HIPAA 2017 JHSPH IRB Clarifications and Changes Accessing protected health information from Johns Hopkins Medicine

Quick Review of Hipaa & research Protected Health Information (PHI): Individually identifiable health information that is transmitted or maintained in any form or medium (electronic, oral, or paper) by a covered entity or its business associates

“covered entity” Health Care Provider: Doctor, Hospital, Clinic, Pharmacy, Chiropractor, Dentist, Psychologist, Nursing Home - but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard. Health Plan: Health Insurance Companies, HMOs, Company Health Plans, Government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans health care programs Health Care Clearinghouse: Entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa

Clarifications for JHM Some People Think Clarifications for JHM PHI “once disclosed” for research is still PHI IRB must grant a waiver to access medical records for recruitment Researchers may access medical records, with permission from clinicians PHI properly disclosed for research is no longer covered by HIPAA HIPAA permits access to medical records for recruitment “Preparatory to Research” without authorization or waiver Only “HIPAA Workforce Members” may access medical records

What is “Proper disclosure” for research? Disclosure of PHI after obtaining signed HIPAA Authorization from research participant Disclosure of PHI “Preparatory to Research” Disclosure of PHI via HIPAA Waiver approved by the IRB Disclosure of PHI via Limited Data Set created by JHHS Workforce Member (likely an Honest Broker) Disclosure of PHI for Research on Decedents Only

HIPAA Privacy Authorizations Are usually combined with informed consent document and are signed Specific regulatory requirements are included in JHSPH consent/authorization template Data disclosed via authorization for research are no longer “PHI” under HIPAA, but are “sensitive private information” requiring appropriate data security protections

Preparatory to research REQUIREMENTS FOR JHM RECRUITMENT Access to PHI only by a “JHHS HIPAA Workforce Member” Access to PHI must be to identify potential participants “within the covered entity” Clinician with treatment relationship must first contact potential participant to get permission for disclosure Clinicians must record patient permission to disclose PHI to researcher in patient medical record Disclosure to researcher is limited to “minimum necessary” information for eligibility and contact

Jhm HIPAA WORKFORCE MEMBERS Credentialed JHHS-privileged professional or staff who have access to EPIC for patient care (credentialed JHHS Workforce Member) Students in health care professions (SON, SOM, SPH) who access PHI under direction of credentialed JHHS Workforce Member and who have signed a HIPAA Workforce Agreement JHU Research Personnel (faculty, staff) working under direction of credentialed JHHS Workforce Member who have signed HIPAA Workforce Agreement JHU Research Personnel serving as JH Privacy Office credentialed “Honest Brokers”

Preparatory to research Recruitment mechanism #1 Contacting the potential participant within the covered entity: Clinician with treatment relationship must ask patient for permission to disclose PHI to researcher Clinician must document permission to disclose “minimum necessary” PHI (name, eligibility criteria) to researcher in medical record Researcher contact with potential participant must occur in the covered entity PHI cannot leave the covered entity

PREPARATORY TO RESEARCH RECRUITMENT MECHANISM #2 Contacting the potential participant outside the covered entity Clinician with a treatment relationship must contact potential participant (by mail, phone, etc.) to ask permission to disclose PHI to researcher Clinician must be added to study as co-investigator and must document permission to disclose in the patient’s medical record Researcher may use the PHI to contact the potential participant outside the covered entity The IRB must waive/alter the signature requirement for consent/authorization, allowing record of patient permission in medical record to serve as documentation Researcher must obtain a signed consent/authorization from participants if the research involves access/use of additional PHI

HIPAA Waiver: Regulatory Requirements The use or disclosure of PHI must pose no more than minimal risk to privacy of individuals because: Researcher provides adequate plan to protect identifiers Researcher provides adequate plan to destroy identifiers Researcher provides written assurance that the PHI will not be reused or disclosed, with a few exceptions The research could not practicably be conducted without the Waiver The research could not practicably be conducted without the PHI Disclosures of JHM PHI under HIPAA Waiver must be tracked

When is HIPAA Waiver likely to be approved? For recruitment in circumstances for which it is impracticable to have a clinician with a treatment relationship contact potential participants (expected to be rare at JHM) Most likely cases: For secondary data analysis of existing, identifiable data For broad program evaluation

Tracking for approved JHM HIPAA waivers Patients have the right to an accounting for all disclosures of PHI under an IRB approved HIPAA Waiver, up to 6 years post-disclosure Researchers with fewer than 50 JHM participants must track the disclosures in the SPH JH Compliance Tracking System (https://cfapps.jhsph.edu/SPH-JH-HIPAA- Compliance/) Researchers with 50 or more JHM participants will have their studies reported by the IRB to the JHM Privacy Office

Limited data set and de-identified data set Must be created by credentialed JHHS Workforce Member May include: Admission, discharge, service dates DOB, DOD Age, including 90 and over Five digit zip code or any other geographic subdivision, such as state, county, city, precinct, census tract and equivalent geocodes except street address

Use of decedents’ information Deceased individuals are not “human subjects” under the DHHS Common Rule, but are protected under HIPAA Researchers seeking to use Decedent PHI must be JHHS Workforce Members Researchers must obtain IRB permission to use PHI of deceased individuals by completing HIPAA Form 5, “Representations Form for Research Involving Only Decedents’ Information” http://www.hopkinsmedicine.org/institutional_review_ board/hipaa_research/forms.html