Research and Protected Health Information

Op10.04-10 Research and Protected Health Information

Purpose

To protect the use and disclosure of protected health information at Missouri State University in accord with HIPAA (45 CFR 164.512(i), .501, .508, .514(e), .528, and .532). In the course of conducting research, researchers may obtain, create, use and/or disclose protected health information for research with individual authorization, or without individual authorization as permitted in this procedure.

Application

Applies to Missouri State University, its Health Care Components (HCC) and workforce

Definitions
1. Patient/Research Participant: Any individual who has received or is receiving health care and/or who is a research subject.
2. Disclosure: The release, transfer, provision of access to, or divulging in any other manner of information outside the facility holding the information.
3. Psychotherapy notes: Notes recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the patient’s medical record. Such notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress notes to date.
4. Protected Health Information (PHI): Individually identifiable health information as defined at HIPAA Procedure 1.005, 1.b. and c
Procedure
1. Research Use/Disclosure without Authorization. To use or disclose protected health information without authorization by the research participant, a Missouri State researcher must obtain one of the following:
  1. 1. Documented Institutional Review Board (IRB). Documentation that an alteration or waiver of research participants authorization for use/disclosure of information about them for research purposes has been approved by the University IRB, for example, to conduct records research, when researchers are unable to use de-identified information, and the research could not practicably be conducted if research participant's authorization were required.
    2. Research entity may use or disclose protected health information for research purposes pursuant to a waiver of authorization by the IRB, provided it has obtained documentation of all of the following:
      1. Identification of the IRB and the date on which the alteration or waiver of authorization was approved;
      2. A statement that the IRB has determined that the alteration or waiver of authorization, in whole or in part, satisfies the three criteria set forth following in (c);
      3. A brief description of the protected health information for which use or access has been determined to be necessary by the IRB;
      4. A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures; and
      5. The signature of the chair or other member, as designated by the chair, of the IRB.
    3. The following three criteria must be satisfied for an IRB to approve a waiver of authorization:
      1. The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
        
        an adequate plan to protect the identifiers from improper use and disclosure;
        
        an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
        
        adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;
      2. The research could not practicably be conducted without the waiver or alteration; and
      3. The research could not practicably be conducted without access to and use of the protected health information.
  2. Preparatory to Research. Representations from the researcher, that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purposes preparatory to research, that the researcher will not remove any protected health information from the covered entity, and representation that protected health information for which access is sought is necessary for the research purpose. See 45 CFR 164.512(i)(1)(ii). This provision might be used, for example, to design a research study or to assess the feasibility of conducting a study.
  3. Research on Protected Health Information of Decedents. Representations from the researcher, that the use or disclosure being sought is solely for research on the protected health information of decedents, that the protected health information being sought is necessary for the research, and, at the request of the health care entity, documentation of the death of the individuals about whom information is being sought. See 45 CFR 164.512(i)(1)(iii).
  4. Limited Data Sets with a Data Use Agreement. A data use agreement entered into by both the health care entity and the researcher, pursuant to which the health care entity may disclose a limited data set to the researcher for research, public health, or health care operations. See 45 CFR 164.514(e). A limited data set excludes specified direct identifiers of the individual or of relatives, employers, or household members of the individual. The data use agreement must:
    1. Establish the permitted uses and disclosures of the limited data set by the recipient, consistent with the purposes of the research, and which may not include any use or disclosure that would violate the law if done by the health care entity;
    2. Limit who can use or receive the data; and
    3. Require the recipient to agree to the following:
      1. Not to use or disclose the information other than as permitted by the data use agreement or as otherwise required by law;
      2. Use appropriate safeguards to prevent the use or disclosure of the information other than as provided for in the data use agreement;
      3. Report to the covered entity any use or disclosure of the information not provided for by the data use agreement of which the recipient becomes aware;
      4. Ensure that any agents, including a subcontractor, to whom the recipient provides the limited data set agrees to the same restrictions and conditions that apply to the recipient with respect to the limited data set; and
      5. Not to identify the information or contact the individual.
2. Research Use/Disclosure with Individual Authorization. HIPAA also permits covered entities to use or disclose protected health information for research purposes when a research participant authorizes the use or disclosure of information about him or herself. Today, for example, a research participant's authorization will typically be sought for most clinical trials and some records research. In this case, documentation of IRB or Privacy Board approval of a waiver of authorization is not required for the use or disclosure of protected health information.
  
  To use or disclose protected health information with authorization by the research participant, the covered entity must obtain an authorization that satisfies the requirements of 45 CFR 164.508. The Privacy Rule has a general set of authorization requirements that apply to all uses and disclosures, including those for research purposes. However, several special provisions apply to research authorizations:
  1. Unlike other authorizations, an authorization for a research purpose may state that the authorization does not expire, that there is no expiration date or event, or that the authorization continues until the A end of the research study;@ and
  2. An authorization for the use or disclosure of protected health information for research may be combined with a consent to participate in the research, or with any other legal permission related to the research study.
3. Accounting for Research Disclosures. In general, HIPAA gives individuals the right to receive an accounting of certain disclosures of protected health information made by a covered entity. See 45 CFR 164.528. This accounting must include disclosures of protected health information that occurred during the six years prior to the individual's request for an accounting, or since the applicable compliance date (whichever is sooner), and must include specified information regarding each disclosure. A more general accounting is permitted for subsequent multiple disclosures to the same person or entity for a single purpose. See 45 CFR 164.528(b)(3). Among the types of disclosures that are exempt from this accounting requirement are:
  1. Research disclosures made pursuant to an individual's authorization;
  2. Disclosures of the limited data set to researchers with a data use agreement under 45 CFR 164.514(e).
    
    In addition, for disclosures of protected health information for research purposes without the individual's authorization pursuant to 45 CFR164.512(i), and that involve at least 50 records, HIPAA allows for a simplified accounting of such disclosures where health care entities may provide individuals with a list of all protocols for which the patient's PHI may have been disclosed under 45 CFR 164.512(i), as well as the researcher's name and contact information. Other requirements related to this simplified accounting provision are found in 45 CFR 164.528(b)(4).
4. Transition Provisions. Under HIPAA, a health care entity may use and disclose protected health information that was created or received for research, either before or after the compliance date, if the covered entity obtained any one of the following prior to April 14, 2003:
  1. An authorization or other express legal permission from an individual to use or disclose protected health information for the research;
  2. The informed consent of the individual to participate in the research; or
  3. A waiver of informed consent by an IRB in accordance with the Common Rule or an exception under FDA's human subject protection regulations at 21 CFR 50.24.
Review Process. The University Privacy Officer will collect information from the Unit Privacy Officers during the month of April each year beginning in 2004 for the purpose of providing feedback to the HIPAA Management Team as to compliance with the procedure and any proposed modification or recommendation that additional training be implemented.
Sanctions. Failure to comply or assure compliance with the policy may result in disciplinary action, up to and including dismissal.

HISTORY: Effective March 21, 2003