As we discussed in two prior posts (here and here), the April 29, 2015, draft House 21st Century Cures bill would make several changes to federal health privacy law. This post focuses on provisions that would relax limitations on payment for PHI disclosed for research purposes and that would expand the purposes for which covered entities may disclose PHI to FDA-regulated entities without individual authorization. We also discuss several provisions included in a prior draft of the Cures bill that have been excluded from the April 29 draft.

Relaxing Limitation on Remuneration for PHI Disclosed for Research

Under current law, covered entities and business associates may not sell PHI. The disclosure of PHI for certain research purposes is not considered a “sale,” as long as “the only remuneration received by the covered entity or business associate is a reasonable cost-based fee to cover the cost to prepare and transmit the [PHI] for such purpose.” Section 1124 of the Cures bill would add a new section 13443 to the HITECH Act to provide that disclosures of PHI for research purposes “are not subject to the limitation on remuneration” in current law. Thus, the provision would permit covered entities to be paid more than their costs by entities to which they disclose PHI for research purposes.

Expanding Disclosure to Pharmaceutical and Device Manufacturers and Other FDA-Regulated Entities for Research

Covered entities may currently disclose PHI, without written authorization or an opportunity for the subject individual to object, to entities subject to the jurisdiction of the Food and Drug Administration (FDA), such as pharmaceutical and device makers. However, PHI may be disclosed to these entities only for certain “public health activities” related to the FDA-regulated product or activity, such as adverse event reporting, enabling product recalls, or conducting post-market surveillance. New section 13443 of the HITECH Act would permit covered entities to disclose PHI to FDA-regulated entities for “research activities including comparative effectiveness research activities, related to the quality, or effectiveness of a product or activity” regulated by FDA.

Provisions Excluded from the Most Recent Draft Cures Bill

The April 29 draft of the Cures bill excludes several health-privacy-related provisions that were included in a prior draft. The discussion draft released in January 2015 would have:

  • Allowed covered entities to disclose a “limited data set” for research purposes without a data use agreement as long as the use of the data set had been reviewed and approved by an IRB and the recipient protects the data set with administrative, physical, and technical safeguards and complies with other requirements;
  • Imposed additional requirements on recipients of both limited data sets and “de-identified” data, such as prohibiting recipients of such data from knowingly identifying, contacting, or attempting to contact the individuals whose data is included; and
  • Allowed clinical data registries to comply with HIPAA privacy and security rules in lieu of complying with the federal Common Rule.

These provisions are not included in the most recent draft and it is unclear whether Members of Congress may consider adding them.

Print:
EmailTweetLikeLinkedIn
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus has a multi-disciplinary practice advising clients on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (HHS) gives her broad experience…

Anna Durand Kraus has a multi-disciplinary practice advising clients on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (HHS) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and health information privacy. Ms. Kraus regularly advises clients on Medicare reimbursement matters, the Medicaid Drug Rebate program, health information privacy issues (including under HIPAA and the HITECH Act), and the challenges and opportunities presented by the Affordable Care Act.

Photo of Paige Jennings Paige Jennings

Paige Jennings is an associate in Covington’s Washington office. She works with the firm’s Federal–State Programs, Health Care, Antitrust, and Litigation practice groups. Ms. Jennings joined the firm after a number of years working on health policy matters in the government and private…

Paige Jennings is an associate in Covington’s Washington office. She works with the firm’s Federal–State Programs, Health Care, Antitrust, and Litigation practice groups. Ms. Jennings joined the firm after a number of years working on health policy matters in the government and private sectors. Prior to earning her law degree and Master of Public Affairs, she worked in the U.S. Senate for over four years, advising Senators John Breaux and Tom Carper on health and social policy matters. Ms. Jennings later handled federal health policy issues at WellPoint, Inc. During law school, she worked with the U.S. Office of Management and Budget during consideration of the Affordable Care Act, and with the Federal Trade Commission for then-Chairman Jon Leibowitz.