelines as well as how TransCelerate and ACRO have partnered to help stakeholders better acclimate to these guidelines.
Baxdrostat Shows Significant Blood Pressure Reduction in Phase III BaxHTN Trial
July 14th 2025In the BaxHTN Phase III study, AstraZeneca’s baxdrostat demonstrated statistically significant and clinically meaningful reductions in systolic blood pressure in patients with uncontrolled or treatment-resistant hypertension.
New FDA Initiative Reveals Common Reasons for Drug Application Rejection
July 11th 2025By publishing more than 200 complete response letters, the FDA is offering new visibility into the issues that most often delay drug approvals, including safety concerns, trial design flaws, and manufacturing gaps.
Arcus’ Quemliclustat Earns Orphan Drug Designation as Phase III Pancreatic Cancer Trial Advances
July 11th 2025The FDA has granted orphan status to Arcus Biosciences’ CD73 inhibitor quemliclustat for metastatic pancreatic cancer, as the global PRISM-1 Phase III trial nears full enrollment following promising survival data from ARC-8.