Use and Disclosure of Protected Health Information for Research under the HIPPA Privacy Rule, The: Unrealized Patient Autonomy and Burdensome Government Regulation

This article offers a legal and ethical analysis of the requirements of federal privacy regulations (herein after the “Privacy Rules”) relating to the use and disclosure of individually identifiable health information for research activities. Section II of this article provides a legal summary of the Privacy Rules’ complex research provisions. Sections III and IV of this article analyze the Privacy Rules’ research provisions from a legal and ethical perspective. Specifically, Section III addresses whether the Privacy Rules promote autonomy by analyzing certain of the legal rights attributed to individuals who are the subjects of health information including: (1) the general right of an individual to authorize (or refuse to authorize) a covered entity’s use or disclosure of health information for research activities; (2) the right of an individual to receive a notice of privacy practices, the purpose of which is to provide the individual the adequate notice to the uses and disclosures of health information that may be made by the covered entity, including uses and disclosures for research activities; and (3) the right of and individual to receive and accounting of health information disclosures made by the covered entity. Section IV of this article addresses whether the Privacy Rules’ research provisions which permit, in certain situations, covered entities to use and disclose individually identifiable health information for research activities without patient authorization. Section IV analyzes the regulatory approaches chose by HHS, including its decision to waive the requirement for patient authorization when: (1) an institutional review board or privacy board has approved the waiver of, or an alteration to, the otherwise required authorization; (2) the review of the information by the researcher is preparatory to or in anticipation of, research; (3) the research involves decedents’ information; or (4) the covered entity is only using or disclosing a limited data set of information pursuant to a data use agreement for the research activity. Finally, Section V of this article includes that, although well-intended, the Privacy Rules research provisions establish onerous administrative requirements the burden of which may outweigh any autonomy that could be realized by the research subject