The Impact of HIPAA on Clinical Trial Recruitment

1. The Impact of HIPAA on Clinical Trial Recruitment Joanne E. Pollak, Johns Hopkins Gregg Fromell, MD, Univ Penn Patricia Pearl O’Rourke, MD, Partners NCHICA Conference AMC Security & Privacy: Progress & Prospects Sept 26-28, 2005

2. How Is Hopkins Organized for HIPAA? Joanne E. Pollak, JD Johns Hopkins Medicine Baltimore, Maryland

3. Covered Entity OHCA JHM AFFILIATED COVERED ENTITIES Johns Hopkins University - Hybrid Non-Covered Functions Covered Functions JHHS Covered Entities & Group Health Plans SOM Student Hlth Plan Archives SON and certain researchers in other schools Kennedy Krieger Non-Employed Medical Staffs Covered Plans Other JH Group Health Plans Priority Partners Managed Care Organization

4. How Is Penn Organized for HIPAA? Gregg J. Fromell, MD Office of Human Research University of Pennsylvania, School of Medicine

5. Covered Entity Summary Covered Entity type: Hybrid Entity Health System & School of Medicine: Affiliated Covered Entity HIPAA Privacy Officers 4 Univ. Office of Audit & Compliance Office of General Counsel Health System Office of Research Integrity & Compliance Covered Entity

6. Legend: ACE: Affiliated Covered Entity OHCA: Organized Health Care Arrangement University of Pennsylvania (“Hybrid Entity”) Healthcare component: HEALTH & WELFARE PROGRAM (Employee Health Plan) Support Services* Healthcare component: STUDENT HEALTH SERVICES Office of Environmental Health and Radiation Safety Support Services: Office of Student Financial Services University of Pennsylvania Institutional Review Boards Office of the Executive Vice President Office of Regulatory Affairs Office of the General Counsel Office of the Comptroller University Archives And Records Center Office of Audit And Compliance Office of Risk Management Office of the Provost Office of Development and Alumni Relations Healthcare component: Living Independently For Elders Office of the President “PENN MEDICINE” Healthcare Component: HUP SOM CPUP PMC CCA Office of Information Systems and Computing ACE Support Services: School of Nursing’s Office of Technology and Informational Systems School of Nursing’s Center for Nursing Research School of Nursing’s Office of Business and Finance PHX WH Healthcare component: School Of Dental Medicine PAH CHCA PCRC OHCA with the Independent Medical Staff *This list is not intended to be exhaustive. L:/3624/ADS/HIPAA/Hybrid Chart - University 3-25-03.ppt

7. How Is Partners Organized for HIPAA? Patricia Pearl O’Rourke, MD Partners HealthCare System

8. Partners HealthCare System ACE All Partners Entities Dana Farber Cancer OHCA MGH Institute BWH McLean Harvard University Newton Wellesley Hybrid Entity Other community Medical School and School of Public Health not covered hospitals by HIPAA Other Harvard - affiliated Hospitals Many with shared clinical programs

9. Session Segments: • Recruitment • Reviews Preparatory to Research • The Double Standard - AMCs and Sponsors • Tissue Banking • Protecting PHI when PIs Leave Institutions • Authorizations for Future Research – OHRP and HIPAA Standards

10. Subject Recruitment Patricia Pearl O’Rourke, MD Partners HealthCare System

11. Subject Recruitment • Identification of potential subjects* • By advertisement • Treating physicians can provide info to patients with expectation that patients can contact the investigator if interested • Review of existing medical records HIPAA • Use of a Registry of persons interested in research participation HIPAA * All processes must be IRB approved

12. First Contact* • Potential participant contacts the investigator HIPAA • Investigator contacts the potential participant identified by review of existing medical records HIPAA • Investigator contacts the potential participant identified from a Research Participant Registry HIPAA * All processes must be IRB approved

13. Documentation of First Contact* • Documentation of only those who enroll HIPAA • Documentation of any potential participant who was screened – “Screening Log” • If any PHI is maintained HIPAA * All processes must be IRB approved

14. Work Preparatory to Research Gregg J. Fromell, MD Office of Human Research University of Pennsylvania, School of Medicine

15. HIPAA definition • Work Preparatory to Research - 164.512(i)(1)(ii) • “Use or disclosure is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research…”

16. Preparing for research • Preparing a protocol • Numbers of patients with disease target • Type and frequency of co-morbid states • Associated medical care factors • Medical therapies • Baseline study results (labs, ECGs, CXR, etc.) • Demographics • Gender • etc.

