180 likes | 274 Views
Patient Health Information and HIPAA. First Meeting for Researchers Frank Fontana December 17, 2002. Research Issues – FAHC Data. As everyone knows, there is an extremely close relationship between UVM and FAHC
E N D
Patient Health Information and HIPAA First Meeting for Researchers Frank Fontana December 17, 2002
Research Issues – FAHC Data • As everyone knows, there is an extremely close relationship between UVM and FAHC • The relationship is so close that it is easy to not recognize the separate identity of each legal entity • The Privacy Rule forces us to acknowledge and respect the legal distinctions
Research Issues – FAHC Data • Why does it force us to do that? • Because disclosures of health information from a covered entity (like FAHC) to any other entity (like UVM) must be justified by a specific provision in the Privacy Rule • So now let’s consider the FAHC data and how it flows for research projects
Research Issues – FAHC Data • And remember – with some exceptions, there either has to be an authorization from a patient to release information for research, or the IRB has to waive or alter the authorization requirement • So, when UVM desires access to FAHC patient information for research, because UVM is performing the research, UVM must produce for FAHC either an authorization or an IRB waiver
Research Issues – FAHC Data • When FAHC is performing the research, FAHC is responsible for obtaining the authorization or the IRB waiver • Another issue with respect to the separation between UVM and FAHC – we have to remain very aware of disclosures between the two entities, and think about whether they are justified by the Privacy Rule
Research Issues – FAHC Data • In other words, if FAHC is the researcher for a certain study, the Privacy Rule may very well prohibit FAHC from freely sharing the research records with UVM • Conversely, if UVM is the researcher, the Privacy Rule may prohibit UVM from freely sharing the research records with FAHC
Research – Other Issues • We have to think in terms of recruitment and the actual study – we need to focus on what obligations exist at each stage, because they may very well be different • We should also focus on where research records are kept, as FAHC will assume additional HIPAA burdens when it houses the records – so, when UVM is the researcher, is it necessary for FAHC to have copies of the research records?
Research Issues – 2 Fact Patterns • Let’s briefly address 2 possible fact patterns, and discuss how those facts might implicate Privacy Rule obligations
Case 1 • AH, MD Pediatric Oncologist with appointments at both FAHC and UVM College of Medicine • Wears multiple hats • Treating Oncologist • Clinical Researcher • Children’s Oncology Group (COG) • Translational Researcher collaborating with colleagues at UVM/VRCC
Case 1 Continued • Referred child newly diagnosed with leukemia • AH wants to enroll the child in multiple research studies: • Therapeutic Regimen • Biologic studies of leukemia at COG • Biologic studies of mutagenesis at UVM • What information may AH share with whom and how?
Possible Analysis of Case 1 • Our first task is to determine who is performing the research – FAHC or UVM • Let’s assume that in each case the research is federally funded, and that under the Affiliation Agreement, UVM is responsible for the research • Ok – then let’s view the research in terms of recruitment and the study itself
Possible Analysis of Case 1 • First, does UVM need a waiver of the authorization requirement before AH can contact the child’s parents about the studies? • More accurately, does FAHC need for UVM to produce such a waiver? • A difficult issue, and one we are discussing - a conservative view is that UVM needs to get the waiver
Possible Analysis of Case 1 • As for the study itself, UVM would likely have to obtain an authorization, and then share that authorization with FAHC • Upon receipt of the authorization, FAHC can make its health information available to UVM for the study • The authorization has to identify how the health information will flow, and to whom it will flow – so if FAHC or others need information access, that has to be identified in the authorization
Case 2 • Now let’s assume that the research at issue is a clinical trial sponsored by a private entity, such as a pharmaceutical company • Let’s further assume that under the Affiliation Agreement, FAHC is considered the researcher for such clinical trials • And, let’s again assume that AH is directly involved in the research efforts
Possible Analysis of Case 2 • Any differences between these two cases?
Possible Analysis of Case 2 • Yes, at least potentially • In this case, FAHC is the researcher, and so it does not need to justify a disclosure of health information for recruitment • As a result, AH can contact the research participants for recruitment, without IRB involvement
Possible Analysis of Case 2 • How about for the study itself? • FAHC needs to obtain the authorization, not UVM, because FAHC is the researcher • Remember, the authorization has to identify how the health information will flow, and to whom it will flow – so if UVM or others need information access, that has to be identified in the authorization
Research Issues • In sum, we need to remember that FAHC and UVM are distinct legal entities and that the distinction is important under the Privacy Rule