2.2.1. The Common Rule

International and domestic concerns about the protection, respect, and privacy of human subjects resulted in a uniform set of regulations from the Federal agencies that fund such research known as the “Common Rule.”^21,22 The legal requirements of the Common Rule apply to research involving human subjects conducted or supported by the 20 Federal departments and agencies, including HHS, that intend to follow the revised Common Rule (Common Rule Agencies). Some of these agencies may require additional legal protections for human subjects. In addition, under the revised Common Rule, institutions that receive funding from a Common Rule Agency may also voluntarily elect through their Federalwide Assurance (as discussed further below) to apply the Common Rule to all human subjects research, irrespective of funding source, conducted by their employees or agents.²³

Significant amendments were made to the Common Rule in 2017. As of January 21, 2019, institutions are expected to be compliant with the revised Common Rule.

Each institution engaged in human subjects research conducted or supported by a Common Rule Agency must enter into a formal written agreement to comply with the Common Rule. For human subjects research conducted or supported by most of the Common Rule Agencies, the required agreement is called a Federalwide Assurance (FWA).²⁴ The Office for Human Research Protections (OHRP) administers the Common Rule as it applies to human subjects research conducted or supported by HHS. The application of Common Rule requirements to a particular registry depends on the institutional context of the registry developer, relevant institutional policies, and whether the health information contributed to the registry maintains patient identifiers. Of particular note is that while the pre-2018 Common Rule allowed institutions to voluntarily subject all of their human subjects research, irrespective of the source of funding or support, to oversight by OHRP for compliance with the Common Rule, the revised Common Rule eliminated this option. Therefore, institutions that seek to conduct non-federally funded or supported human subjects research in accordance with the Common Rule will need to rely on internal oversight and compliance mechanisms to facilitate adherence to Common Rule standards.

Guidance documents published by OHRP, such as the 2008 guidance entitled “Coded Private Information or Specimens Use in Research” and the guidance entitled “Issues to Consider in the Research Use of Stored Data or Tissues” (last updated in 1997), discuss the research use of identifiable private health information.²⁵ The latter guidance makes clear that OHRP considers the creation of health information registries—containing individually identifiable, private information—for research purposes to be human subjects research for the institutions subject to its jurisdiction.²⁶ The applicability of the Common Rule to research registries is discussed in more detail in Section 3.

OHRP regulations for human subject protection require prospective review and approval of human subjects research by an institutional review board (IRB) and the informed consent (usually written) of each of the human subjects involved in the research, unless an IRB expressly grants a waiver of informed consent requirements.²⁷ A research project must satisfy certain regulatory conditions to obtain IRB approval of a waiver of the informed consent requirements. (See below for discussion of waivers of informed consent requirements.) A registry plan is the research “protocol” reviewed by the IRB. At a minimum, the protocol should identify (1) the research purpose of a health information registry, (2) detailed arrangements for obtaining informed consent, or detailed justifications for not obtaining informed consent, to collect health information, and (3) appropriate safeguards for protecting the confidentiality of registry data, in addition to any other information required by the IRB on the risks and benefits of the research.²⁸

As noted previously, for human subjects research conducted or supported by most Common Rule Agencies, an FWA satisfies the requirement for an approved assurance of compliance. In addition, irrespective of requirements applicable by operation of the revised Common Rule, some research organizations have explicit institutional policies and procedures that require IRB review and approval of all human subjects research.

2.2.2. The Privacy Rule

In the United States, HIPAA and its implementing regulations (namely, the Privacy, Security, and Breach Notification Rules, which are collectively referred to here as the HIPAA Rules) created legal protections for the privacy of individually identifiable health information created and maintained by “covered entities” and their “business associates.” “Individually identifiable health information” is information, including demographic data, created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse, that identifies an individual or could reasonably be used to identify an individual, and relates to (1) an individual’s past, present, or future physical or mental health or condition; (2) the provision of healthcare to an individual; or (3) the past, present, or future payment for healthcare to an individual. With certain exceptions, “individually identifiable health information” is “protected health information” (PHI) under the HIPAA Rules when it is transmitted or maintained by a covered entity or a business associate on behalf of a covered entity.²⁹ Because registries may exist over long periods of time, it is important to note that the individually identifiable information of persons who have been deceased for more than 50 years is not considered PHI.

