TISSUE REPOSITORIES:

THE COMMON RULE

and

THE HIPAA PRIVACY RULE

Mark A. Rothstein, J.D.Herbert F. Boehl Chair of Law and Medicine

Director, Institute for Bioethics, Health Policy and LawUniversity of Louisville School of Medicine

1. Coverage

Neither the Common Rule nor the Privacy Rule has comprehensive coverage.

Common Rule – coverage is based on relationship to federal government (i.e., federal funding, FDA submission, MPA)

Privacy Rule – coverage is based on relationship to electronic claims submission (i.e., health providers, health plans, health clearinghouses)

The gaps in coverage are not parallel, and efforts to expand coverage of both rules have not met with success.

2. Applicability to Tissue Repositories

Neither the Common Rule nor the Privacy Rule was drafted with a contemplation of development of vast biobanks, large-scale automated analytical tools, electronic health records and networks, and population-wide studies.

3. Differences Between theCommon Rule and the Privacy Rule

There are several important variations between the two rules.

Sometimes the provisions of the Common Rule are more burdensome for researchers; sometimes the provisions of the Privacy Rule are more burdensome.

The differences have been noted in the PRIM&R report and other studies.

•In letters to the Secretary of HHS in

November 2001 and March 2004, the

National Committee on Vital and Health

Statistics (NCVHS) recommended

harmonization of the Common Rule and

the Privacy Rule.

•A trans-HHS working group was

established in late 2006 to consider the

issue.

4. Key Differences of Particular Relevance to Tissue Repositories

Example #1: Consent for Unspecified Future Uses

Common Rule – Blanket consent for future use is disfavored but not prohibited. Tiered consent often is used to designate broad categories of approved research uses of specimens.

Privacy Rule – Study specific authorization or study-specific waiver of authorization is required for disclosure of PHI.

There is a problem with authorization for prospective disclosure of health records.

At the time of initial authorization, an individual may not have sensitive information (e.g., mental health, STD) in his or her record.

The individual is unlikely to realize that there could be unlimited, future disclosures of all health information.

One possible solution is to authorize unspecified uses (through tiered authorization), but limit additions to the health record to a period of years (e.g., 5 years), and to require new authorization.

Example #2: Identifiability

Identifiability is a key concept for both the Common Rule (exemption 4 – 45 CFR 46.101(b)(4)) and the Privacy Rule (45 CFR 164.514(a)).

The standards for de-identification are different (of course).

Both rules have the same premise: If the specimens or data are not identifiable, then there are no significant risks to the welfare or privacy of the subject/individual.

This assumption may not be valid.

Identifiability should be only one factor in determining whether there are more than de minimis risks to the subject/individual.

De-identified information may produce substantial harms:

1. Ease of re-identification

2. Group harms

3. Objectionable uses

Several studies have shown that, if asked, patients will give consent and authorization to use their tissue and records, but they want to be asked.

Use of de-identified tissue and information without permission risks a loss of trust in biomedical research and the health care system generally.

5. PRIM&R Recommendations

The report does a nice of job raising many of the key issues.

I do not support all of the recommendations.

E.g., the notice approach of the Privacy Rule should be used instead of the informed consent approach of the Common Rule.

E.g., Research subject to the Common Rule should be exempt from the Privacy Rule requirements.

6. Avoiding False Dichotomies

The issue is NOT researchers vs. individuals.

Without individuals supplying their tissue, health records, and tax dollars, many researchers would be out of business.

Without researchers, individuals will not reap the benefits in prevention, diagnosis, and treatment for themselves and their loved ones.

7. The Challenge

thoughtful, nuanced, forward-looking, simple, clear, minimally burdensome regulations

Develop

that will also:

• Reasonably safeguard the welfare and privacy of subjects/individuals.

• Empower subjects/individuals to make informed decisions.

• Contain a level of transparency and accountability.

• Obtain and maintain individual and collective trust in the research and health care enterprises.