The Health Insurance Portability and Accountability Act Privacy Rule

Abstract

The Privacy Rule is fundamentally changing the way that healthcare providers, health plans, and others use, maintain, and disclose health information and the steps that researchers must take to obtain health data. The Privacy Rule requires researchers who seek access to identifiable health information to obtain written authorization from subjects, or, alternatively, to demonstrate that their research protocols meet certain Privacy Rule requirements that permit access without written authorization. To ensure continued access to data, researchers will need to work more closely than before with healthcare providers, health plans, and other institutions that generate and maintain health information.

The Ethics of Research Biobanking: A Critical Review of the Literature

“…Hence, we cannot know if these differences relate to the approaches and interests of investigators or the donating public. In a study among cancer patient donors in the US the recent HIPAA Privacy Rule (that has been enacted to ensure the privacy of patients and ensure their consent prior to use of their medical records, see Gunn et al, 2004) was even criticized by donors for potentially delaying research (Kaphingst et al, 2006).…”

A Primer of the HIPAA Privacy Rule for Practice-Based Researchers

“…Although there are important differences between the Privacy Rule's requirement for individual authorization for the research use or disclosure of PHI and the Common Rule's requirement to consent to participate in a research study as a whole, "both sets of requirements can be met by use of a single, combined form, which is permitted by the Privacy Rule." 1,2,7,10 However, local IRBs have the authority to require separate forms.…”

“…1,2,8 If such patient authorization is not possible or "practicable," researchers can apply to their IRB for a waiver of individual authorization, making sure to document that the specific waiver criteria are satisfied. 1,2,7,8,10 Researchers who apply for a waiver are advised to thoroughly address the following concerns: (1) the use or disclosure of the PHI involves no more than minimal risk to the privacy of the individual; (2) the research could not practicably be conducted without access to and use of the PHI; (3) only the "minimum necessary" information is requested and each data element is justified; (4) the research could not practicably be conducted without the waiver; and (5) there is an adequate plan to protect the identifiers from improper use and disclosure.…”

“…7 The preparatory research provision also permits covered entities to disclose PHI to aid study recruitment. 7,10 In this case, an employee or member of the covered entity's workforce would be allowed to identify prospective research participants for purposes of seeking their authorization to use or disclose PHI for a research study. Clinician researchers and clinical staff are permitted to directly recruit their patients.…”

“…These data can be organized as either a limited or de-identified dataset and compiled in a summary table. However, the researcher must adhere to the following restrictions on "reviews preparatory for research" 7,10 : (1) disclosure is sought solely to prepare a research protocol or for similar purposes; (2) no PHI is to be physically removed from the covered entity; and (3) the PHI is necessary to plan the research (Table 1).…”