Covered entities are healthcare providers that engage in certain standard financial or administrative healthcare transactions electronically, health plans, and healthcare clearinghouses.³⁰ Business associates generally are persons or organizations, other than a member of a covered entity’s workforce, that perform certain functions or services (e.g., claims processing, data analysis, data aggregation, patient safety activities) on the covered entity’s behalf that involve access to PHI.³¹ Covered entities and business associates are subject to civil—and in some cases criminal—liability for violations of the HIPAA Rules. This chapter will focus on covered entity healthcare providers and healthcare plans, as well as their respective business associates.

Generally, the Privacy Rule defines the circumstances under which covered entities and their business associates may use and disclose PHI for a variety of purposes, including research.³² The Privacy Rule establishes a Federal baseline of protections, and it does not preempt State laws that provide even greater, more stringent privacy protections for PHI.³³ For example, the Privacy Rule requires covered entities to include certain information in patient authorizations for the use or disclosure of PHI, including an expiration date or event that can be many years in the future. The laws of the State of Maryland, however, specifically require that, absent certain exceptions, a patient’s authorization may only be valid for a maximum period of 1 year.³⁴ In this case, a covered entity located in Maryland can and should satisfy both the Privacy Rule and State law requirements by complying with the State’s one-year maximum expiration deadline on its patient authorization forms.

The HIPAA Rules may apply to either or both the registry developer (as a covered entity or a business associate developing the registry in a business associate capacity) and the registry’s data sources. A registry’s initial collection of health information from a covered entity or business associate requires a disclosure pathway under the Privacy Rule. Thus, registry developers that are not themselves subject to the HIPAA Rules should nonetheless be knowledgeable about the HIPAA Rules to facilitate the necessary processes for any of their data sources that are covered entities or business associates. In developing a registry, they should expect to interact with clinicians, the privacy officer, the IRB or privacy board staff, health information system representatives, legal counsel, compliance officials, and contracting personnel. Registry developers should also maintain awareness of regulatory modifications or amendments to, or new guidance on how to comply with, the HIPAA Rules, which can be expected as the use of electronic PHI becomes more prevalent. For example, on January 25, 2013, HHS issued significant modifications to the HIPAA Rules, many of which implemented HITECH Act requirements.³⁵ One of the most relevant modifications for registry developers, as mentioned above and discussed more fully below, is the extension of certain requirements of the HIPAA Rules and liability for noncompliance directly to business associates.³⁶

The HIPAA Rules would also apply where the registry developer is a covered entity or business associate (creating the registry in its business associate capacity) and collects health information from other covered entities or business associates, or from data sources that are not subject to the HIPAA Rules. Examples of the latter may include developers of wearable devices and mobile applications that are provided directly, and not on behalf of a covered entity or health plan, to individuals to track their health and fitness. Although HIPAA does not apply to such data sources, a pathway under the Privacy Rule would still be necessary for the HIPAA covered registry developer to use and disclose the data once in its possession, as the data would then constitute PHI in its possession. Note also that the data source itself may be subject to other laws, such as the Federal Trade Commission Act’s (FTC Act), which prohibits unfair or deceptive trade practices, and State laws that include requirements for the protection of personal information from a privacy or consumer protection standpoint. Registry developers should anticipate that such non-HIPAA regulated data sources may become more prevalent with the proliferation of digital health solutions and consider the regulatory and legal requirements and other limitations (such as in privacy policies and terms of use applicable to the data collection platform) that may apply to the registry’s collection and use of data from such sources.

