The HIPAA/HITECH Omnibus Final Rule: Implications for Clinical Research Blog

On January 23, 2013, the Department of Health and Humans Services (HHS) published the Omnibus Final Rule (Final Rule) which modifies the “HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the HITECH Act and the Genetic Information Nondiscrimination Act of 2008.”

The Final Rule became effective on March 26, 2013. Research entities have until September 23, 2013 to come into full compliance.  

The Final Rule modifies the use of an individual’s protected health information (PHI) outlined in the Privacy Rule.

Here are the modifications which are likely to have implications on the conduct of research:

• The Final Rule provides for compound authorizations for combining conditioned and un-conditioned authorizations. A compound authorization must differentiate between the conditioned and unconditioned research components.  The individual retains the option to opt-in to the unconditioned research activities.

• The Final Rule allows an authorization for the use of PHI in future research. The authorization must describe the future research in such a manner that an individual expects that his or her PHI will be used or disclosed for such future research. 

• The Final Rule provides that any information that would otherwise constitute PHI of a deceased person ceases to be PHI 50 years after the death of the deceased person. 

There are likely benefits of the Omnibus Final Rule for research such as the alleviation of administrative burdens, the removal of barriers for future research, and the ability to use a deceased person’s PHI.

These benefits remain to be tested.

Lina Genovesi, PhD, JD

www.linagenovesi.com