As we discussed in two prior posts (here and here), the April 29, 2015, draft House 21st Century Cures bill would make several changes to federal health privacy law. This post focuses on provisions that would relax limitations on payment for PHI disclosed for research purposes and that would expand the purposes for which covered entities may disclose PHI to FDA-regulated entities without individual authorization. We also discuss several provisions included in a prior draft of the Cures bill that have been excluded from the April 29 draft.

Relaxing Limitation on Remuneration for PHI Disclosed for Research

Under current law, covered entities and business associates may not sell PHI. The disclosure of PHI for certain research purposes is not considered a “sale,” as long as “the only remuneration received by the covered entity or business associate is a reasonable cost-based fee to cover the cost to prepare and transmit the [PHI] for such purpose.” Section 1124 of the Cures bill would add a new section 13443 to the HITECH Act to provide that disclosures of PHI for research purposes “are not subject to the limitation on remuneration” in current law. Thus, the provision would permit covered entities to be paid more than their costs by entities to which they disclose PHI for research purposes.

Expanding Disclosure to Pharmaceutical and Device Manufacturers and Other FDA-Regulated Entities for Research

Covered entities may currently disclose PHI, without written authorization or an opportunity for the subject individual to object, to entities subject to the jurisdiction of the Food and Drug Administration (FDA), such as pharmaceutical and device makers. However, PHI may be disclosed to these entities only for certain “public health activities” related to the FDA-regulated product or activity, such as adverse event reporting, enabling product recalls, or conducting post-market surveillance. New section 13443 of the HITECH Act would permit covered entities to disclose PHI to FDA-regulated entities for “research activities including comparative effectiveness research activities, related to the quality, or effectiveness of a product or activity” regulated by FDA.

Provisions Excluded from the Most Recent Draft Cures Bill

The April 29 draft of the Cures bill excludes several health-privacy-related provisions that were included in a prior draft. The discussion draft released in January 2015 would have:

• Allowed covered entities to disclose a “limited data set” for research purposes without a data use agreement as long as the use of the data set had been reviewed and approved by an IRB and the recipient protects the data set with administrative, physical, and technical safeguards and complies with other requirements;
• Imposed additional requirements on recipients of both limited data sets and “de-identified” data, such as prohibiting recipients of such data from knowingly identifying, contacting, or attempting to contact the individuals whose data is included; and
• Allowed clinical data registries to comply with HIPAA privacy and security rules in lieu of complying with the federal Common Rule.

These provisions are not included in the most recent draft and it is unclear whether Members of Congress may consider adding them.