Under certain circumstances, registry developers and the associated institutions where the registry will reside may not be subject to the HIPAA Rules. Notably, the HIPAA Rules do not apply to registries that reside outside of a covered entity or business associate. Within academic medical centers, for example, registry developers may be associated with units that are outside of the institutional healthcare component to which the HIPAA Rules apply, such as a biostatistics or economics department. The FTC Act and similar state laws referenced above may apply to such registry developers if they are not a public agency or non-profit institution.³⁷ To avoid running afoul of the FTC Act, such registry developers should be transparent in privacy notices provided to participants through any website or application used for information collection process about the intended uses and disclosures of the information. The registry developer should also limit uses and disclosures of information collected through the registry to those described in the privacy notice and maintain safeguards commensurate with the representations made in the privacy notice and the sensitivity of the information collected by the registry.

Ultimately, however, many potential data sources for registries will be covered entities or business associates, such that registry developers are likely to find themselves deeply enmeshed in the HIPAA Rules. As noted above, a registry may have direct liability under HIPAA if the registry is considered a business associate of a data source that is a covered entity (see the discussion below of the HITECH Act, which extended direct liability for compliance with certain requirements of the HIPAA Rules to business associates of covered entities, where before business associates were required and liable to protect the information to which they had access only through their business associate agreements with covered entities). Under such circumstances, the registry developer must enter into a business associate agreement with the covered entity that meets the requirements under the Privacy Rule before the registry developer can use or disclose PHI in connection with the development or deployment of the registry. Therefore, registry developers should be cognizant of the patient privacy considerations confronting their likely data sources—as well as themselves, if they are performing functions or services on behalf of their data sources as business associates—and should consider implementing certain HIPAA protections whether or not they are required to do so. In addition, the HIPAA Rules require that covered entities enter into formal agreements, known as data use agreements, with any recipient of PHI that constitutes a limited dataset before the recipient may use the limited dataset for permitted purposes (i.e., research, healthcare operations, or public health activities). Recipients of limited datasets may be subject to legally enforceable obligations under contract law by virtue of the data use agreement in addition to any regulatory obligations that apply in the event the recipient is a covered entity or business associate.

A registry developer that is not a covered entity or business associate and that seeks to collect information directly from individuals may also still encounter Privacy Rule requirements if patient information from a healthcare provider or insurance plan for purposes of is needed to recruit registry participants. For example, a patient authorization or waiver of authorization (discussed below) may be necessary for the disclosure of patient contact information by a healthcare provider or insurance plan (or their business associate) to a registry developer, even if the actual information to be collected by the registry will be provided from the patient him or herself. Note that the strategy of requesting data directly from individuals can be useful for collecting data on mobile populations, such as elderly retirees who occupy different residences in winter and summer, and for collecting the health records of school children. A Federal privacy law³⁸ protects the health records of children that are held by schools from disclosure without explicit parental consent; thus, parents can often obtain copies of these records more easily than investigators.

Following the registry’s collection of data, its subsequent use and sharing of registry data will be informed by the regulatory conditions that applied to the initial collection of the registry data, as well as by other ethical and legal considerations. The Privacy Rule created multiple pathways by which registries can compile and use patient information. For instance, a registry within a covered entity may obtain a HIPAA authorization from each patient contributing PHI to a registry for a particular research project, such as the relationship between hypertension and Alzheimer’s disease. If the registry subsequently seeks to use the PHI for a different research purpose, it may do so if it obtains new authorizations or the use otherwise satisfies the Privacy Rule. For example, the registry may de-identify the PHI in accordance with the Privacy Rule’s de-identification standards, at which point the data would no longer be considered as PHI. Alternatively, the registry can obtain authorizations for use and disclosure of individuals’ PHI for future research purposes at the same time that it obtains authorization to place the information in the registry, as long as the authorization adequately describes the purposes of the future research such that it would be reasonable for the individual to expect that his or her information could be used or disclosed in connection with the future research activity.³⁹

The authors recommend that registry developers establish a detailed tracking system, based on the extent to which registry data remain identifiable for individual patients, for the collection, uses, and disclosures of registry data. The tracking system should produce comprehensive documentation of compliance with both Privacy Rule requirements, including requirements to obtain authorizations, and any legally binding contractual obligations to data sources.

