Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP...
-
Upload
earl-hancock -
Category
Documents
-
view
218 -
download
0
Transcript of Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP...
![Page 1: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/1.jpg)
Advanced HIPAA Issues for Biotech and Life Sciences Companies:
Mark E. SchreiberPalmer & Dodge LLP111 Huntington AvenueBoston, MA [email protected]
April 8, 2005
On the Frontier of Science and On the Edge of HIPAA
![Page 2: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/2.jpg)
2
HIPAA Provisions under which Biotech / Life Sciences Issues Arise
HIPAA provider coverage?
Business Associate applicability?
Authorizations – unspecified research
Research data bases
Accounting for research disclosures
Clinical studies in E.U. – HIPAA interface
![Page 3: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/3.jpg)
3
Medical Device / Testing Companies – Covered Entities?
May be “health care provider” under broad HIPAA definition
Most don’t engage in electronic standard transactions
Some may unwittingly send claims, insurance or related e-mails
If so, possible HIPAA coverage
Not all ask right questions of right people To properly determine status
If covered, then what?
Privacy notices, etc.
To whom?
![Page 4: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/4.jpg)
4
Are Clinical Researchers / Sponsors or CRO’s Business Associates?
Generally “research” not a BA function performed for covered entities
“We’re not a BA” letter BA’s often negotiated
Business clout If researcher / sponsor also provides
Quality assurance, or Data processing services for covered entity
De-identifying records, or Creating limited data sets
Then researcher / sponsor is BA Researcher / sponsor – document in CTA that no
BA-triggering services provided
![Page 5: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/5.jpg)
5
Sponsors Generally Not Covered Entity or BA
No HIPAA concerns, then, right? Not so fast . . .
Sites will and should impose handling restrictions in CTA’s
Some sites impose informed consent confidentiality limitations
Blending with HIPAA standards, on researchers / sponsors and “downstream”
Restricts marketing use
![Page 6: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/6.jpg)
6
Sponsors Generally Not Covered Entity or BA
Confidentiality agreement OK, but modify agreements To specifically allow
For monitoring services, and
Other purposes in HIPAA-compliant patient authorization
Other agreement “pass-throughs” Reps and warrantees, indemnity language
Researchers / sponsors – rigorous privacy policies / practices that approximate those of HIPAA
HIPAA treated as de facto standard of care
State law invasion of privacy claims
![Page 7: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/7.jpg)
7
Authorizations – Future Unspecified Research
HIPAA authorizations for research Can broadly cover patient’s entire medical record
Can broadly cover classes or persons to whom and by whom PHI can be used / disclosed
Under “purpose” element,
“Each purpose” must be specified
Valid authorization for unspecified studies
Virtually impossible under HIPAA
Registry or database for unspecified future research – OK
![Page 8: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/8.jpg)
8
Research Databases under HIPAA
Database – separate purpose from primary protocol
Must be specifically authorized In protocol authorization or
In separate subsequent authorization
If database maintained by covered entity Future disclosures must be pursuant to new
authorization
If database disclosed to sponsor Generally outside HIPAA
![Page 9: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/9.jpg)
9
IRB Waivers and Future Researcher Follow Up with Participants
If IRB Waiver
Researcher free to use PHI for current research
New, specific waiver necessary Before researcher can contact study participants about
new study
![Page 10: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/10.jpg)
10
Accounting for Research Disclosures
NEED NOT be accounted for where Disclosed under authorization
Disclosed in limited data set form
Needs data use agreement
MUST be accounted for upon individual request where disclosed pursuant to IRB waiver
Less detailed accounting: Where covered entity discloses records of 50
individuals under IRB waiver during requested accounting period
![Page 11: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/11.jpg)
11
Coming HIPAA Attractions: Clinical Studies Abroad and Outsourcing
E.U. Model different – no HIPAA statute but broaderdata laws E.U. Data Protection laws
Each E.U. country
Consent necessary for medical data use (sensitive data) Specific use, purpose, etc. English or in local language?
Data transfer out of E.U. country to U.S. Consent to transfer – different from consent to use / collect Data protection model clauses / agreements U.S. Safe Harbor
![Page 12: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/12.jpg)
12
Who Follows Up on E.U. Branch Office or E.U. Consents?
Some companies not aware of or abide by these laws
Risk to studies?
Sometimes requires explanation of importance
E.U. clinical directive
Is foreign medical PHI subject to HIPAA whentransferred to U.S. HIPAA covered entity? Telemedicine
Medical records of E.U. resident sent to U.S.
![Page 13: Advanced HIPAA Issues for Biotech and Life Sciences Companies: Mark E. Schreiber Palmer & Dodge LLP 111 Huntington Avenue Boston, MA 02199 617-239-0585.](https://reader036.fdocuments.net/reader036/viewer/2022062322/56649e905503460f94b952d3/html5/thumbnails/13.jpg)
13
Outsourcing of HIPAA Data Processing Overseas
Canada, India, Pakistan, Philippines
Medical transcription services
Pakistan case – multiple contractors to HIPAA covered entity
Rep. Markey letter to HHS
Possible outsourcing amendments to HIPAA