Public Health Law Map - Beta 5 - Medical and Public Health Law Site

• An adequate plan to protect health information identifiers from
improper use and disclosure.
• An adequate plan to destroy identifiers at the earliest opportunity
consistent with conduct of the research (absent a health or research
justification for retaining them or a legal requirement to do so).
• Adequate written assurances that the PHI will not be reused or
disclosed to (shared with) any other person or entity, except as
required by law, for authorized oversight of the research study, or for
other research for which the use or disclosure of the PHI would be
permitted under the Privacy Rule.
• The research could not practicably be conducted without the waiver or
alteration.
• The research could not practicably be conducted without access to and use
of the PHI.
The Privacy Rule does not require an IRB or Privacy Board to review the form
or content of the Authorization a researcher or covered entity intends to use, or
the proposed uses and disclosures of PHI made according to an Authorization.
Under the Privacy Rule, an IRB or Privacy Board need only review requests to
waive or alter the Authorization requirement.[HIPAA Research at 17.]
b) Issues Raised by Unauthorized Access
These standards recognize that there are situations where the individual's right to
control his/her PHI is overridden by society's need for the that individual's PHI for
research that will benefit others. In theory, these exceptions should be as narrow as
possible, and the information should be carefully protected from further disclosure.
The identifiers should be destroyed as soon as they are no longer needed, absent
specific reasons to retain them. There are two problems with these standards which
raise troubling questions. First, there is no review of the underlying importance of
the research being done. There is no balancing between the value of the research
and the individual's privacy: any research can qualify for a waiver or modification
of the authorization requirements, without regard to its merits. Second, the IRB or
Privacy Board does not review the actual authorization that will be used. It is only
required to decide whether a waiver or modification is allowable, but it is the
researchers who get to decide what the form will look like. Since this provision
does not prohibit IRBs or Privacy Boards from reviewing these modified forms, it
is anticipated that they will get some review to assure that they really meet the
representations made to the IRB or Privacy Board.
4. Designing Research Studies
Before HIPAA, researchers were often given access to patient records to review
361