With regard to registries developed for research purposes, the Privacy Rule defines research as “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.”⁴⁰ Commentary by HHS on the Privacy Rule explicitly includes within this definition of research the development (building and maintenance) of a repository or database for future research purposes.⁴¹ The definition of research in the Privacy Rule partially restates the definition of research in the Common Rule for the protection of human subjects, adopted by HHS and certain other Federal agencies.⁴² Some implications of this partial restatement of the definition of research are discussed later in this chapter.

The National Institutes of Health (NIH) has published guidance, in collaboration with the Office for Civil Rights and other HHS offices and agencies, on the impact of the Privacy Rule on health services research and research databases and repositories. The NIH guidance identifies the options available to investigators under the Privacy Rule to gain access to PHI held by healthcare providers and insurance plans.⁴³ For example, in addition to provisions for the use or disclosure of identifiable patient information for research, the Privacy Rule permits healthcare providers and insurance plans (and business associates on their behalf) to use or disclose patient information for certain defined public health activities.⁴⁴ The Privacy Rule defines a public health authority as “an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency… that is responsible for public health matters as part of its official mandate.” The Centers for Disease Control and Prevention and HHS have jointly published specific guidance on the Privacy Rule requirements related to public health activities.⁴⁵ Other Privacy Rule provisions permit uses or disclosures of PHI that are required by law, including State laws.⁴⁶

The protections for patient information created by the Privacy Rule that are generally relevant to registries developed for research purposes include explicit individual patient authorization for the use or disclosure of PHI,⁴⁷ legally binding data use agreements for the release of “limited datasets” between health information sources and users,⁴⁸ the removal of specified identifiers or statistical certification to achieve de-identification of health information,⁴⁹ an accounting of disclosures to be made available to patients at their request,⁵⁰ and notification in the event of a breach of unsecured PHI to affected individuals who may be affected by the breach, as well as HHS and, in some cases, the media. In addition, if certain criteria required by the Privacy Rule are satisfied, an IRB or privacy board may grant a waiver of individual patient authorization for the use or disclosure of health information in research.⁵¹

2.2.3. FDA Regulations

Depending on the circumstances, FDA regulatory requirements may apply to the development or use of a health information registry. In particular, FDA requirements for the protection of human subjects (also referred to as “Good Clinical Practice” or “GCP” requirements) apply to activities that constitute a “clinical investigation,” which generally means any experiment that involves an FDA-regulated test article and one or more human subjects, and that either is subject to FDA requirements for prior submission, or the results of which are intended to be submitted later to, or held for inspection by, the FDA as part of an application for a research or marketing permit.⁵² Where a health information registry is developed or used to collect data for supporting a marketing permit for a new product, a labeling update for a currently marketed product, or other submission to the FDA relating to an FDA-regulated drug, device, or biologic, FDA human subject protection regulations may apply.

Similar to the Common Rule, FDA human subject protection regulations include requirements for obtaining IRB review of proposed clinical investigations and the informed consent (or an IRB waiver thereof⁵³) of participating human subjects.⁵⁴ Informed consent must be documented by a signed written consent form unless an IRB waives the documentation requirement.⁵⁵ Also of relevance to the establishment and use of such health information registries are the FDA regulatory requirements for the use of electronic records and electronic signatures.⁵⁶ Commonly referred to as “Part 11,” these requirements include standards for access controls, audit trails, and other safeguards to protect the integrity and validity of electronic records and electronic signatures that are used to satisfy FDA statutory or regulatory records requirements.⁵⁷

Unlike the Common Rule and HIPAA, FDA human subject protection regulations do not explicitly exclude clinical investigations that are limited to the use of de-identified information.⁵⁸ Rather, FDA regulations define “human subject” as any “individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A subject may be either a healthy human or a participant.”⁵⁹ This paradigm is likely a reflection of the nature of much research involving FDA-regulated investigational products, which often involves interventions or interactions with living human subjects rather than constitute research limited to the retrospective analysis of data. Until July 2017, the challenge in the lack of a carve-out for research using de-identified data had been compounded by the inability of IRBs to waive FDA’s informed consent requirements for certain minimal risk research (as is permitted under the Common Rule and HIPAA).⁶⁰ As real world data sources proliferate and technological advances make it increasingly easier to capture, share, and learn from electronic information, however, stakeholders are recognizing the potential that data holds in research and development, post-market surveillance, and other FDA-regulated activities.

