Good Clinical Practice: A Question & Answer Reference Guide - May 2012 - (Page 479)

Section 14: The HIPAA Privacy Rule and FDA-Regulated Clinical Trials By Sandra SAM Sather, MS, BSN, CCRA, CCRC Clinical Pathways, LLC www.clinicalpathwaysresearch.com Since the initial HIPAA regulations (“Standards for Privacy of Individually Identifiable Health Information”) went into effect on April 14, 2003, there are still indications that some aspects of HIPAA have not been entirely understood or implemented appropriately in the context of some clinical research activities (e.g., full disclosure of subject case histories, proper use and content of HIPAA Authorizations for Use and Disclosure of Protected Health Information). One source of issues in merging both sets of requirements might be the misinterpretation of some HIPAA requirements, and the heavy reliance of research sites on sponsors for Authorization templates for a clinical trial. Recently, a proposed regulatory change to clinical research requirements to address this challenge was announced. In July 2011, the Office of the Secretary and the Food and Drug Administration released an announcement for proposed changes to regulatory requirements entitled, “Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators” specific to FDA 21CFR 50 and 56, OHRP/OCR 45 CFR Parts 46, 160, and 164. (45 CFR 160 and 164 are specific to the Health Insurance Portability and Accountability Act of 1996 (HIPAA)). The proposed Rule change includes seven areas of focus for regulatory change, one specific to the establishment of mandatory data security and information protection standards for all studies that involve identifiable or potentially identifiable data. The HIPAA Privacy Rule requirements are only applicable to covered entities, and this proposal reminds us that not all research sites are covered entities and may not have to follow the requirements of the HIPAA Privacy and Security standards. The goal of the regulatory change related to identifiable information is to strengthen and standardize the protections for subject study identifiable information across all studies, and to make the requirements enforceable and consistent in the research setting. (http://www.fda.gov/ScienceResearch/SpecialTopics/RunningClinicalTrials/ ProposedRegulationsandDraftGuidances/default.htm). In the meantime, a helpful resource for all stakeholders, research sites, sponsors and IRBs for confirming the requirements of the Privacy Rule is the OCR website—specifically, the section for Health Information Privacy (http://www.hhs.gov/ocr/privacy/index.html). The Health Information Privacy section contains several relevant components: Understanding HIPAA Privacy, Summary of the HIPAA Privacy Rule, Training Materials, HIPAA Administrative Simplification Statute & Rules, Enforcement Activities & Results, How to File a Complaint, Frequently Asked Questions, and What’s New. The most helpful sections for stakeholders performing FDA-regulated clinical trials are on training materials, enforcement, and frequently asked questions (FAQs). The training section contains many useful documents, including one specifically for research. The enforcement section contains monthly updates on the enforcement activities and results, and the FAQs section has a large number of answers to questions regarding the implementation of the rule’s requirements, including within clinical trials. The FAQs section leverages the information on the OCR website and applies it to the many key clinical research practices that are impacted by the Privacy Rule. Particular focus is placed upon those areas in which some have misinterpreted the HIPAA rules, possibly affecting the quality of clinical research practices and outcomes. An example is the misinterpretation of the Minimum Necessary Standard requirements in HIPAA, which has led to reluctance on the part of some covered entities to release to sponsor/monitors a research subject’s past medical information used in evaluating eligibility. The section will be useful in addressing any questions that arise from the HITECH Rule and research activities. This section discusses the key aspects of the HITECH Rule that relate to the conduct of clinical research, and also clarifies many key concepts regarding the HIPAA requirements that relate specifically to research. Some core concepts specific to HIPAA and clinical research that are also covered in this section: authorizations for 479 http://www.clinicalpathwaysresearch.com http://www.fda.gov/ScienceResearch/SpecialTopics/RunningClinicalTrials/ProposedRegulationsandDraftGuidances/default.htm http://www.fda.gov/ScienceResearch/SpecialTopics/RunningClinicalTrials/ProposedRegulationsandDraftGuidances/default.htm http://www.hhs.gov/ocr/privacy/index.html

Table of Contents for the Digital Edition of Good Clinical Practice: A Question & Answer Reference Guide - May 2012

Good Clinical Practice: A Question & Answer Reference Guide - May 2012
Table of Contents
Introduction
Section 1: GCP Regulations, Standards and Guidelines for Clinical Research
Section 2: Investigators/Sites
Section 3: Form FDA-1572/Statement of the Investigator
Section 4: Study Sponsors and Clinical Trial Monitoring
Section 5: Informed Consent
Section 6: Source Data/Documentation
Section 7: Clinical Trial Protocols/Protocol Changes/Protocol Violations
Section 8: Institutional Review Boards
Section 9: Drug/Study Safety and Safety Reporting
Section 10: FDA Inspections, Quality Assurance Activities, and Study Auditing
Section 11: Computerized Systems, e-Clinical Trials, and Electronic Records Rules
Section 12: Patient Recruitment
Section 13: Conflicts of Interest/Financial Disclosure
Section 14: The HIPAA Privacy Rule and FDA-Regulated Clinical Trials
Section 15: Drug Accountability, Administration, and Labeling
Section 16: Fraud, Negligence, and Regulatory Non-Compliance
Section 17: Subject Diaries
Section 18: GCP and Clinical Research Standards in the European Union and An Interview with Fergus Sweeney, Ph.D., EMA Head of Sector, Compliance and Inspection
Section 19: Clinical Trial and GCP Standards in Selected Leading Countries/Regions: Latin America, China, Russia, Ukraine, and India
Section 20: GCP Compliance Statistics and Trends
21 CFR Part 11 — Electronic Records; Electronic Signatures
21 CFR Part 50 — Protection of Human Subjects
21 CFR Part 54 — Financial Disclosure by Clinical Investigators
21 CFR Part 56 — Institutional Review Boards
21 CFR Part 312 — Investigational New Drug Application
ICH Consolidated Guideline on Good Clinical Practice (E6)
ICH Guideline on Clinical Safety Data Management (E2A)
European Union Clinical Trials Directive
European Union Good Clinical Practice Directive

Good Clinical Practice: A Question & Answer Reference Guide - May 2012