AMC Privacy & Security: Progress & Prospects September 26-28, 2006

1. Clinical Research TrackTying Up Loose Ends in ResearchMaria J. Pekar, MBA, JDLoyola University Health SystemNanci Hawley RN NPMayo Foundation Office of Human Research Protection AMC Privacy & Security: Progress & ProspectsSeptember 26-28, 2006

2. Quick Background on Disclosures

3. Accounting Right • An individual has a right to receive an accounting of disclosures of PHI made by a CE in the six years prior to the date on which the accounting is requested, except for disclosures: • To carry out TPO • To the individual • Incidental disclosures if permitted & minimum necessary applied & safeguards in place • With the individual’s authorization • For the facility’s directory or for notification purposes • National security or intelligence purposes • Correctional institutions or law enforcement officials • In a limited data set if applicable • Prior to compliance date

4. Disclosure Defined • The release, transfer, provision of access to or divulging in any other manner of information outside the entity holding the information.

5. Required by law Public health activities About victims of abuse, neglect or domestic violence Health oversight activities Judicial & administrative proceedings Law enforcement About decedents Organ/tissue donations Some research Averting Serious Threats Special government functions Workers Compensation The 512 Nightmare

6. Research Accounting >50 • The name of the protocol or other research activity; • A description, in plain language, of the research protocol or other research activity, including the purpose of the research & the criteria for selecting particular records • A brief description of the type of PHI that was disclosed; • The date or period of time during which such disclosures occurred, or may have occurred, including the date of the last such disclosure during the accounting period; • The name, address and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed; and • A statement that the PHI of the individual may or may not have been disclosed for a particular protocol or other research activity.

7. What is Outside? • Separate but related corporations • Parent/subsidiary corporations • Could be Contract Research Organizations • All 512s • Waived Research & Preparatory to Research includes • Sponsors • Manufacturers • Remember Business Associates are OK

8. Loyola University Health SystemTying up Loose Ends in Research“See the Quality in Compliance” September 26-28, 2005 Maria J. Pekar, MBA, JD Associate Vice President & Staff Attorney Corporate Compliance & Internal Audit Loyola University Health System

9. Disclaimer In the immortal words of Sergeant Schultz, "I know NOTHING." Page 9

10. About us University Health System Schoolof Nursing School of Medicine Other Company Other interest #1 Physician Foundation Medical Center Other interest #2 Hospital (523 beds) Home Care and Hospice Children's Hospital Cancer Center OutpatientCenter Emergency MedicalServices Satellite Ambulatory Care Sites (15) Other Business KEY Corporation Operating Unit Page 10

11. Page 11

12. Type of Work Date Opened = >7/1/xx Page 12

13. IRB Background • About 400 open studies • ~99% get authorizations • ~1% waived • About 200 of PIs • Faculty (closed staff) • Nursing • Social Work • Institutional Review Board • 18 members • Meet monthly Page 13

14. Capturing • Develop a process • Revise your consent • Write a policy • Build a database • Communicate to all • e.g. Faculty, Staff and students • Patients in your Notice of Privacy Practices • PRAY Page 14

15. Page 15

16. Page 16

17. In Our Notice • To be included in research projects. • As an academic medical center, Loyola has active research programs that include studies that may involve your current care or a review of your medical history. We generally ask for your written authorization before using your medical information or sharing it with others in order to conduct research. Under limited circumstances, we may use and disclose your medical information without your authorization. Information is only used without your approval if we obtain an independent review to ensure that research conducted without your authorization poses minimal riak to your privacy. Otherwise, only limited information, falling within the government privacy protections guidelines, are used. Page 17

18. Our Approach • Compliance & IRB communicate well • Educate IRB early and often • Limit disclosures • Use transitional safe-harbor sparingly & re-consent active studies • Wear “covered entity” hat when applicable • Facts and circumstances analysis • Health care operations • Internal auditing • Be pragmatic Page 18

19. Avoidance in Research • Get authorizations • Proscribe disclosures for waived studies • Use Data Use Agreements • Provide “broad” research accounting reports • De-identify it • Route most everything through IRB • Make the PIs track it Page 19

20. Contact Info • Maria J. Pekar, MBA, JD • Loyola University Medical Center • 2160 So. First Avenue • Building 101 – Room 1752 • Maywood, IL 60153 • 708/216-8686 • mpekar@lumc.edu Page 20

21. TYING UP LOOSE ENDS IN RESEARCHSeptember 26-28, 2005 Nanci Hawley RN NP Mayo Foundation Office of Human Research Protection Compliance Coordinator

22. Simplified Infrastructure Overview

24. Director Administrator Administrative Committee Office Support Compliance Coordinator Education Program Serious Adverse Events Board Orange Thursday Full Board OrangeFriday Full Board Blue Thursday Full Board Blue Friday Full Board Expedited Review Committee Expedited Review Committee Expedited Review Committee Review Committee Expedited Mayo Foundation Office for Human Research Protection

25. IRB Total Active Studies

26. Office of Human Research Protection (IRB) • Provide a notification pathway for research personnel to identify unauthorized research compliance • Provide guidance in handling research related activities • Investigate and provide recommendations in areas of research compliance • Education

27. Possible Types of Research Disclosures • Protected Health Information • Financial Information • Personal Information

28. Possible Protected Health Information (PHI) Disclosures • Diagnosis of disease (sharing of PHI within an institution for non-therapeutic studies without a Review Preparatory to Research • Disclosure to an outside recruiting firm of a patient database for both therapeutic and non-therapeutic studies • Providing a detailed screening log to an industry sponsor for recruitment of a study • Not obtaining written HIPAA with verbally consented studies

29. Possible Financial Information Disclosures • Providing economic information without prior approval or participant authorization (research study specific)

30. Possible Personal InformationDisclosures • Disclosure of demographic information (e.g. address, SSN, income) through computer technology

31. Tracking of Research Disclosures with the IRB • Annual/continuing progress reports • Industry sponsored monitoring reports • Self reporting (deviation forms) • Participant/research personnel disclosure • Review Preparatory to Research • Communications within IRB approval to legal contracting, financial services

32. Changes since HIPAA(April 14th, 2003) • Education Programs • Written authorizations to use and disclose protected health information (separate authorization for verbally consented studies or joint written consent and authorization) • Reviews Preparatory to Research

33. Changes since HIPAA • Documentation in correspondence to investigator within IRB approval to the type of HIPAA authorization necessary • Recruiting methods into new studies • Logistical changes in research activities/department (e.g. survey research)

34. Question 1 • On a scale of 1-5, where do you think your organization is relative to IRB compliance with HIPAA disclosures? (1- least compliant; 5-most compliant)

35. Question 2 • Has your organization done anything differently when handling clinical research since the implementation of HIPAA? • If so, what and has it been effective?

36. Question 3 • In your organization what is the greatest challenge when dealing with research and disclosures?