Important Considerations for the Institutional Review Board When Granting Health Insurance Portability and Accountability Act Authorization Waivers

A FUNDAMENTAL NEED FOR PRIVACY

Privacy is recognized as a basic human right in the United States and has been identified as a core principle of ethics in clinical research.⁶ Health data privacy protections were enacted in 1996 when the Health Insurance Portability and Accountability Act (HIPAA) was passed. HIPAA amended the Internal Revenue Code of 1986 with provisions to simplify the administration of health insurance, to enable the responsible flow of medical information to advance patient care, and to promote good clinical practice.⁷ Sections 261 through 264 of HIPAA were established, in part, with the purpose of improving “the efficiency and effectiveness of the health care system by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.”⁷ The Standards for Privacy of Individually Identifiable Health Information, the HIPAA Privacy Rule (45 CFR §160 and Subparts A and E of §164), was promulgated under that stated purpose.⁸ The HIPAA Privacy Rule addresses the use and disclosure of individuals’ health information by certain organizations and sets standards for individuals' privacy rights so that they can understand and control how their health information is used.⁹

Despite the tremendous increase in the complexity of the data privacy landscape, both within the healthcare industry and beyond, the HIPAA Privacy Rule has been largely unchanged since its enactment. Thus, the privacy burden has generally fallen on organizations to analyze and interpret the aging rules and apply them to novel concepts, such as data collection from wearable health devices, a situation almost certainly not foreseen by the rule's original authors.

CURRENT FRAMEWORK FOR PRIVACY PROTECTION IN CLINICAL RESEARCH

HIPAA promotes the advancement of good medicine by enabling the sharing of medical information with providers for continuity of care, and the HIPAA Privacy Rule establishes the conditions under which protected health information (PHI) may be used or disclosed for research purposes.¹⁰ Generally, healthcare entities may not use or disclose PHI in the context of research without written authorization from each subject allowing for that use or disclosure. However, the HIPAA Privacy Rule allows an IRB, a committee charged with reviewing and approving human subjects research, to waive the need for an authorization. The IRB may only waive the need for an authorization if documentation is provided that shows the use or disclosure of PHI presents “no more than a minimal risk to the privacy” of the subjects.¹¹ An adequate plan to protect the identifying information contained in PHI from improper use or disclosure must be in place, as well as an adequate plan to destroy that information at the earliest opportunity consistent with the conduct of the research. Additionally, adequate written assurances must be provided that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study or for other research for which the use or disclosure of PHI would be permitted by law.

Because IRBs were one of the only bodies allowed to waive the need for authorizations in the research context, they essentially served as the gatekeepers of privacy for human subjects. However, this situation changed with the 2018 revisions to the Common Rule.¹²

Under the Common Rule, IRBs must review and have authority to approve, require modifications in, or disapprove “all research involving human subjects conducted, supported, or otherwise subject to regulation” by any of the federal agencies that promulgated or have adopted the Common Rule.¹² However, certain categories of research are exempt from the Common Rule requirements that the researcher obtain IRB review and approval of the research and informed consent of the research subject. The 2018 revisions added new categories of research that are exempt, including secondary research regulated under the HIPAA Privacy Rule. Secondary research is the reuse of identifiable information and identifiable biospecimens originally collected for some other research or healthcare activity, such as research that uses PHI from an existing databank.¹³ HHS made this change because the agency considers secondary research to be associated with sufficiently low human subject research risks, and the important risk of privacy should be governed by the HIPAA Privacy Rule instead of the Common Rule.¹⁴ However, under the revised Common Rule, research administrative staff may review a submitted research study and determine that it is exempt without the IRB ever being involved and without any independent review of privacy considerations. This situation potentially lessens privacy protections for research subjects, placing the burden for privacy protection on IRBs and research institutions.

Therefore, as in almost every decision a healthcare organization makes with respect to handling of PHI, IRBs must be mindful of the relevant HIPAA guidance and must carefully consider all facts and circumstances available when granting approvals of HIPAA authorization waiver requirements, especially in the context of exempt research, so that the IRB is confident that reasonable safeguards to protect patient privacy have been maintained. Research institutions should amend their processes to ensure that the appropriate level of privacy review is given to all studies, even those that are exempt.