On April 29, 2015, the U.S. House Energy and Commerce Committee released a revised discussion draft of the 21st Century Cures Act (“Cures”). The Cures bill would make several changes to existing federal privacy regulations promulgated under the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. These changes would primarily affect the use and disclosure of protected health information (PHI) for “research purposes.” This post discusses a provision that would expand covered entities’ ability to use or disclose PHI for research purposes without authorization from the subject individual. Future posts will discuss provisions that would allow remote access to PHI for certain research purposes; allow a one-time authorization of the use and disclosure of PHI for research; eliminate limitations on remuneration for PHI disclosed for research purposes; and allow disclosure of PHI to FDA-regulated entities for research purposes such as comparative effectiveness analysis.

Defining “Research” as Part of Health Care Operations

Section 1124 of the draft Cures bill would add a new section 13442 to the HITECH Act to permit covered entities to use or disclose PHI to certain entities for “research purposes” without authorization from the subject individual or a waiver from an IRB or privacy board. The new section would require the Secretary “to allow the use and disclosure of [PHI] by a covered entity for research purposes, including studies whose purpose is to obtain generalizable knowledge, to be treated as the use and disclosure of such information for health care operations . . . .”

Under the current HIPAA Privacy Rule, a covered entity may use PHI (and disclose it to certain entities) for its own health care operations without written authorization from the individual. Health care operations include activities such as quality assessment and improvement, review of health care professional qualifications, underwriting and enrollment, business planning and development, customer service, etc. Covered entities may also disclose PHI to another covered entity for that entity’s health care operations if each entity has or had a relationship with the individual who is the subject of the PHI and the disclosure is for certain quality assessment or performance reviews or for health care fraud and abuse detection or compliance.

The Cures provision would allow covered entities to use or disclose PHI for “research purposes” without obtaining authorization from the subject individual or an IRB or privacy board waiver. Covered entities could make such disclosures only to:

• Other covered entities (without regard to the current requirement that the disclosing and receiving covered entities have a relationship with the subject individual);
• A business associate with a business associate contract to perform health care operations for the covered entity;
• A business associate with a business associate contract to perform data aggregation services for the covered entity.

These specified entities would be permitted to use the disclosed PHI for research purposes without authorization from the individual or a privacy board or IRB waiver. The disclosing covered entity could not disclose PHI for research purposes to any other third party not specified above unless the covered entity obtained authorization or privacy board or IRB approval.