On Monday, March 4, PRIM&R hosted a webinar titled PRIM&R’s Primer on the HIPAA/HITECH Act Omnibus Final Rule. Emily Chi Fogler, JD, senior legal counsel in the Office of General Counsel at Partners HealthCare System, and Jennifer Geetter, JD, partner in the law firm of McDermott Will & Emery LLP, participated as speakers, with P. Pearl O’Rourke, MD, as moderator. Following the webinar, we connected with Emily Chi Fogler, and she kindly answered a few more questions that came in from webinar participants, for Ampersand.

Alexandra Shlimovich (AS): In terms of the elements for opting in to the unconditioned sections of research, would these elections necessarily need to be a part of the informed consent form (ICF) and HIPAA authorization forms if these forms are separate? For example, should check boxes for opting in be included on ICF and mirrored on HIPAA authorization?
Emily Chi Fogler (ECF): If I understand this question correctly, you are asking whether, if your entity/IRB uses separate ICF and authorization forms (two freestanding documents), you have to repeat/include an opt-in for the unconditioned activity (e.g., banking) in both forms.

The final rule and its preamble do not address this specific example, but, given the clear intent of the US Department of Health and Human Services (DHHS) for entities/IRBs to have flexibility in implementing the requirements and to reduce administrative burden for participants and researchers, we think a practical reading of the rule would permit the opt-in mechanism (for example a check box) to be located in either form without having to be repeated/included in both.  If the opt-in is located in the ICF, the authorization should very clearly incorporate the opt-in by reference. in other words, since the opt-in is a required part of the authorization under the final rule, the authorization form should state that it is incorporating by reference the opt-in checkbox option selected by the participant in the consent form and that the participant’s choice indicated in the consent will apply to the use and disclosure of their protected health information (PHI) requested in the authorization. If the opt-in is located in the authorization, the ICF should cross-reference that the person will be asked to provide their authorization to the unconditioned activity in the authorization form and that if they do not authorize the activity it will not occur.  

AS: Is the National Cancer Institute (NCI) model consent template compliant with HIPAA where it says that your sample will be used for any future research including diabetes, etc? The answer offered during the webinar was it was probably ok if it was consistent with the purpose of the original research but if the original research was cancer research, how can one say that future research on diabetes would be covered by this?
ECF: During the webinar we noted that the NCI consent language is quite broad and that it will be a judgment call for IRBs whether they would be comfortable with the breadth of it, and specifically whether it meets the “reasonable person” standard now established in the preamble to the final rule – i.e., whether a reasonable person would understand from the description in the form how her PHI might be used/disclosed for the future research. We also noted that, while language in a form may be “legal,” and meet the requirements of DHHS, it still may be too broad or nonspecific for the preference of some IRBs or participants.

We do not think that the analysis hinges on whether the future research was consistent with, or within the same scope or area as, the original research study. Although that might be one criterion for an IRB to use in assessing the appropriateness of the future research use (from both a Common Rule and a HIPAA perspective), it is not the definitive criteria for determining whether the description of future research is acceptable under the new Omnibus Final Rule. As we understand the final rule, future research could be in an entirely different disease area, and still be acceptable under the Final Rule if it is determined by the covered entity/IRB that a reasonable person would understand the scope of possible uses of their PHI from the description in the form.  In other words, the question is more, is the description of the future uses clear and meaningful enough that the planned future use would be reasonably expected or anticipated based on that description.  If the future research were within the same disease area or clearly related to the disease being studied in the initial study, it might create a stronger argument that a participant would understand the planned future use, but we don’t think that’s the dividing line or the only factor to consider.

If you’re interested in learning more about HIPAA/HITECH Act Omnibus Final Rule and did not have a chance to participate in last week’s webinar, the archive is available for purchase. PRIM&R members can also access additional readings related to this topic on our Knowledge Center.