The Department of Health and Human Services (HHS) has issued a notice of proposed rulemaking (NPRM) entitled, “Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the Health Information Technology for Economic and Clinical Health Act” (HITECH). As part of the NPRM, HHS is soliciting comments on whether to 1) revise the Privacy Rule to allow institutions and researchers to combine conditioned and unconditioned authorizations for research; and 2) modify its existing interpretations of the Privacy Rule that require an authorization for the use or disclosure of protected health information (PHI) for clinical research to be study-specific. Allowing compound authorizations and authorizations for future research could remove a significant barrier to clinical research. The NPRM is open to public comment until Sept. 13, 2010.  

Increasingly, institutions are conducting correlative clinical research as part of a clinical trial. These correlative studies include contributing subject data or tissue samples to an onsite or offsite databank or tissue repository for future clinical research uses. The NPRM has significance for life sciences companies and institutions that use or intend to use clinical trial data for future research that is unrelated to the clinical trial from which the data was derived.  

Compound Authorizations  

The Privacy Rule currently prohibits “compound authorizations,” which combine an authorization that conditions treatment, payment, enrollment in a health plan, or eligibility for benefits with an authorization for another purpose for which treatment, payment, enrollment, or eligibility may not be conditioned. Institutions and researchers cannot obtain a single research authorization for the use or disclosure of PHI for a clinical trial that includes both treatment as part of a clinical trial and tissue banking of specimens (and associated protected health information) collected, since a research-related treatment authorization generally is conditioned and a tissue banking authorization generally is not conditioned. Therefore, institutions and researchers must obtain separate authorizations from research participants for a clinical trial that also collects tissue samples with associated PHI information for a tissue bank.

HHS issued guidance after the promulgation of the Privacy Rule stating that the Privacy Rule considers the creation and maintenance of a tissue repository or database as a specific research activity, but the subsequent use or disclosure by an institution of information from the database for a specific research study requires separate authorization. As a result, researchers are required to obtain a subsequent authorization from study subjects for the same future uses, and the researcher or institution cannot include that future research authorization in the authorization for the data or tissue collection study.  

The NPRM is seeking comments on whether to revise the Privacy Rule to allow institutions and researchers to combine conditioned and unconditioned authorizations for research, provided that the authorization clearly differentiates between the conditioned and unconditioned research components and clearly allows the individual the option to opt in to the unconditioned research activities.  

Permitting compound authorizations for research would allow for a single authorization when researchers seek to contribute PHI or tissue samples to a data/tissue bank as part of an underlying clinical trial.  

Future Research Uses

Increasingly, institutions are conducting correlative clinical research as part of a clinical trial. These correlative studies include contributing subject data or tissue samples to an onsite or offsite databank or tissue repository for future clinical research uses. HHS has interpreted the Privacy Rule to prohibit blanket or broad research authorizations for "nonspecific research" or "future, unspecified projects" and requires that authorizations be study- specific for purposes of complying with the Privacy Rule’s requirement that an authorization must include a description of each purpose of the requested use or disclosure. HHS considers the creation and maintenance of a research repository or database a specific research activity, but the subsequent use or disclosure by an institution or researcher of information from the database for a specific research study requires separate authorization. This means that the description cannot be so broad as to encompass future unspecified clinical research. HHS has stated that this interpretation addresses its concern that study subjects would lack necessary information to make an informed decision.  

As a result of HHS’ current interpretation, institutions often limit a company’s right to use and disclose study subject data so that it is consistent with the institution’s obligations under 45 CFR Part 46 (the “Common Rule”) and the Privacy Rule. In general, this means that a company acting as a sponsor or supporter of a clinical trial must agree to use and disclose subject data solely for purposes related to the clinical trial and for the purpose of complying with applicable law. Consequently, the company cannot use PHI for future, unspecified clinical research.  

HHS’s existing interpretation of the Privacy Rule not only encumbers secondary clinical research, but also limits a study subject's ability to agree to the use or disclosure of his or her PHI for future research without having to be re-contacted to sign multiple authorization forms at various points in the future. In addition, HHS's current interpretation is inconsistent with the Common Rule with respect to the ability of a researcher to seek study subjects' consent to future clinical research so long as the future research uses are described in sufficient detail to allow an informed consent. Part of HHS’ rationale for considering revising its interpretation of this requirement is the fact that many IRBs approve informed consents that allow future research on the clinical research subjects’ PHI or tissue samples. As a result, there is an inherent inconsistency if the authorization does not allow future research.

As part of the NPRM, HHS is considering whether to modify its interpretation of the Privacy Rule that an authorization for the use or disclosure of PHI for clinical research be study-specific. HHS proposes and seeks comments on each of the following three options:  

  1. Whether the Privacy Rule should permit an authorization for uses and disclosures of PHI for future clinical research purposes to the extent such purposes are adequately described in the authorization such that it would be reasonable for the individual to expect that his or her protected health information could be used or disclosed for such future clinical research;  
  2. Whether the Privacy Rule should permit an authorization for future research only to the extent the description of the future research included certain elements or statements specified by the Privacy Rule, and if so, what should those be; and  
  3. Whether the Privacy Rule should permit option (1) as a general rule but require certain disclosure statements on the authorization in cases where the future research may encompass certain types of sensitive research activities, such as research involving genetic analyses or mental health research, which may alter an individual's willingness to participate in the research.  

Allowing authorizations to permit future clinical research would likely reduce the administrative burden for institutions and researchers by permitting uses or discloses of PHI for re-analysis without having to obtain an additional authorization from the study subject for each additional research use. This allowance would also be consistent with the Common Rule, which permits broad informed consent for secondary research if the IRB deems the original informed consent to be adequate.  

Revising or reinterpreting the current Privacy Rule requirements regarding compound authorizations and future research uses would likely streamline the authorization process and dramatically decrease the burden on institutions, researchers and study subjects. In addition, the informed consent process as well as clinical trial agreement negotiations would likely be more efficient and less confusing for all parties.