HIPAA Omnibus' Research ProvisionsPrivacy Attorney Explains New Consent Rules
In the past, healthcare organizations often needed to obtain multiple authorizations from patients in order to use their information for research studies and clinical trials, Greene says.
But under HIPAA Omnibus, authorizations now can be combined, Greene explains in an interview with HealthcareInfoSecurity [transcript below].
Previously, patients needed to sign multiple consents to participate in a specific clinical trial as well as future studies, the attorney explains. Now that authorization can be combined in one form. "You can authorize future research studies as long as you put the individual on reasonable notice," he says. "For example, they won't be surprised by the type of research that in the future their information may be used or disclosed for."
Organizations should not wait until the Sept. 23 HIPAA Omnibus compliance deadline to take advantage of the changes, Greene says.
"As of March 26, when the law became effective, they can immediately start taking advantage of it," he says. "They can start revising their research policies, procedures and their research forms to reflect they now have this greater flexibility for uses and disclosures."
In the interview, Greene also explains:
- The types of healthcare providers and business associates that the research provision covers;
- The differences between conditioned and unconditioned authorizations;
- How the new research provisions provide benefits to patients and medical researchers.
As a partner at Davis Wright Tremaine LLP in Washington, Greene specializes in HIPAA and HITECH Act issues. He formerly was senior health information technology and privacy specialist at the HHS Office for Civil Rights, where he played a significant role in administering and enforcing the HIPAA privacy, security and breach notification rules.
Changes to Research Provisions
MARIANNE KOLBASUK MCGEE: First, tell us briefly what has changed under HIPAA Omnibus when it comes to research and explain what the new provisions say?
ADAM GREENE: There have been two big changes with respect to research. Both of these were in response to long-standing concerns in the research community. One is a greater ability to combine what are referred to as conditioned and unconditioned authorizations. The other is greater ability to authorize future research.
With respect to conditioned and unconditioned authorizations, generally HIPAA does not allow you to condition treatment payment or other benefits on an authorization, meaning you can't say, "Sign this authorization that allows us to use or disclose this protected health information in a way otherwise not permitted by HIPAA, otherwise we won't treat you." One of the exceptions to that has always been [with] clinical trials, where you can say to the individual, "Please sign this authorization for us to use or disclose your information for the clinical trial research; otherwise, we won't provide you with the treatment that's part of the clinical trial." That's what's referred to as a conditioned authorization.
In the past, you could not combine that with an unconditioned authorization, such as, "We'd also like you to sign this authorization that allows us to maintain your information in a research repository or a tissue specimen repository." That was leading to the need to have completely separate authorization forms for potentially related research purposes.
Now, under the Omnibus Rule, covered entities are allowed to combine these conditioned and unconditioned authorizations. For example, you can have an authorization that says, "Sign this authorization to use or disclose your information for purposes of the clinical trial research; otherwise, we won't provide you with clinical treatment. And, in addition, check here, sign here or initial here if you authorize your information being maintained in a tissue-specimen repository, which is voluntary." If you choose not to do that secondary authorization, that won't affect your clinical trial treatment. Now there's ability to combine these in a single authorization form making it easier for the patient.
We also have this other change which is actually not in the regulations, but is solely found in the preamble to the Omnibus Rule. That change is a long standing interpretation of the U.S. Department of Health and Human Services. Previously, HHS said you could not authorize future research studies that haven't yet been created, for example. Now, they've changed that interpretation and said, "You may actually have an authorization that [consents] use and disclosure for future research studies as long as you put the individual on a reasonable notice." For example, they're not going to be surprised by the type of research that in the future their information may be used or disclosed for.
Tips for Covered Entities
MCGEE: What should covered entities such as medical centers and doctor practices do to comply? And do these provisions only apply to healthcare organizations that conduct medical research?
GREENE: Covered entities need not wait until the compliance date in September of 2013 to take advantage of this, because this is less about compliance and more about, frankly, an improved workability. As of March 26, when the law became effective, they can immediately start taking advantage of it. They can start revising their research policies, procedures and their research forms to reflect they now have this greater flexibility for uses and disclosures.
MCGEE: What about business associates? Do these provisions apply to them? If so, what kinds of business associates are affected?
GREENE: This provision applies to all covered entities, regardless of whether they do research, and all business associates to the extent that they make uses or disclosures for research. For a covered entity, it may be that the doctor's office or the hospital doesn't conduct research itself, but it needs to use or disclose for research. It should be cognizant of the fact that the research may not be performed pursuant to these more flexible forms. Similarly, it may be rarer for a business associate to be making uses and disclosures for research, but there may be circumstances where business associates do in fact make such uses and disclosures. If so, they should be cognizant of these changes, and business associates should always remember they may only use and disclose as permitted by their business associate agreement. They would have to comply with HIPAA with respect to these changes to research, but also make sure that their business associate agreement permits disclosure for research purposes.
Benefits to Patients, Medical Researchers
MCGEE: In terms of patients, where does this all come into play? For instance, do the covered entities need to give a form that discloses this information about the research revisions? Is this part of their privacy notices? Where would the patient see this show up?
GREENE: This likely will only be transparent to patients with respect to the forms that they actually complete. In that, they now may find themselves completing [fewer] research forms because they have been combined, and because they sign one form that covers a wide range of future research. Otherwise, patients likely are not going to see this reflected in the notice of privacy practices or otherwise see changes related to this.
MCGEE: In terms of medical research and the impact of these provisions for patients, is this a good thing or a bad thing in terms of these changes?
GREENE: For medical research, this is a very good thing. This was, I think, a pretty big complaint, the fact that they had to keep going back to patients and getting authorizations over and over, and sometimes get multiple authorizations at the same time. I think they're very much appreciative of this change. For patients, [they] did not necessarily receive much benefit from having to complete multiple forms. As long as the patients know what they're signing, I think this is ultimately beneficial for them.