Individual
Rights in the Research Context
The
HIPAA Privacy Rule gives individuals a number of rights
regarding access to, knowledge about and control over
their identifiable health information. All investigators
must be aware of and able to implement these rights.
1.
The Right to Access PHI:
Research subjects are entitled to access (i.e., inspect
and copy) their PHI that is maintained in a designated
record set as defined by the Privacy Rule.
Designated
record set: a health care provider's medical and
billing records about individuals and any records
used by the provider to make decisions about individuals.
For
research purposes, the designated record set
primarily includes PHI that is generated in research
and recorded in the medical chart or in billing
records. PHI recorded elsewhere (e.g., a lab notebook)
that may be used to make clinical or billing decisions
about the subject (e.g., a blood pressure reading)
is also part of the designated record set.
Not
included in a designated record set: information
generated in research that lacks clinical validity or
clinical utility and that is not recorded in the medical
chart or in billing records and that will not be used
for making decisions about the individual.
-
The
Privacy Rule permits researchers conducting clinical
trials to suspend subjects' right of access temporarily,
for as long as the research is in progress, if the
subject specifically agrees to this suspension in
the research authorization. The right of access must
be reinstated when the research is completed.
-
The
Privacy Rule allows a researcher to deny an individual
access if the PHI was obtained from someone other
than a health care provider under a promise of confidentiality
and the access would likely reveal the source of the
information.
If
a subject requests access to their research information,
refer that subject to the Privacy Officer at your institution.
The Privacy Officer will then work with the investigator
to coordinate a response.
2.
The Right to Amend PHI:
Research
subjects are entitled to request an amendment to their
PHI that is in a designated record set (see above definition).
If a subject requests such an amendment, refer that
subject to the Privacy Officer at your institution.
The Privacy Officer will then work with the investigator
to coordinate a response.
3.
The Right to Receive an Accounting of Disclosures:
An
individual has the right to request an accounting of
every disclosure (sharing outside of Partners) of their
PHI made pursuant to a waiver. The right to an accounting
also applies to disclosures of decedents' information
and disclosures preparatory to research. Such requests
must be directed to the Privacy Officer.
In
order to fulfill this requirement, investigators are
required to report to the Privacy Officer (or designee)
all disclosures (sharing outside of Partners) of protected
health information (PHI) made pursuant to a waiver of
authorization or in the other cases noted above, if
applicable. This record must be kept for 6 years (starting
on April 14, 2003) after the disclosure and it must
include the following information in addition to a list
of all individuals about whom PHI was disclosed:
-
Date
of the disclosure
-
Name
of the person or entity who received it and their
address (if known)
-
Brief
description of what PHI was disclosed
-
Brief
statement of the purpose of the disclosure
If
the research is particularly sensitive, the investigator
may replace the description of what PHI was disclosed
and the brief statement of purpose of the disclosure
with a reference code that will be kept by the investigator.
The investigator could then provide the names of all
enrolled individuals, the date of the disclosure, the
names of persons or entities receiving the PHI and the
reference code.
Multiple
disclosures for same purpose:
The Privacy Rule provides specific provisions for ongoing
studies that require multiple disclosures of PHI for
the same research protocol. If during the 6-year reporting
period, multiple disclosures of the PHI have been made
to the same person or entity for a single purpose, then
the accounting may include:
-
For
the first disclosure:
-
Date of the disclosure
-
Name
of the person or entity who received it and their
address (if known)
-
Brief description of what PHI was disclosed
-
Brief statement of the purpose of the disclosure
-
The
frequency, periodicity, or number of the disclosures
made during the 6 year period
-
The
date of the last such disclosure made during the 6
year reporting period
Procedure:
1. The IRB's notice granting approval of a waiver of
authorization will state that you must track all disclosures.
Partners has developed an Excel-based template that
can be used to document all of the required information.
The investigators can use this template for their internal
records and forward it to the Privacy Officer as required.
2. The investigator must provide to the Privacy Officer
a list of names of every study participant and the following
information (reporting to the Privacy Officer should
be made either at the time of disclosure or quarterly):
-
Date
of the disclosure
-
Name
of the person or entity who received it and their
address (if known)
-
Brief
description of what PHI was disclosed
-
Brief
statement of the purpose of the disclosure
3.
If the study requires multiple disclosures, the following
information must be provided to the Privacy Officer:
-
For
the first disclosure:
-
Date of the disclosure
-
Name of the person or entity who received it and
their address (if known)
-
Brief description of what PHI was disclosed
-
Brief statement of the purpose of the disclosure
-
The
frequency, periodicity, or number of the disclosures
made during the 6 year period
-
The
date of the last such disclosure made during the 6
year reporting period
4.
If an individual approaches you/your lab requesting
an accounting of all disclosures made within the previous
6 years, you must refer the individual to the institutional
Privacy Officer.
4.
The Right to Restrict Uses and Disclosures of PHI:
Research subjects are entitled to request that the researcher
restrict the uses and disclosures of their PHI. However,
the researcher is not required to agree to the restriction.
If the researcher wants to consider this request, s/he
should contact the Privacy Officer to coordinate a response.
5.
The Right to Request Alternate Means or Alternate Location
for Communications:
The researcher must accommodate such requests (e.g.,
home address vs. work address), if reasonable. The researcher
may not require the subject to explain the basis of
the request. In order to comply with this requirement,
each authorization and informed consent document will
ask the subject to identify the preferred contact information.
6.
The Right to Revoke Authorization for the Use or Disclosure
of PHI:
Subjects have the right to revoke their authorization
for research uses and disclosures of their PHI, except
to the extent that the researcher has already relied
on the authorization. This request must be in writing.
If the PHI has already been used to perform an analysis
or other evaluation for the study, the results of that
analysis can be retained. The researcher may also continue
to use the subject's PHI as necessary to account for
the subject's withdrawal from the study or to report
adverse events. However, the researcher generally may
not use or disclose any PHI that has not already been
created or gathered at the time the person revokes the
authorization. Researchers must inform other individuals
or sites involved in the research of any subjects' revocation
of authorization.
|