CLC Comments on Proposed Changes to HIPAA Privacy Rule
(September 13, 2010)
September 13, 2010
U. S. Department of Health and Human Services
Office of Civil Rights
Attention: HITECH Privacy and Security Rules Modifications
Hubert H. Humphrey Building
Room 509F
200 Independence Avenue, SW
Washington, D.C. 20201
Re: RIN 0991-AB57
The undersigned organizations of the Cancer Leadership Council, representing cancer patients, researchers, and health professionals, applaud the Office of Civil Rights (OCR) for the proposed rule implementing changes to the HIPAA Privacy, Security, and Enforcement Rules mandated by the Health Information Technology for Economic and Clinical Health Act (HITECH) and recommending changes in the HIPAA Privacy Rule to enhance individuals’ access to their medical records and facilitate important research that utilizes protected health information (PHI). We are pleased that OCR carefully evaluated the recommendations related to HIPAA and research from the Institute of Medicine and the Secretary’s Advisory Committee for Human Research Protections, along with almost a decade of HIPAA compliance and enforcement history, to develop research-related revisions to the Privacy Rule.
We are offering comments on: 1) proposed changes to the Privacy Rule to permit individuals to have electronic access to their medical records and to limit the charges that may be imposed for such access, 2) the proposal to permit compound authorizations that would combine conditioned and nonconditioned authorizations, and 3) the request for public input on the standards for authorizations for future research use of PHI in data repositories.
Access of Individuals to Protected Health Information
The proposed rule would implement the HITECH Act provision that health care providers maintaining electronic health records ensure their patients access to their records in electronic form. We are pleased that the proposed rule would also make that requirement of electronic access a standard of the HIPAA Privacy Rule, effectively extending it to all HIPAA covered entities. By taking this action, OCR will help to provide more consumers access to their records in a usable electronic format and will provide incentives for more rapid acceptance and utilization of electronic health records.
OCR has requested public comment on its presumption that most covered entities have the capability to provide individuals access to their records in an electronic form (web-based portal, e-mail, portable electronic media, or other means). We anticipate that the agency will receive feedback that some covered entities are not yet equipped to meet this requirement of electronic access to PHI. In that circumstance, we urge the agency not to abandon this provision but instead to provide a transition period during which it would permit those covered entities that do not have electronic capability to meet the access requirement through other means.
The proposed rule further protects individual access to PHI by limiting the charges for access to PHI to a reasonable cost-based fee that would include the labor costs associated with meeting the request and the cost of the electronic media necessary to provide access to the data. We support the proposed limit on charges that may be imposed.
Compound Authorization
There are significant potential benefits both to researchers and research participants resulting from the recommendation to permit compound authorizations. A compound authorization might include a conditioned authorization for use of PHI in connection with enrollment in a clinical trial and a nonconditioned authorization for use and disclosure of PHI in connection with a research database.
It is now a common circumstance for cancer research teams to undertake correlative studies in connection with a clinical trial, an approach that may be especially important for advancing research and development of therapies that are targeted to specific populations of cancer patients. Permitting a compound document that would include the trial authorization (the conditioned authorization) and the research database authorization (the nonconditioned authorization) might serve to clarify and strengthen the research consent and authorization process for clinical trial participants. In the current situation, research participants must review and sign multiple consent forms if they are to participate in a clinical trial and also permit the use and disclosure of PHI in a database. Those participating in this consent process note that the repetition of forms is not necessarily useful and instead can be confusing.
The recommendation to permit a compound authorization form holds the potential for eliminating redundancy in the language of the form and highlighting the relationship between the clinical research study and correlative research effort and the risks and benefits of each. We believe that such a form, combined with a clear opt-in opportunity for participation in the correlative study, would serve the interests of patients.
We support the recommendation by OCR to permit a compound authorization and endorse the use of the opt-in mechanism for the nonconditioned research authorization.
Authorizing Future Research Use or Disclosure
The CLC includes researchers, research participants, and advocates for research participants, and we have shared significant frustrations as a result of the current standards for future research use. Our shared experience has been seeing PHI – a potentially valuable research asset – remain out of reach for important research endeavors because the initial authorization did not anticipate a certain research study, and an institutional review board (IRB) or Privacy Board, on that basis, refused to grant a waiver of authorization for use of the data. We are pleased that OCR is considering a remedy through a modification in the standards for authorizations for future research use.
Individuals who permit the use and disclosure of their PHI to a database want assurances that their PHI will be treated with care and that there will not be breaches resulting in harmful publication of their data. However, it is our experience that patients do not demand an authorization that details with great specificity the future research uses of their data.
We endorse the first option described by OCR, which is an “authorization for uses and disclosures of protected health information for future research purposes to the extent such purposes are adequately described in the authorization such that it would be reasonable for the individual to expect that his or her protected health information could be used or disclosed for such future research.” We also recommend that individuals be assured that future research uses will be reviewed by IRBs to “determine that the new research is not incompatible with the initial consent.” This can be accomplished by way of the recommendation from OCR that the changes in the future research authorization language be coordinated with the Office of Human Research Protections and Food and Drug Administration to ensure harmonization with their human subjects protections regulations.
We agree that any revision of the Privacy Rules should protect an individual’s right to revoke his or her authorization for the use and disclosure of information for future research needs. By way of a guidance document, OCR might share the experience of research institutions that secure active participation in databases and future research utilizing those sources. Some institutions foster ongoing participation in research, and also minimize the risk of revocation of authorization, by reporting to research participants regarding studies that utilize PHI in databases. Such reports do not include data about use of specific individuals’ data but instead provide altruistic research participants information on the institution’s overall research effort, information that conveys the benefits and achievements related to their involvement in research.
***
We appreciate the opportunity to comment on these sections of the proposed rule and look forward to publication of final rules that include modifications of the future research authorization standards.
Sincerely,
Cancer Leadership Council
American Society of Clinical Oncology
Bladder Cancer Advocacy Network
C3: Colorectal Cancer Coalition
Cancer Support Community
Coalition of Cancer Cooperative Groups
Education Network to Advance Cancer Clinical Trials (ENACCT)
International Myeloma Foundation
Kidney Cancer Association
The Leukemia & Lymphoma Society
Lymphoma Research Foundation
Multiple Myeloma Research Foundation
National Coalition for Cancer Survivorship
National Lung Cancer Partnership
National Patient Advocate Foundation
Ovarian Cancer National Alliance
Pancreatic Cancer Action Network
Prevent Cancer Foundation
Sarcoma Foundation of America
Us TOO International Prostate Cancer Education and Support Network
About
CLC | What's New |
Policy Issues |
Participants' Login
Home | Sitemap
| Contact Info
Copyright
© 2001-2002 Cancer Leadership Council. All rights reserved.
Please send comments and suggestions to webmaster@cancerleadership.org.