In that regard, and driven in part by changes mandated under the 21^st Century Cures Act,⁶¹ the FDA has taken steps to facilitate and provide more regulatory guidance regarding the secondary use of data. First, investigators may now seek IRB waiver of the informed consent requirement under FDA regulations according to criteria that are comparable to those under the Common Rule. The parameters for seeking IRB waiver of FDA informed consent requirements are discussed in more detail in Section 3.3.5. Additionally, developers of health information registries should note that the FDA has issued final guidance on the use of real world evidence to support FDA regulatory decision making for medical devices (RWE Guidance).⁶² The RWE Guidance includes the FDA’s recommendations for when a proposed collection of real world data that constitutes a clinical investigation would require an investigational device exemption (IDE). The FDA states that such a determination is fact- and context-specific, but that generally, if the collection of real world data involves using a device in the normal course of medical practice or routine clinical care under the authority of a healthcare practitioner, an IDE would likely not be required.⁶³ In contrast, if the goal is to generate data on the safety and efficacy of a device and the process influences treatment decisions, an IDE may be required.⁶⁴ The RWE Guidance also describes the characteristics of real world data that the FDA may assess to consider whether the data is suitable for regulatory decision making, including the relevance and reliability of the data.⁶⁵

2.2.4. Applicability of Regulations to Research; Multiple-Purpose Registries

At many institutions, the IRB or the office that provides administrative support for the IRB interprets the regulations to determine which activities at that institution constitute human subjects research, and thus may itself determine what activities require IRB review. A registry developer is strongly encouraged to consult his or her organization’s IRB or a central IRB, as applicable, early in the registry planning process to avoid delays and lessen the need for multiple revisions of documentation submitted to the IRB. Distinctions between research and other activities that apply scientific methodologies are frequently unclear. Such other activities include both public health practice⁶⁶ and quality-related investigations.⁶⁷ Both the primary and secondary purposes of an activity are factors considered in the determination of whether registry activities constitute research. For purposes of the Common Rule, as interpreted by OHRP, an activity is considered research even if research is only a secondary purpose of the activity.⁶⁸ This OHRP interpretation of research purpose differs from that of the Privacy Rule with respect to quality-related studies performed by healthcare providers and insurance plans. Under the Privacy Rule, only if the primary purpose of a quality-related activity is to obtain generalizable knowledge do the research provisions of the Privacy Rule apply; otherwise, the Privacy Rule defines the activity as a “healthcare operation.”⁶⁹

Additionally, registry developers should be mindful of the distinctions between the scope of FDA GCP requirements, on the one hand, and the Common Rule and HIPAA, on the other hand. With the steps the FDA has taken to facilitate secondary use of data as described previously, the scope of potential FDA-regulated use cases for health information registries may expand. In that regard, while a research registry that is limited to collecting and using de-identified information would generally fall outside the scope of the Privacy Rule and the Common Rule,⁷⁰ as noted above, FDA regulations do not explicitly exempt or exclude clinical investigations that use only de-identified data from FDA human subject protection requirements.⁷¹ Thus, compliance with FDA GCP requirements may be required for certain registry activities that are not subject to the Common Rule or HIPAA.

Registry developers should rely on their privacy officer’s and IRB’s experience and resources in defining research and other activities for their institutions and determining which activities require IRB review as research. In meeting accreditation standards, inpatient facilities typically maintain standing departmental (e.g., pediatrics) or service (e.g., pharmacy or nursing) committees to direct, review, and analyze quality-related activities. Some physician groups also establish and maintain quality-related programs, because good clinical practice includes ongoing evaluation of any substantive changes to the standard of care. These institutional quality committees can provide guidance on the activities that usually fall within their purview. Similarly, public health agencies typically maintain systematic review processes for identifying the activities that fit within their legal authority.

