As we discussed in a prior post, the April 29, 2015, draft House 21st Century Cures bill would make several changes to federal health privacy law. This post focuses on provisions that would allow remote access to PHI for purposes preparatory to research and that would permit individuals to make a one-time authorization of the use and disclosure of their PHI for research purposes.

Remote Access for Purposes Preparatory to Research

Section 1124 of the Cures bill would add a new section 13444 to the HITECH Act to modify the rules governing the use and disclosure of PHI for purposes preparatory to research. Current law allows covered entities to use or disclose PHI for such purposes as long as no PHI is removed from the covered entity by the researcher. The Cures bill would permit researchers to “remote[ly] access” health information, as long as the covered entity and researcher maintain “appropriate security and privacy safeguards” and the PHI “is not copied or otherwise retained by the researcher.” The draft bill does not define what it means to “copy” or “retain” PHI, or for example, whether the temporary caching of files on a remote portal would violate the new requirements.

Individual One-Time Authorization for Uses and Disclosures of PHI for Research

Cures section 1124 would also add a new section 13445 to the HITECH Act to permit individuals to make a one-time authorization allowing their PHI to be used or disclosed for “future research purposes.” Under current law, covered entities must, as a general rule, obtain authorization from the subject individual in order to use or disclose PHI for purposes other than treatment, payment, or health care operations. However, covered entities may use or disclose PHI for “research purposes” without obtaining authorization if the covered entity complies with certain requirements such as getting a waiver of the authorization requirement from an institutional review board (IRB) or privacy board.

The Cures bill would consider an authorization for future research purposes valid if it met certain conditions, such as sufficiently describing the future purposes (at least in general terms); providing an expiration date for the authorization or stating that the authorization will not expire; and informing the individual about how to revoke the authorization. Although a prior draft of the Cures bill specified that the authorization would apply both to already-existing PHI as well as PHI collected after the date of the authorization, the April draft does not contain this language. Additionally, the new provision is somewhat unclear as to the impact that a revocation of the authorization would have on ongoing research using the individual’s PHI.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into…

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and HIPAA privacy and security. Anna is co-chair of the firm’s Health Care Industry practice group.

Anna regularly advises clients on Medicare reimbursement matters, particularly those arising under Part B and the Part D prescription drug benefit. She also has extensive experience with the Medicaid Drug Rebate program. She assists numerous pharmaceutical and device manufacturers, health care providers, pharmacy benefit managers, and other health care industry stakeholders to navigate the challenges and opportunities presented by the Affordable Care Act.

Anna is a trusted adviser on health information privacy, security and breach notification issues, including those arising under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. Her background in this area dates back to the issuance of the original HIPAA privacy regulations.

Anna’s clients depend on her to guide them through compliance with the Anti-Kickback statute, the Stark regulations, and other laws preventing fraud and abuse in the health care industry. Her deep knowledge of these laws has made her an important component of the firm’s representation of pharmaceutical companies and health care organizations under federal investigation or facing allegations under the False Claims Act. In addition, clients contemplating acquisitions in the health care sector rely on her to guide due diligence efforts.

Read more about Anna D. KrausEmail
Show more Show less