Privacy and Security Considerations in Research and Clinical Trials February 28, 2013 Joanna K. Napp, J.D., M.P.H. Chief Privacy Officer and Compliance Officer HealthTronics Inc. American Society for Experimental NeuroTherapeutics | 15 th Annual Meeting

Disclosure HealthTronics Inc. and Endo Health Solutions Inc. American Society for Experimental NeuroTherapeutics | 15th Annual Meeting Type of Financial Relationship: Employment/Workforce Member

Learning Objectives Identify and obtain a general overview of the federal and state privacy laws that may apply to research and clinical trial activities, including on-line trials; Understanding the differences between privacy and security law application to persons/entities involved in the trials/research; Identify means of complying with key privacy and security laws and mitigating privacy risks that can arise. American Society for Experimental NeuroTherapeutics | 15th Annual Meeting

Disclaimer This presentation is provided for informational purposes only and is not intended and should not be construed to constitute legal advice. Please consult your own counsel and/or privacy officer in connection with any questions regarding, or any fact-specific situations under, local, state and/or federal laws and regulations. ©2012 HealthTronics, Inc. All rights reserved. 4

Landscape of Federal Laws and Regulations Affecting Privacy in Research –FDA Requirements –Patient Safety Quality Improvement Act (PSQIA) –HIPAA/HITECH and the new “Omnibus Rule” –Genetic Information Nondiscrimination Act (GINA) –The “Common Rule” –FTC – Red Flag Rule; Personal Health Records –The Privacy Act of 1974 ©2012 HealthTronics, Inc. All rights reserved. 5

State Privacy and Security Laws –State laws have broader coverage/scope than HIPAA and other federal privacy laws. –State laws have separate privacy and security requirements. The security requirements often cover PII, not just PHI. –State laws can be very restrictive on use of PHI in marketing uses and sales. The terms “marketing” and “sale” can be defined very broadly. –State laws can provide steep fines and penalties, and private rights of actions for security breaches. –States may have additional requirements for patient authorizations. –States are developing rules specific to mobile applications.

State Privacy and Security Laws - Examples  California  Mobile applications  Security breach requirements  Texas  Broad Covered Entity definition  Separate security/breach requirements  Massachusetts  201 CMR ©2012 HealthTronics, Inc. All rights reserved. 7

–Recruitment for trials –Consents/authorizations –Security of data –Communications –Privacy statements and representations –Secondary uses ©2012 HealthTronics, Inc. All rights reserved. 8 Privacy and Security Concerns in Clinical Trial Activities

Use of Social Media in Clinical Trial Activities ©2012 HealthTronics, Inc. All rights reserved. 9  Use in recruitment  Third-party websites and third-party web-based applications and tools are technologies that a sponsor/investigator will not own, operate or exclusively use or control.  Do you know how these sites or platforms will work?  If information from users will be collected through interaction on a social networking site, does the site/application address how privacy will be maintained?  What types of data and from whom?  Vulnerable populations?  Sensitive information?  Identification of participants?  Who stores the data and where?  Who has access?  Who will monitor?

Use of Social Media in Clinical Trial Activities  How will participants understand the degree to which information may be collected, transmitted, viewed or shared? What is their expectation of privacy? What is the person’s right to control access to his/her information?  Does your recruitment plan address this?  Remember that recruitment using social media may still be subject to protection of human subject regulations at 45 CFR Part 46 (Common Rule), and 21 CFR Part 56 (FDA).  These regulations require IRB review and approval of certain covered research;  OHRP Guidance notes: “Some clinical trial websites ask viewers to answer questions regarding eligibility for a specific clinical trial. If identifiable private information is collected via the clinical trial website, the IRB should review plans for protecting the confidentiality of that information. The IRB should ensure that the website clearly explains how identifiable private information might be used.” ©2012 HealthTronics, Inc. All rights reserved. 10

Use of Social Media in Clinical Trial Activities  Use in communications  Sending communications during trials – use of mobile devices and mobile applications.  Study reminders  Visit requirements  Privacy and Security of mobile apps.  California  FTC  Considerations through all phases of the trial  What is the process for handling a security or privacy breach?  Due to the real-time nature of social media, it’s important to address privacy issues at the front end. ©2012 HealthTronics, Inc. All rights reserved. 11

Patient/Subject Considerations  Privacy policies  Terms of service  Identification and re-identification Issues  Storage and transmission of data – encryption and other security measures  Consents/authorizations  Content and verification  Waivers  Documentation and retention  How informed is the subject? Have you acquired legally-effective informed consent? Static or on-going process?  OHRP FAQ and Guidance  Regulatory requirements (45 CFR ; 21 CFR part 50)  State law requirements  Belmont Report  HIPAA ©2012 HealthTronics, Inc. All rights reserved. 12

Recent HIPAA Changes Affecting Research  The Privacy Rule prohibited “compound authorizations”. For example, this prohibited Covered Entities from obtaining a single authorization for the use or disclosure of PHI for a research study that included both treatment as part of a clinical trial and tissue banking of specimens collected.  Under the new “Omnibus” Rule, a Covered Entity will be allowed to combine conditioned and unconditioned authorizations for research, so long as the authorization clearly differentiates between the conditioned and unconditioned components and clearly allows the subject to “opt- in” to the unconditioned research component/activities.  HHS intends this change to allow for the use of compound authorizations for any type of research activities (except research that involves the use or disclosure of psychotherapy notes). ©2012 HealthTronics, Inc. All rights reserved. 13

Impact on Clinical Care and Practice Privacy and security are important considerations throughout all aspects of a clinical trial. Use of social media makes privacy and security considerations more complex. Privacy and security must be addressed prospectively and continually. Providing truly informed consent requires consideration of the privacy and security implications and articulating them in a way that the subjects can understand and appreciate all the risks.