Standard confidentiality protections for registry data include requirements for physical, technical, and administrative safeguards to be incorporated into plans for a registry. In some instances, an IRB may not consider legally required protections for the research use of patient information sufficient to address relevant confidentiality concerns, including the Privacy Rule protections that may be applicable to registries created by or maintained within covered entities, such as healthcare providers and insurance plans, or business associates. Some IRBs and institutions, for example, may take the position that more stringent privacy protections should apply (if not required under applicable federal or state law) to genomic information. The potential bases for this position include the immutable nature of genetic traits, the potential stigma and discrimination that may result if the information were to be disclosed, and the notion that genomic information may be used to identify an individual or his or her genetic relatives, even if the genomic information does not contain any information that is currently considered PHI under HIPAA.⁷² Likewise, information about certain conditions (such as alcoholism or HIV-positive status) and certain populations (such as children) may be associated with a greater potential for harm from social stigma and discrimination. Under these circumstances, the IRB can make approval of a registry plan contingent on implementation of additional safeguards that it determines are necessary to minimize the risks to the individuals contributing health information to the registry.

3.3.1. De-Identified Health Information

The Privacy Rule describes two methods for de-identifying health information.¹⁰⁸ The “Safe Harbor” method of de-identification requires the removal of 18 specific identifiers related to the individual and the individual’s relatives, household members, and employers. In addition, this method requires the removal of any information that “could be used alone or in combination with other information to identify an individual.”¹⁰⁹ The “Expert Determination” method requires that a qualified expert certify that the potential for identifying an individual from the data elements is very small.

A qualified expert should have “appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable” in order to make this determination.¹¹⁰ De-identified information may include a code permitting re-identification of the original record by the data source (covered entity), provided the code is not derived from information about an individual, including hash codes,¹¹¹ and resists translation. In addition, the decoding key must remain solely with the healthcare provider or plan that is the source of the patient information, and the covered entity cannot use or disclose the code for any other purpose.

Research using existing data in which individual patients cannot be identified directly or indirectly through linked identifiers does not involve human subjects as defined by the Common Rule, and thus is not subject to the requirements of the Rule.⁹⁵ Refer to the discussion later in this chapter. On the other hand, registry developers and users should note that FDA regulations do not explicitly exclude the use of de-identified information from the definition of a clinical investigation.¹¹²

As a prudent business practice, each healthcare provider or insurance plan or its respective business associate that is a source of de-identified information is likely to require an enforceable legal agreement with the registry developer. It should be signed by an appropriate institutional official on behalf of the registry developer. At a minimum, this agreement will likely contain the following terms, some of which may be negotiable: the identification of the content of the data and the medium for the data; a requirement that the data recipient, and perhaps the healthcare provider or insurance plan or their business associate providing the data, make no attempt to identify individual patients; the setting of fees for data processing and data use; limitations on disclosure or further use of the data, if any; and an allocation of the risks of legal liability for any improper use of the data.

In some cases, the registry developer may receive fully identifiable data from healthcare providers or insurance plans and then de-identify the data prior to including it in the registry. In these scenarios, the registry developer plays what is known as an “honest broker” function – which means that the registry developer must not only de-identify the data prior to including it in the registry, but must ensure that any identifiers that the registry developer receives remain inaccessible to the researchers that access the de-identified registry data. Registry developers that provide these “honest broker” services typically use administrative, physical, and/or technical safeguards to establish a “firewall” between the members of its workforce that have access to the fully identifiable data provided by healthcare providers and insurance plans and the workforce members that are performing analyses on the de-identified data. The firewall prevents the researcher from being able to access the identifiable information provided by health plans and insurance companies. Health providers or insurance plans that receive honest broker services from registry developers must enter into business associate agreements with the registry developer in order to disclose PHI to them for this purpose. Most healthcare providers and insurance plans have developed a standard business associate agreement in response to the Privacy Rule and will likely insist on using it, although some modifications may need to be negotiated in order to produce registry data. A registry developer hired to create a de-identified dataset must return or destroy the direct identifiers once the business associate relationship formed for purposes of creating the de-identified dataset terminates.

