Research and HIPAA Privacy Protections, Slides of Law

Download Research and HIPAA Privacy Protections and more Slides Law in PDF only on Docsity! 1 CITI Training Study Guide Research and HIPAA Privacy Protections Protecting people who participate in research What is the issue HIPAA addresses?  If you have access to persons’ identifiable health information for any purpose, you are obligated to protect it.  A researcher using such health information must know the specific limitations that apply, notably those imposed by HIPAA.  HIPAA regulations supplement FDA and “Common Rule” (general protection of human subjects) regulations What is HIPAA? HIPAA requirements were set out in the: “Health Insurance Portability and Accountability Act of 1996”  HIPAA protections focus on “protected health information” (PHI) created in or by health providers and health plans (“covered entities” – organizations covered by the law).  The intended use of the information determines the rules that will apply. 2 HIPAA Rules for Research… Depend on how HIPAA defines research…  Research IS “systematic investigation, including research development, testing, and evaluation, designed to develop and contribute to generalizable knowledge”  Research IS NOT:  Quality assessment and improvement activities, outcomes evaluation or development of clinical guidelines (these fall under “health care operations”  Research activities that aim for population health knowledge (these fall under “public health activity”)  Determination is made by IRB or legal counsel HIPAA Rules for Research When a health plan or provider shares information, it may rely on an IRB to assess compliance with HIPAA  Generally HIPAA requires explicit written authorization by the person (subject) whose information is to be used.  There are exceptions, but these exceptions require a waiver approved by the IRB (similar to a waiver of informed consent). HIPAA Rules for Research  Exceptions (grounds for waivers) include:  There is “minimal risk” to the privacy of the research subject  The information will not leave the health providers’ premises and will be used only for reviews preparatory to research  The person is deceased  Recruitment activities “preparatory to research” so long as the PHI does not leave the health provider premises