PARTNERS HUMAN RESEARCH COMMITTEE
116 Huntington Ave, Suite 1002. Boston, MA 02116
Tel: 617-424-4100, Fax: 617-424-4199
Partners_Logo

 

Individual Rights in the Research Context

The HIPAA Privacy Rule gives individuals a number of rights regarding access to, knowledge about and control over their identifiable health information. All investigators must be aware of and able to implement these rights.

1. The Right to Access PHI:

Research subjects are entitled to access (i.e., inspect and copy) their PHI that is maintained in a designated record set as defined by the Privacy Rule.

Designated record set: a health care provider's medical and billing records about individuals and any records used by the provider to make decisions about individuals.

For research purposes, the designated record set primarily includes PHI that is generated in research and recorded in the medical chart or in billing records. PHI recorded elsewhere (e.g., a lab notebook) that may be used to make clinical or billing decisions about the subject (e.g., a blood pressure reading) is also part of the designated record set.

Not included in a designated record set: information generated in research that lacks clinical validity or clinical utility and that is not recorded in the medical chart or in billing records and that will not be used for making decisions about the individual.

Exceptions to access:

  • The Privacy Rule permits researchers conducting clinical trials to suspend subjects' right of access temporarily, for as long as the research is in progress, if the subject specifically agrees to this suspension in the research authorization. The right of access must be reinstated when the research is completed.
  • The Privacy Rule allows a researcher to deny an individual access if the PHI was obtained from someone other than a health care provider under a promise of confidentiality and the access would likely reveal the source of the information.

If a subject requests access to their research information, refer that subject to the Privacy Officer at your institution. The Privacy Officer will then work with the investigator to coordinate a response.

2. The Right to Amend PHI:

Research subjects are entitled to request an amendment to their PHI that is in a designated record set (see above definition). If a subject requests such an amendment, refer that subject to the Privacy Officer at your institution. The Privacy Officer will then work with the investigator to coordinate a response.

3. The Right to Receive an Accounting of Disclosures:

An individual has the right to request an accounting of every disclosure (sharing outside of Partners) of their PHI made pursuant to a waiver. The right to an accounting also applies to disclosures of decedents' information and disclosures preparatory to research. Such requests must be directed to the Privacy Officer.

In order to fulfill this requirement, investigators are required to report to the Privacy Officer (or designee) all disclosures (sharing outside of Partners) of protected health information (PHI) made pursuant to a waiver of authorization or in the other cases noted above, if applicable. This record must be kept for 6 years (starting on April 14, 2003) after the disclosure and it must include the following information in addition to a list of all individuals about whom PHI was disclosed:

  • Date of the disclosure
  • Name of the person or entity who received it and their address (if known)
  • Brief description of what PHI was disclosed
  • Brief statement of the purpose of the disclosure

If the research is particularly sensitive, the investigator may replace the description of what PHI was disclosed and the brief statement of purpose of the disclosure with a reference code that will be kept by the investigator. The investigator could then provide the names of all enrolled individuals, the date of the disclosure, the names of persons or entities receiving the PHI and the reference code.

Multiple disclosures for same purpose:

The Privacy Rule provides specific provisions for ongoing studies that require multiple disclosures of PHI for the same research protocol. If during the 6-year reporting period, multiple disclosures of the PHI have been made to the same person or entity for a single purpose, then the accounting may include:

  • For the first disclosure:
    • Date of the disclosure
    • Name of the person or entity who received it and their address (if known)
    • Brief description of what PHI was disclosed
    • Brief statement of the purpose of the disclosure
  • The frequency, periodicity, or number of the disclosures made during the 6 year period
  • The date of the last such disclosure made during the 6 year reporting period

Procedure:

1. The IRB's notice granting approval of a waiver of authorization will state that you must track all disclosures. Partners has developed an Excel-based template that can be used to document all of the required information. The investigators can use this template for their internal records and forward it to the Privacy Officer as required.

2. The investigator must provide to the Privacy Officer a list of names of every study participant and the following information (reporting to the Privacy Officer should be made either at the time of disclosure or quarterly):

  • Date of the disclosure
  • Name of the person or entity who received it and their address (if known)
  • Brief description of what PHI was disclosed
  • Brief statement of the purpose of the disclosure

3. If the study requires multiple disclosures, the following information must be provided to the Privacy Officer:

  • For the first disclosure:
    • Date of the disclosure
    • Name of the person or entity who received it and their address (if known)
    • Brief description of what PHI was disclosed
    • Brief statement of the purpose of the disclosure
  • The frequency, periodicity, or number of the disclosures made during the 6 year period
  • The date of the last such disclosure made during the 6 year reporting period

4. If an individual approaches you/your lab requesting an accounting of all disclosures made within the previous 6 years, you must refer the individual to the institutional Privacy Officer.

4. The Right to Restrict Uses and Disclosures of PHI:

Research subjects are entitled to request that the researcher restrict the uses and disclosures of their PHI. However, the researcher is not required to agree to the restriction. If the researcher wants to consider this request, s/he should contact the Privacy Officer to coordinate a response.

5. The Right to Request Alternate Means or Alternate Location for Communications:

The researcher must accommodate such requests (e.g., home address vs. work address), if reasonable. The researcher may not require the subject to explain the basis of the request. In order to comply with this requirement, each authorization and informed consent document will ask the subject to identify the preferred contact information.

6. The Right to Revoke Authorization for the Use or Disclosure of PHI:

Subjects have the right to revoke their authorization for research uses and disclosures of their PHI, except to the extent that the researcher has already relied on the authorization. This request must be in writing. If the PHI has already been used to perform an analysis or other evaluation for the study, the results of that analysis can be retained. The researcher may also continue to use the subject's PHI as necessary to account for the subject's withdrawal from the study or to report adverse events. However, the researcher generally may not use or disclose any PHI that has not already been created or gathered at the time the person revokes the authorization. Researchers must inform other individuals or sites involved in the research of any subjects' revocation of authorization.