The HIPAA Privacy Rule Affects Subject Recruitment

On 14 August 2002, the U.S. Department of Health & Human Services approved final amendments to the so-called Privacy Rule, the privacy regulations issued by HHS in December 2000. With regard to research recruitment and the need for an authorization for disclosure of protected health information to third parties, the language in the preamble to the final amendments is intended to clarify the following: Although 45 CFR 164.512(i)(1)(ii) allows use or disclosure of protected health information for research preparatory activities, including recruitment, on the hospitals site, the protected health information may not be removed from the hospitals site by the researcher for such activities without the patients authorization or waiver, or without alteration thereof by the institutional review board (IRB).

When can researchers view protected information about patients? Under 45 CFR 164.512(i)(1)(ii), a hospital may permit researchers to view protected health information about its patients for purposes of the researcher preparing the research protocol and recruiting subjects provided that the researcher demonstrates, either in writing or orally, that

• the use or disclosure is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research.
• no protected health information is to be removed from the hospital by the researcher in the course of the review.
• the protected health information for which use or access is sought is necessary for the research purposes.

When can researchers record and remove protected information? The researcher may record and remove protected health information from the hospitals premises only if the hospital either waives or modifies authorization requirements (and appropriately documents this) or obtains an authorization from the patient. Alternatively, the researcher may remove de-identified information, or the hospital may disclose a limited data set to the researcher, provided the hospital and the researcher enter into a data use agreement relating to the limited data set.