3.3.2. Limited Datasets of Health Information

De-identified health information may not suffice to carry out the purposes of a registry, especially if the registry is designed to receive followup information as a result of monitoring patients over time or information from multiple sources in order to compile information on a health event (e.g., cancer incidence). Dates of service and geographic location may be crucial to achieving the purposes of the registry or to the integrity and use of the data. Health information provided to the registry that is not fully de-identified but excludes direct identifiers may constitute a limited dataset as defined by the Privacy Rule. A healthcare provider or insurance plan (or business associate on behalf of a provider or plan if permitted by the terms of the business associate agreement) may disclose a limited dataset of health information for research, public health, or healthcare operations purposes, provided it enters into a data use agreement (DUA) with the recipient. The terms of the DUA must satisfy specific Privacy Rule requirements.¹¹³ Officials for both the data source and the registry developer should sign the DUA so that a legal contract results. The DUA establishes the permitted uses of the limited dataset by the registry developer (i.e., the creation of the registry and subsequent use of registry data for specified research purposes). The DUA may not authorize the registry developer to use or disclose the information in a way that would result in a violation of the Privacy Rule if done by the data source.¹¹⁴ Furthermore, the DUA for a limited dataset of health information must provide that the data recipient will appropriately safeguard the information and not attempt to identify individual patients or to contact those patients.¹¹⁵ Certain other requirements also apply.

An investigator who works for a healthcare provider or insurance plan to which the Privacy Rule applies and that is the source of the health information for a registry may use a limited dataset to develop a registry for its own research purpose. In these circumstances, the Privacy Rule still requires a DUA that satisfies the requirements of the Privacy Rule between the healthcare provider or insurance plan and the investigator. This agreement may be in the form of a written confidentiality agreement.¹¹⁶

As with de-identified data, a registry developer may assist a healthcare provider or insurance plan or their business associate by creating the limited dataset as an honest broker.¹⁰⁶ In some situations, this assistance may be crucial to ensuring that data are accessible and available to the registry. In order for the registry developer to perform the honest broker function, the Privacy Rule requires that the data source (the covered entity or their business associate) and the registry developer (in this instance acting as a business associate) enter into a business associate agreement.¹¹⁷

The registry populated with a limited dataset may include a coded link that connects the data back to patient records, provided the link does not replicate part of a direct identifier. The key to the code (e.g., encryption key) may allow health information obtained from patients over time to supplement existing registry data or allow the combination of information from multiple sources.

If the registry data obtained by investigators constitutes a limited dataset, the investigator may elect to consult an IRB or an institutional official knowledgeable about the Common Rule requirements to determine whether the registry involves human subjects, as there is no clear crosswalk between the concept of a limited dataset under the Privacy Rule and the definition of a “human subject” under the Common Rule. Frequently, a special form for this purpose is available from the IRB. The IRB (or institutional official) should provide the registry developer with documentation of its decision. While the Secretary’s Advisory Committee for the Protection of Human Subjects has issued recommended guidance for OHRP’s consideration that would clarify that a limited dataset does not constitute a human subject for purposes of the Common Rule, OHRP has yet to adopt the recommendation as of the date of publication of the fourth edition of the User’s Guide.¹¹⁸

3.3.3. Direct Identifiers: Authorization and Consent

As discussed above, the Privacy Rule permits the use or disclosure of patient information for research with a valid, written authorization from each patient whose information is used or disclosed.¹¹⁹ The Privacy Rule specifies the content of this authorization, which gives permission for a specified use or disclosure of the health information.¹²⁰ Healthcare providers and insurance plans frequently insist on using the specific authorization forms that they have developed in order to avoid additional legal review and minimize any potential liability that they believe might be associated with use of other forms.