17. Preparing for research • Other similar purposes preparatory to research • Determine proportion of targeted population with interest in participating in research (protocol feasibility) • Provide a means to inform patients that a study exists and to aid patient decision to seek more information • Provide contact information for interested patients to come for further information and formal consenting/authorization

18. Supportive elements Items important to support work preparatory to research • Protocol preparation • NPP noting information could be used for research • Access to information only by appropriate members of the research team • None of the PHI provided is permitted to leave Covered entity • Documentation that information accessed is necessary to the research • Process to oversee the above • IRB or Privacy Board approval not required

19. Supportive elements Items important to support work preparatory to research • Other similar purposes preparatory to research • Previously noted items in last slide • IRB approval of study informational materials to be reviewed with patients/potential subjects • Institutional policies on how patients should be contacted, e.g. • through an institutional care-giver • by a researcher authorized by the care-giver or institution • directly by the researcher without care-giver approval in certain circumstances

20. Use of Research Data The Double Standard for AMCs & Sponsors Joanne E. Pollak, JD Johns Hopkins Medicine Baltimore, Maryland

21. What is the Issue? • AMCs generally are covered entities • Sponsors of research project generally are not covered entities • AMCs must describe all uses and disclosures of PHI in the HIPAA authorization • Sponsors often want to use PHI for: • future research • recruiting for future studies • advertising products • marketing surveys • marketing research • Participants cannot give a HIPAA authorization for future research • Other uses raise policy/ethical issues

22. Is Technical Compliance with HIPAA Enough? • AMCs, as covered entities, can tell participants that the sponsor is not a covered entity and that the AMC cannot guarantee that HIPAA protections will be followed by the sponsor when it receives their PHI • So long as the AMC tells the participant that the PHI is no longer protected, the AMC is in technical compliance with HIPAA • Yet many AMCs feel that passing on PHI to sponsors for these other uses is not appropriate or in keeping with the AMC’s relationship to the participant

23. What Can AMCs Do to Protect PHI? • Provide the minimum necessary PHI to sponsors • Get sponsors to agree to use and disclose PHI only for the purposes authorized for the specific study • Get sponsors to agree not to use and disclose PHI for specific purposes • future research • recruiting for future studies • advertising products • marketing surveys • marketing research

24. Tissue Banking Patricia Pearl O’Rourke, MD Partners HealthCare System

25. Tissue Banking • Banks are considered research protocols and require IRB approval • Common Rule allows consent for future unspecified research • HIPAA does not allow authorization for future unspecified research – authorizations must be specific • FDA regs disallow waiver of consent

26. Tissue Banks and HIPAA No Simple Answer • Is the bank within a covered entity? • Is the covered entity an ACE? • Is the covered entity a hybrid? • Is the bank a covered activity? • Is the bank NOT a covered activity?

27. Clinical Identifiable Anonymous Research Banking part of initial protocol Banking NOT part of initial protocol Identifiable Anonymous How Tissue Gets Into a Bank:IRB Issues BANK

28. Clinical Identifiable Anonymous Identifiable Anonymous Research Banking part of initial protocol Banking NOT part of initial protocol Identifiable Anonymous How Tissue Leaves the Bank:IRB Issues BANK

29. Clinical Identifiable Limited Data Set Coded Anonymous Research Banking part of initial protocol Banking NOT part of initial protocol Identifiable Limited Data Set Coded Anonymous How Tissue Gets Into a Bank:HIPAA Issues BANK

30. Clinical Identifiable Limited Data Set Coded Anonymous HIPAA Action Identifiable Limited Data Set Coded Anonymous Research Banking part of initial protocol Banking NOT part of initial protocol How Tissue Leaves the Bank:HIPAA Issues BANK Identifiable Limited Data Set Coded Anonymous

