This post is part of our series on key aspects of the final HITECH omnibus rule issued by the U.S. Department of Health and Human Services (HHS) on January 17, 2013 (available here), and scheduled to be published in the Federal Register on January 25.  Previous posts are available here.  The regulations are effective March 26, 2013, but covered entities and business associates have until September 23, 2013, to comply with most new requirements.

The final HITECH omnibus rule contains major changes to the HIPAA requirements for research authorizations.  Specifically, as described below, HHS has loosened the current restrictions on “compound authorizations” for research purposes, and is now interpreting the HIPAA Privacy Rule to allow authorizations for future research.  These changes could have a tremendous impact on the manner in which  informed consent for clinical trials is documented in the United States and on the availability of clinical trial data for future research.

Compound Authorizations.  The HIPAA Privacy Rule generally prohibits “compound authorizations,” which are authorizations that are combined with any other legal permission.  An exception allows the combining of an authorization for a research study with written permission for the same study, usually found in an informed consent form.  But under the current rules, this exception is not available if one authorization conditions treatment, payment, enrollment in a health plan, or eligibility for benefits on the individual providing an authorization (conditioned authorization) and the other authorization does not contain such conditions (unconditioned authorization).  This prevents a covered entity from, for example, using a single authorization for a research study that covers both treatment as part of a clinical study and tissue banking of specimens for future research.  Many groups have informed HHS that this lack of integration is inconsistent with the Common Rule (45 C.F.R. Part 46) and creates unnecessary documentation burdens.

In the final HITECH omnibus rule, HHS adopted its proposal (which we previously described here) to amend the authorization requirements to allow a covered entity to combine conditioned and unconditioned authorizations for research, provided the authorization:

• clearly differentiates between the conditioned and unconditioned research components; and
• provides the individual with an opportunity to opt in to the unconditioned research activities.

The revised 45 C.F.R. § 164.508(a)(3)(i) also specifically provides that an authorization for a research study may be combined with “an authorization for the creation or maintenance of a research database or repository.”

Although the preamble sets forth a number of possible methods that would satisfy the differentiation and opt-in requirements, HHS emphasized that covered entities and researchers have flexibility to determine the best approach for meeting the requirements.

Authorizations for Future Research.  In addition to revising the authorization requirements, HHS, in the preamble to the final rule, reversed its prior interpretation that a research authorization must be study specific and therefore cannot include an authorization for future research.

The prior policy had been based on a concern that the lack of specific information about future research would make it impossible for subjects to make an informed decision about the use of their protected health information for that future research.  However, HHS noted that it had heard from many researchers and other groups that this interpretation encumbers secondary research and diverges from current practice under the Common Rule.  We discussed these concerns, and HHS’s proposed options to address this issue, in a previous post.

In the preamble to the final rule, HHS stated that it was modifying its prior interpretation to allow authorizations for future research.  Under this modification, HHS interprets the requirement in 45 C.F.R. 164.508(c)(1)(iv) that the authorization must include a description of each purpose of the use or disclosure to mean that the authorization for future research must “adequately describe such purposes such that it would be reasonable for the individual to expect that his or her protected health information could be used or disclosed for such future research.” HHS stated that this approach gives covered entities, researchers, and Institutional Review Boards (IRBs) flexibility in determining how best to describe a future research purpose, and that it consulted with the Food and Drug Administration (FDA) and the Office for Human Research Protections on this approach to ensure consistency with the HHS and FDA human research protections.

Interestingly, HHS also stated that covered entities and researchers may rely on an IRB-approved consent obtained prior to the effective date of the final rule that reasonably informs individuals about future research, as long as the informed consent was combined with a HIPAA authorization (even if the authorization was specific to the original study or creation and maintenance of a repository).

Implications for Researchers and Life Sciences Companies.  The final HITECH omnibus rule’s changes to the HIPAA Privacy Rule’s research authorization requirements have the potential to alleviate administrative burdens on both clinical trial subjects and researchers; promote uniformity in the documentation of global trials (since the compound authorization prohibition is unique to the United States); and greatly facilitate secondary and future research.