On April 29, 2015, the U.S. House Energy and Commerce Committee released a revised discussion draft of the 21st Century Cures Act (“Cures”). The Cures bill would make several changes to existing federal privacy regulations promulgated under the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. These changes would primarily affect the use and disclosure of protected health information (PHI) for “research purposes.” This post discusses a provision that would expand covered entities’ ability to use or disclose PHI for research purposes without authorization from the subject individual. Future posts will discuss provisions that would allow remote access to PHI for certain research purposes; allow a one-time authorization of the use and disclosure of PHI for research; eliminate limitations on remuneration for PHI disclosed for research purposes; and allow disclosure of PHI to FDA-regulated entities for research purposes such as comparative effectiveness analysis.

Defining “Research” as Part of Health Care Operations

Section 1124 of the draft Cures bill would add a new section 13442 to the HITECH Act to permit covered entities to use or disclose PHI to certain entities for “research purposes” without authorization from the subject individual or a waiver from an IRB or privacy board. The new section would require the Secretary “to allow the use and disclosure of [PHI] by a covered entity for research purposes, including studies whose purpose is to obtain generalizable knowledge, to be treated as the use and disclosure of such information for health care operations . . . .”

Under the current HIPAA Privacy Rule, a covered entity may use PHI (and disclose it to certain entities) for its own health care operations without written authorization from the individual. Health care operations include activities such as quality assessment and improvement, review of health care professional qualifications, underwriting and enrollment, business planning and development, customer service, etc. Covered entities may also disclose PHI to another covered entity for that entity’s health care operations if each entity has or had a relationship with the individual who is the subject of the PHI and the disclosure is for certain quality assessment or performance reviews or for health care fraud and abuse detection or compliance.

The Cures provision would allow covered entities to use or disclose PHI for “research purposes” without obtaining authorization from the subject individual or an IRB or privacy board waiver. Covered entities could make such disclosures only to:

  • Other covered entities (without regard to the current requirement that the disclosing and receiving covered entities have a relationship with the subject individual);
  • A business associate with a business associate contract to perform health care operations for the covered entity;
  • A business associate with a business associate contract to perform data aggregation services for the covered entity.

These specified entities would be permitted to use the disclosed PHI for research purposes without authorization from the individual or a privacy board or IRB waiver. The disclosing covered entity could not disclose PHI for research purposes to any other third party not specified above unless the covered entity obtained authorization or privacy board or IRB approval.

Print:
EmailTweetLikeLinkedIn
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus has a multi-disciplinary practice advising clients on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (HHS) gives her broad experience…

Anna Durand Kraus has a multi-disciplinary practice advising clients on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (HHS) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and health information privacy. Ms. Kraus regularly advises clients on Medicare reimbursement matters, the Medicaid Drug Rebate program, health information privacy issues (including under HIPAA and the HITECH Act), and the challenges and opportunities presented by the Affordable Care Act.

Photo of Paige Jennings Paige Jennings

Paige Jennings is an associate in Covington’s Washington office. She works with the firm’s Federal–State Programs, Health Care, Antitrust, and Litigation practice groups. Ms. Jennings joined the firm after a number of years working on health policy matters in the government and private…

Paige Jennings is an associate in Covington’s Washington office. She works with the firm’s Federal–State Programs, Health Care, Antitrust, and Litigation practice groups. Ms. Jennings joined the firm after a number of years working on health policy matters in the government and private sectors. Prior to earning her law degree and Master of Public Affairs, she worked in the U.S. Senate for over four years, advising Senators John Breaux and Tom Carper on health and social policy matters. Ms. Jennings later handled federal health policy issues at WellPoint, Inc. During law school, she worked with the U.S. Office of Management and Budget during consideration of the Affordable Care Act, and with the Federal Trade Commission for then-Chairman Jon Leibowitz.