Standards
for Privacy of Individually Identifiable Health Information
J. Section 164.532--Transition Provisions
1. Research Transition
December 2000 Privacy Rule
The December 2000 Privacy Rule at Sec. 164.532 contained different
transition requirements for research being conducted with an individual's
legal permission that included treatment, and for research being
conducted with an individual's legal permission that did not include
treatment. However, the Rule did not explicitly address transition
provisions for research studies ongoing after the compliance date
where the legal permission of the individual had not been sought.
March 2002 NPRM
Several commenters found the transition provisions for research
to be confusing, and further noted that December 2000 Privacy Rule
did not address research ongoing after the compliance date where
the legal permission of the individual had not been sought. To address
these concerns, the Department proposed several revisions to the
Privacy Rule's transition provisions. In particular, the Department
proposed that there be no distinction in the transition provisions
between research that includes treatment and research that does
not, and no distinction between the requirements for research conducted
with a patient's legal permission and research conducted with an
IRB- approved waiver of a patient's informed consent. In sum, the
NPRM proposed that covered entities be permitted to use or disclose
protected health information created or received for a specific
research study before the compliance date (if there was no agreed-to
restriction in accordance with Sec. 164.522(a)), if the covered
entity has obtained, prior to the compliance date, any one of the
following: (1) An authorization or other express legal permission
from an individual to use or disclose protected health information
for the research study; (2) the informed consent of the individual
to participate in the research study; or (3) a waiver, by an IRB
of informed consent for the research study in accordance with the
Common Rule or FDA's human subject protection regulations. However,
even if the researcher obtained, from an IRB, a waiver of informed
consent, an authorization would be required if informed consent
is later obtained. This may occur if there is a temporary waiver
of informed consent for emergency research under the Food and Drug
Administration human subject protection regulations.
Overview of Public Comments
The following discussion provides an overview of the public comment
received on this proposal. Additional comments received on this
issue are discussed below in the section entitled, "Response
to Other Public Comments."
Most commenters supported the proposed revisions to the Privacy
Rule's transition provisions for research. However, a few commenters
requested that the transition provisions be broadened to permit
covered entities to rely on an express legal permission or informed
consent approved by an IRB before the compliance date, even if the
permission or consent had not been signed by the individual prior
to the compliance date. Consequently, a researcher could use the
same forms throughout their study, decreasing the chance of introducing
error into the research through the use of multiple recruitment
procedures, disruption to the research, and the burden for the IRBs
and researchers. A few other commenters suggested that covered entities
be permitted to use and disclose protected health information with
consent forms approved by an IRB prior to the compliance date until
the next review by the IRB, as required by the Common Rule. They
argued that this would result in all informed consent forms being
in compliance with the Privacy Rule's authorization regulations
within a one-year period, and it would avoid disruption to ongoing
research, as well as a flood of consent form revision requests to
the IRBs.
Final Modifications
The following discussion provides an overview of the public comment
received on this proposal. Additional comments received on this
issue are discussed below in the section entitled, "Response
to Other Public Comments."
Most commenters supported the proposed revisions to the Privacy
Rule's transition provisions for research. However, a few commenters
requested that the transition provisions be broadened to permit
covered entities to rely on an express legal permission or informed
consent approved by an IRB before the compliance date, even if the
permission or consent had not been signed by the individual prior
to the compliance date. Consequently, a researcher could use the
same forms throughout their study, decreasing the chance of introducing
error into the research through the use of multiple recruitment
procedures, disruption to the research, and the burden for the IRBs
and researchers. A few other commenters suggested that covered entities
be permitted to use and disclose protected health information with
consent forms approved by an IRB prior to the compliance date until
the next review by the IRB, as required by the Common Rule. They
argued that this would result in all informed consent forms being
in compliance with the Privacy Rule's authorization regulations
within a one-year period, and it would avoid disruption to ongoing
research, as well as a flood of consent form revision requests to
the IRBs.
Response to Other Public Comments
Comment: A commenter requested that the transition provision
be narrowed by requiring research that received a waiver of informed
consent from an IRB prior to the compliance date but that begins
after the compliance date be re-evaluated under the Privacy Rule's
waiver criteria.
Response: The Department disagrees. Given that the Privacy
Rule's waiver criteria for an individual's authorization generally
are consistent with the same types of considerations currently applied
to a waiver of an individual's informed consent, this suggestion
would impose unnecessary burdens on researchers, IRBs, and Privacy
Boards, with respect to the few research studies that would fall
in this category.
|
