Patient Health Information and HIPAA

1
Patient Health Information and HIPAA

• First Meeting for
• Researchers
• Frank Fontana
• December 17, 2002

2
Research Issues FAHC Data

• As everyone knows, there is an extremely close
  relationship between UVM and FAHC
• The relationship is so close that it is easy to
  not recognize the separate identity of each legal
  entity
• The Privacy Rule forces us to acknowledge and
  respect the legal distinctions

3
Research Issues FAHC Data

• Why does it force us to do that?
• Because disclosures of health information from a
  covered entity (like FAHC) to any other entity
  (like UVM) must be justified by a specific
  provision in the Privacy Rule
• So now lets consider the FAHC data and how it
  flows for research projects

4
Research Issues FAHC Data

• And remember with some exceptions, there either
  has to be an authorization from a patient to
  release information for research, or the IRB has
  to waive or alter the authorization requirement
• So, when UVM desires access to FAHC patient
  information for research, because UVM is
  performing the research, UVM must produce for
  FAHC either an authorization or an IRB waiver

5
Research Issues FAHC Data

• When FAHC is performing the research, FAHC is
  responsible for obtaining the authorization or
  the IRB waiver
• Another issue with respect to the separation
  between UVM and FAHC we have to remain very
  aware of disclosures between the two entities,
  and think about whether they are justified by the
  Privacy Rule

6
Research Issues FAHC Data

• In other words, if FAHC is the researcher for a
  certain study, the Privacy Rule may very well
  prohibit FAHC from freely sharing the research
  records with UVM
• Conversely, if UVM is the researcher, the Privacy
  Rule may prohibit UVM from freely sharing the
  research records with FAHC

7
Research Other Issues

• We have to think in terms of recruitment and the
  actual study we need to focus on what
  obligations exist at each stage, because they may
  very well be different
• We should also focus on where research records
  are kept, as FAHC will assume additional HIPAA
  burdens when it houses the records so, when UVM
  is the researcher, is it necessary for FAHC to
  have copies of the research records?

8
Research Issues 2 Fact Patterns

• Lets briefly address 2 possible fact patterns,
  and discuss how those facts might implicate
  Privacy Rule obligations

9
Case 1

• AH, MD Pediatric Oncologist with appointments at
  both FAHC and UVM College of Medicine
• Wears multiple hats
• Treating Oncologist
• Clinical Researcher
• Childrens Oncology Group (COG)
• Translational Researcher collaborating with
  colleagues at UVM/VRCC

10
Case 1 Continued

• Referred child newly diagnosed with leukemia
• AH wants to enroll the child in multiple research
  studies
• Therapeutic Regimen
• Biologic studies of leukemia at COG
• Biologic studies of mutagenesis at UVM
• What information may AH share with whom and how?

11
Possible Analysis of Case 1

• Our first task is to determine who is performing
  the research FAHC or UVM
• Lets assume that in each case the research is
  federally funded, and that under the Affiliation
  Agreement, UVM is responsible for the research
• Ok then lets view the research in terms of
  recruitment and the study itself

12
Possible Analysis of Case 1

• First, does UVM need a waiver of the
  authorization requirement before AH can contact
  the childs parents about the studies?
• More accurately, does FAHC need for UVM to
  produce such a waiver?
• A difficult issue, and one we are discussing - a
  conservative view is that UVM needs to get the
  waiver

13
Possible Analysis of Case 1

• As for the study itself, UVM would likely have to
  obtain an authorization, and then share that
  authorization with FAHC
• Upon receipt of the authorization, FAHC can make
  its health information available to UVM for the
  study
• The authorization has to identify how the health
  information will flow, and to whom it will flow
  so if FAHC or others need information access,
  that has to be identified in the authorization

14
Case 2

• Now lets assume that the research at issue is a
  clinical trial sponsored by a private entity,
  such as a pharmaceutical company
• Lets further assume that under the Affiliation
  Agreement, FAHC is considered the researcher for
  such clinical trials
• And, lets again assume that AH is directly
  involved in the research efforts

15
Possible Analysis of Case 2

• Any differences between these two cases?

16
Possible Analysis of Case 2

• Yes, at least potentially
• In this case, FAHC is the researcher, and so it
  does not need to justify a disclosure of health
  information for recruitment
• As a result, AH can contact the research
  participants for recruitment, without IRB
  involvement

17
Possible Analysis of Case 2

• How about for the study itself?
• FAHC needs to obtain the authorization, not UVM,
  because FAHC is the researcher
• Remember, the authorization has to identify how
  the health information will flow, and to whom it
  will flow so if UVM or others need information
  access, that has to be identified in the
  authorization

18
Research Issues

• In sum, we need to remember that FAHC and UVM are
  distinct legal entities and that the distinction
  is important under the Privacy Rule