On January 23, 2013, the Department of Health and Humans Services (HHS) published the Omnibus Final Rule (Final Rule) as a modification to the "HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the HITECH Act and the Genetic Information Nondiscrimination Act of 2008."
Editor's Note: You can now view part II of this article here.
On January 23, 2013, the Department of Health and Humans Services (HHS) published the Omnibus Final Rule (Final Rule) as a modification to the “HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the HITECH Act and the Genetic Information Nondiscrimination Act of 2008.”
As stated by HHS, “the Final Rule is needed to strengthen the privacy and security provisions established under HIPAA for PHI and harmonize certain requirements with those under HHS’s Human Subject Protections regulations.”
Although the Final Rule is a welcome response to concerns by the research community that the current Privacy Rule encumbers research and diverges from the HHS’s Human Subject Protections regulations for future research, the provisions of the Final Rule that modify the current Privacy Rule are likely to have significant implications for clinical research.The Privacy Rule
Under the current Privacy Rule, researchers are permitted to conduct research on subjects and patients, if the Covered Entity with whom they are affiliated abides the standards for the use of an individual’s protected health information (PHI).
Under the Privacy Rule:
The Final Rule
The Final Rule became effective on March 26, 2013.
The provisions of the Final Rule that are likely to impact on research conduct are related to compound authorizations--authorization for future research use and the use of a deceased person’s PHI.
These changes give Covered Entities, researchers and IRBs discretion regarding how authorizations distinguish between conditioned and unconditioned activities. They are likely to allow Covered Entities to combine authorizations for use and disclosure of PHI for clinical trials and related tissue and data banking activities, as well as in other research situations.
Authorization for Future Research Use
These changes are likely to give Covered Entities, researchers, and IRBs flexibility to determine how to adequately describe the future research purpose, the information to be used or disclosed for future research, and the recipients of the PHI for future research. However, since these changes have not been tested, HHS may issue additional guidance with respect to revocations of authorizations for future research uses.
Deceased Person PHI
This declassification is likely to benefit research since beyond the 50 years authorization from living individuals related to the deceased person is no longer required.
The provisions of the Final Rule have significant implications for clinical research:
Covered Entities have until September 23, 2013, to come into full compliance with the Final Rule.
In addition, Covered Entities should keep abreast of future regulatory developments and guidance on these and other issues, such as revocation of authorizations of use of PHI for future research use, additional guidance related to research use of genetic information, and harmonization of the Final Rule with the standards for informed consent.
Future regulatory developments and guidance may be found on http://privacyruleandresearch.nih.gov/ and http://www.hhs.gov/ocr/office/index.html.
Lina Genovesi, PhD, JD