31. Protecting PHI When an Investigator Leaves an Institution Gregg J. Fromell, MD Office of Human Research University of Pennsylvania, School of Medicine

32. Investigator departure • Two scenarios when PIs leave an institution: • PI retains study responsibility • PI transfers responsibility to Covered Entity investigator

33. Scenario 1:PI retains responsibility • Documents PI is required to maintain: • Signed informed consent forms • Signed HIPAA authorization forms • Subject study files – information obtained from the subject by the study team: • including study logs such as subject screening and enrollment logs, etc. • Subject informational materials for patients/subjects • advertisements, • information sheets • brochures • Medical records from which source information is abstracted • Adverse events, including • tracking logs, • forms used to report adverse events (e.g. IND safety reports, MedWatch forms, summaries to study sponsor, etc.)

34. Scenario 1:PI retains responsibility • Documents PI is required to maintain: • Correspondence with • IRB, including IRB membership and Federal Wide Assurance, as well as study approval and continuing review and approval • Government regulatory bodies • Sponsor & contractors • Relevant internal correspondence with study team or institutional persons • Protocol (original approved, and all subsequent revised and approved versions) • Investigator brochure • Documentation of signatures and delegation of responsibility

35. Scenario 1:PI retains responsibility • Documents PI is required to maintain: • Laboratory documents, including laboratory certification and lab reference ranges, and any applicable laboratory manuals • Monitoring documentation • Monitoring visit tracking log • Monitoring reports (e.g. study initiation reports, monitoring visit reports, close out report) • CVs, medical licensees (as appropriate), and training documentation for study team investigators and sub-investigators

36. Scenario 1:PI retains responsibility • Review list of documents to determine which contain PHI and which original documents are required within the covered entity.

37. Scenario 2:PI transfers responsibility • Control of all records and PHI remains with the Covered Entity and newly assigned PI

38. Other things to consider • For both scenarios: • Notification of the IRB and study sponsor • Revision of FDA form 1572 (as appropriate) • Notification of research subjects • Should there be a formal confidentiality agreement completed between the exiting investigator and the institution? • Provision for ongoing oversight and processing of subjects if certain subjects cannot be directly managed by the investigator at the investigator’s new institution

39. Other things to consider • For Scenario 1, PI retains responsibility: • Previously noted times • How best to manage movement of PHI from the original institution to the new institution • does the action require formal disclosure tracking or not, and if not, what are the provisions to support that claim? • How to manage the relationship and HIPAA requirements when investigators must have access to subject medical records stored at the original institution? • Issue of re-consenting and re-authorization and which institution has the obligation and authority to require either.

40. Authorization for Future Research OHRP & OCR Positions Joanne E. Pollak, JD Johns Hopkins Medicine Baltimore, Maryland

41. What is the Issue? • Two federal regulatory agencies have different views on an individual’s ability to consent to future, unspecified research • Office of Human Research Protection (OHRP) allows consent for future research if explained with as much specificity as possible; examples: • future research related to colon cancer; • future research related to immune deficiency and related diseases. • Office of Civil Rights (OCR) does not allow authorization for future research because, in their view, specificity is not possible

42. Why is This a Problem? • Confusion for the participant • Assigns informed consent for current and future research • signs HIPAA authorization for current research • gets subsequent HIPAA authorization forms for future research in which the participant is not “enrolled” • Confusion for IRBs • IRB must require a new authorization for future research if “practicable” • IRB often must waive authorization — but wonders why it must do so when there already is informed consent • Waiver triggers HIPAA accounting requirements which the IRB thinks is silly since the participant gave informed consent for the future research

43. Facilitator Slides

44. Question 1 • On a scale of 1-4, how would you rank your institution’s degree of impact of HIPAA on the volumes or qualities of new clinical trials research recruitment? Responses can range from: • It has significantly affected our recruitment efforts • It has affected our recruitment efforts • It has minimally affected our recruitment efforts • It has not affected our recruitment efforts

45. Question 2 • Are there other conditions or situations that you feel have had a greater degree of effect on the recruitment efforts aside from HIPAA? • They are…. • Why do you feel this is so?....