TOXICOGENOMICS AND THE WORKPLACE

1
TISSUE REPOSITORIES THE COMMON RULE and THE
HIPAA PRIVACY RULE Mark A. Rothstein,
J.D. Herbert F. Boehl Chair of Law and
Medicine Director, Institute for Bioethics,
Health Policy and Law University of Louisville
School of Medicine
2

• 1. Coverage
• Neither the Common Rule nor the Privacy Rule has
  comprehensive coverage.
• Common Rule coverage is based on relationship
  to federal government (i.e., federal funding, FDA
  submission, MPA)

3

• Privacy Rule coverage is based on relationship
  to electronic claims submission (i.e., health
  providers, health plans, health clearinghouses)
• The gaps in coverage are not parallel, and
  efforts to expand coverage of both rules have not
  met with success.

4

• 2. Applicability to Tissue Repositories
• Neither the Common Rule nor the Privacy Rule was
  drafted with a contemplation of development of
  vast biobanks, large-scale automated analytical
  tools, electronic health records and networks,
  and population-wide studies.

5

• 3. Differences Between theCommon Rule and the
  Privacy Rule
• There are several important variations between
  the two rules.
• Sometimes the provisions of the Common Rule are
  more burdensome for researchers sometimes the
  provisions of the Privacy Rule are more
  burdensome.
• The differences have been noted in the PRIMR
  report and other studies.

6

• In letters to the Secretary of HHS in November
  2001 and March 2004, the National Committee on
  Vital and Health Statistics (NCVHS) recommended
  harmonization of the Common Rule and the Privacy
  Rule.
• A trans-HHS working group was established in late
  2006 to consider the issue.

7

• 4. Key Differences of Particular Relevance to
  Tissue Repositories
• Example 1 Consent for Unspecified Future Uses
• Common Rule Blanket consent for future use is
  disfavored but not prohibited. Tiered consent
  often is used to designate broad categories of
  approved research uses of specimens.

8

• Privacy Rule Study specific authorization or
  study-specific waiver of authorization is
  required for disclosure of PHI.

9

• There is a problem with authorization for
  prospective disclosure of health records.
• At the time of initial authorization, an
  individual may not have sensitive information
  (e.g., mental health, STD) in his or her record.
• The individual is unlikely to realize that there
  could be unlimited, future disclosures of all
  health information.

10

• One possible solution is to authorize unspecified
  uses (through tiered authorization), but limit
  additions to the health record to a period of
  years (e.g., 5 years), and to require new
  authorization.

11

• Example 2 Identifiability
• Identifiability is a key concept for both the
  Common Rule (exemption 4 45 CFR 46.101(b)(4))
  and the Privacy Rule (45 CFR 164.514(a)).
• The standards for de-identification are
  different (of course).

12

• Both rules have the same premise If the
  specimens or data are not identifiable, then
  there are no significant risks to the welfare or
  privacy of the subject/individual.

13

• This assumption may not be valid.
• Identifiability should be only one factor in
  determining whether there are more than de
  minimis risks to the subject/individual.
• De-identified information may produce
  substantial harms
• Ease of re-identification
• Group harms
• Objectionable uses

14

• Several studies have shown that, if asked,
  patients will give consent and authorization to
  use their tissue and records, but they want to be
  asked.
• Use of de-identified tissue and information
  without permission risks a loss of trust in
  biomedical research and the health care system
  generally.

15

• 5. PRIMR Recommendations
• The report does a nice of job raising many of
  the key issues.
• I do not support all of the recommendations.

16

• E.g., the notice approach of the Privacy Rule
  should be used instead of the informed consent
  approach of the Common Rule.
• E.g., Research subject to the Common Rule should
  be exempt from the Privacy Rule requirements.

17

• 6. Avoiding False Dichotomies
• The issue is NOT researchers vs. individuals.
• Without individuals supplying their tissue,
  health records, and tax dollars, many researchers
  would be out of business.
• Without researchers, individuals will not reap
  the benefits in prevention, diagnosis, and
  treatment for themselves and their loved ones.

18

• 7. The Challenge
• thoughtful, nuanced, forward-looking, simple,
  clear, minimally burdensome regulations

Develop
that will also
19

• Reasonably safeguard the welfare and privacy of
  subjects/individuals.
• Empower subjects/individuals to make informed
  decisions.
• Contain a level of transparency and
  accountability.
• Obtain and maintain individual and collective
  trust in the research and health care enterprises.

20
(No Transcript)