Patient Health Information and HIPAA

1. Patient Health Information and HIPAA First Meeting for Researchers Frank Fontana December 17, 2002

2. Research Issues – FAHC Data • As everyone knows, there is an extremely close relationship between UVM and FAHC • The relationship is so close that it is easy to not recognize the separate identity of each legal entity • The Privacy Rule forces us to acknowledge and respect the legal distinctions

3. Research Issues – FAHC Data • Why does it force us to do that? • Because disclosures of health information from a covered entity (like FAHC) to any other entity (like UVM) must be justified by a specific provision in the Privacy Rule • So now let’s consider the FAHC data and how it flows for research projects

4. Research Issues – FAHC Data • And remember – with some exceptions, there either has to be an authorization from a patient to release information for research, or the IRB has to waive or alter the authorization requirement • So, when UVM desires access to FAHC patient information for research, because UVM is performing the research, UVM must produce for FAHC either an authorization or an IRB waiver

5. Research Issues – FAHC Data • When FAHC is performing the research, FAHC is responsible for obtaining the authorization or the IRB waiver • Another issue with respect to the separation between UVM and FAHC – we have to remain very aware of disclosures between the two entities, and think about whether they are justified by the Privacy Rule

6. Research Issues – FAHC Data • In other words, if FAHC is the researcher for a certain study, the Privacy Rule may very well prohibit FAHC from freely sharing the research records with UVM • Conversely, if UVM is the researcher, the Privacy Rule may prohibit UVM from freely sharing the research records with FAHC

7. Research – Other Issues • We have to think in terms of recruitment and the actual study – we need to focus on what obligations exist at each stage, because they may very well be different • We should also focus on where research records are kept, as FAHC will assume additional HIPAA burdens when it houses the records – so, when UVM is the researcher, is it necessary for FAHC to have copies of the research records?

8. Research Issues – 2 Fact Patterns • Let’s briefly address 2 possible fact patterns, and discuss how those facts might implicate Privacy Rule obligations

9. Case 1 • AH, MD Pediatric Oncologist with appointments at both FAHC and UVM College of Medicine • Wears multiple hats • Treating Oncologist • Clinical Researcher • Children’s Oncology Group (COG) • Translational Researcher collaborating with colleagues at UVM/VRCC

10. Case 1 Continued • Referred child newly diagnosed with leukemia • AH wants to enroll the child in multiple research studies: • Therapeutic Regimen • Biologic studies of leukemia at COG • Biologic studies of mutagenesis at UVM • What information may AH share with whom and how?

11. Possible Analysis of Case 1 • Our first task is to determine who is performing the research – FAHC or UVM • Let’s assume that in each case the research is federally funded, and that under the Affiliation Agreement, UVM is responsible for the research • Ok – then let’s view the research in terms of recruitment and the study itself

12. Possible Analysis of Case 1 • First, does UVM need a waiver of the authorization requirement before AH can contact the child’s parents about the studies? • More accurately, does FAHC need for UVM to produce such a waiver? • A difficult issue, and one we are discussing - a conservative view is that UVM needs to get the waiver

13. Possible Analysis of Case 1 • As for the study itself, UVM would likely have to obtain an authorization, and then share that authorization with FAHC • Upon receipt of the authorization, FAHC can make its health information available to UVM for the study • The authorization has to identify how the health information will flow, and to whom it will flow – so if FAHC or others need information access, that has to be identified in the authorization

14. Case 2 • Now let’s assume that the research at issue is a clinical trial sponsored by a private entity, such as a pharmaceutical company • Let’s further assume that under the Affiliation Agreement, FAHC is considered the researcher for such clinical trials • And, let’s again assume that AH is directly involved in the research efforts

15. Possible Analysis of Case 2 • Any differences between these two cases?

16. Possible Analysis of Case 2 • Yes, at least potentially • In this case, FAHC is the researcher, and so it does not need to justify a disclosure of health information for recruitment • As a result, AH can contact the research participants for recruitment, without IRB involvement

17. Possible Analysis of Case 2 • How about for the study itself? • FAHC needs to obtain the authorization, not UVM, because FAHC is the researcher • Remember, the authorization has to identify how the health information will flow, and to whom it will flow – so if UVM or others need information access, that has to be identified in the authorization

18. Research Issues • In sum, we need to remember that FAHC and UVM are distinct legal entities and that the distinction is important under the Privacy Rule