TISSUE REPOSITORIES: THE COMMON RULE and THE HIPAA PRIVACY RULE Mark A. Rothstein, J.D. Herbert F. Boehl Chair of Law and Medicine Director, Institute for Bioethics, Health Policy and Law University of Louisville School of Medicine

1. Coverage Neither the Common Rule nor the Privacy Rule has comprehensive coverage. Common Rule – coverage is based on relationship to federal government (i.e., federal funding, FDA submission, MPA)

Privacy Rule – coverage is based on relationship to electronic claims submission (i.e., health providers, health plans, health clearinghouses) The gaps in coverage are not parallel, and efforts to expand coverage of both rules have not met with success.

2.Applicability to Tissue Repositories Neither the Common Rule nor the Privacy Rule was drafted with a contemplation of development of vast biobanks, large-scale automated analytical tools, electronic health records and networks, and population- wide studies.

3.Differences Between the Common Rule and the Privacy Rule There are several important variations between the two rules. Sometimes the provisions of the Common Rule are more burdensome for researchers; sometimes the provisions of the Privacy Rule are more burdensome. The differences have been noted in the PRIM&R report and other studies.

In letters to the Secretary of HHS in November 2001 and March 2004, the National Committee on Vital and Health Statistics (NCVHS) recommended harmonization of the Common Rule and the Privacy Rule. A trans-HHS working group was established in late 2006 to consider the issue.

4.Key Differences of Particular Relevance to Tissue Repositories Example #1: Consent for Unspecified Future Uses Common Rule – Blanket consent for future use is disfavored but not prohibited. Tiered consent often is used to designate broad categories of approved research uses of specimens.

Privacy Rule – Study specific authorization or study-specific waiver of authorization is required for disclosure of PHI.

There is a problem with authorization for prospective disclosure of health records. At the time of initial authorization, an individual may not have sensitive information (e.g., mental health, STD) in his or her record. The individual is unlikely to realize that there could be unlimited, future disclosures of all health information.

One possible solution is to authorize unspecified uses (through tiered authorization), but limit additions to the health record to a period of years (e.g., 5 years), and to require new authorization.

Example #2: Identifiability Identifiability is a key concept for both the Common Rule (exemption 4 – 45 CFR (b)(4)) and the Privacy Rule (45 CFR (a)). The standards for de-identification are different (of course).

Both rules have the same premise: If the specimens or data are not identifiable, then there are no significant risks to the welfare or privacy of the subject/individual.

This assumption may not be valid. Identifiability should be only one factor in determining whether there are more than de minimis risks to the subject/individual. De-identified information may produce substantial harms : 1.Ease of re-identification 2.Group harms 3.Objectionable uses

Several studies have shown that, if asked, patients will give consent and authorization to use their tissue and records, but they want to be asked. Use of de-identified tissue and information without permission risks a loss of trust in biomedical research and the health care system generally.

5.PRIM&R Recommendations The report does a nice of job raising many of the key issues. I do not support all of the recommendations.

E.g., the notice approach of the Privacy Rule should be used instead of the informed consent approach of the Common Rule. E.g., Research subject to the Common Rule should be exempt from the Privacy Rule requirements.

6.Avoiding False Dichotomies The issue is NOT researchers vs. individuals. Without individuals supplying their tissue, health records, and tax dollars, many researchers would be out of business. Without researchers, individuals will not reap the benefits in prevention, diagnosis, and treatment for themselves and their loved ones.

7.The Challenge thoughtful, nuanced, forward-looking, simple, clear, minimally burdensome regulations Develop that will also:

Reasonably safeguard the welfare and privacy of subjects/individuals. Empower subjects/individuals to make informed decisions. Contain a level of transparency and accountability. Obtain and maintain individual and collective trust in the research and health care enterprises.