One exception to the requirement for an authorization occurs when a healthcare provider or insurance plan creates a registry to support its “healthcare operations.”¹²¹ The Privacy Rule’s definition of “healthcare operations” explicitly includes quality improvement and quality assurance activities, outcomes evaluation, and the development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities.⁴⁰ For example, a hospital registry created to track its patient outcomes against a recognized clinical care standard as a quality improvement initiative has a healthcare operations purpose. The hospital would not be required to obtain authorizations from its patients to use or disclose health information in a registry for this purpose.

Research use of health information containing identifiable information constitutes human subjects research as defined by the Common Rule.⁹⁵ In general, the Common Rule requires documented, legally effective, voluntary, and informed consent of each research subject.¹²² The applicability of FDA GCP requirements, as noted previously, does not turn on the identifiability of the information used. Like the Common Rule, where applicable, FDA GCP regulations require documented, legally effective, voluntary, and informed consent of each research subject.¹²³

Documentation of the consent process required by the Common Rule or FDA regulations may be combined with the authorization required by the Privacy Rule for disclosure and use of health information.¹²⁴ However, registry developers should be aware that a healthcare provider or insurance plan may not immediately accept the combined form as a valid authorization and may insist on legal review of a combined form before disclosing any health information.

In addition to being voluntary and legally effective, an individual’s consent should contain meaningful information about the research, including what activities are involved, and the expected risks and potential benefits from participation. The Common Rule and FDA regulations require the consent process to include specific elements of information.¹²⁵ Registry developers should provide non–English-speaking patients with appropriate resources to ensure that the communication of these elements during the consent process is comprehensible. All written information for patients should be translated, or else arrangements should be made for qualified translators to assist in the consent process.

IRBs may approve waivers or alterations of both authorization (for use or disclosure of patient information for registry purposes) and consent (to registry participation), provided the research use of health information satisfies certain regulatory conditions. In addition, the Privacy Rule provides for the ability of privacy boards to approve waivers of authorization for the research use of health information where an organization does not have an IRB.¹²⁶ Waivers are discussed in detail below.

In certain limited circumstances, research subjects can consent to future unspecified research using their identifiable private information. The Common Rule permits an IRB-approved consent process to be broader than a specific research project¹²⁴ and to include information about research that may be done in the future. In its review of such future research, an IRB can subsequently determine that the previously obtained consent (1) satisfies or (2) does not satisfy the regulatory requirements for informed consent. If the previously obtained consent is not satisfactory, an additional consent process may be required; alternatively, the IRB may grant a waiver of consent, provided the regulatory criteria for a waiver are satisfied.

Investigators may seek informed consent for future unspecified research through one of two pathways under the revised Common Rule. First, as permitted under the pre-2018 Common Rule and now under the revised Common Rule, research subjects may provide consent to future research using their identifiable private information through a consent process that meets the elements set forth in 45 C.F.R. § 46.116(a)-(c), with the purpose of any future research described in accordance with such required elements (to the extent not waived or altered by the IRB).¹²⁷ In addition, under the revised Common Rule, individuals could consent to such research through the new “broad consent” pathway, where the investigator maintains documentation of the broad consent, an IRB conducts a limited review of the proposed use of the information and the scope of the consent, and the investigator does not include returning individual research results to subjects as part of the study plan.¹²⁸ This new consent pathway could allow registry developers to collect data in registries for secondary use studies under a more limited IRB review than previously required. The broad consent provided by individuals under this new consent pathway must include several required elements, including a description of reasonably foreseeable risks and benefits, information about how the confidentiality of the information will be maintained, a description of the type of information that might be used for research purposes and the types of research that will be conducted, a description of the time period that the information will be used, and, if appropriate, a statement that the information may be used for commercial profit (and if the individual will share in the research profit).¹²⁹ OHRP has made clear that this new consent pathway does not replace the pathways noted above for conducting research – i.e., (1) full IRB review of a consent process that is designed to meet the “study-specific” informed consent framework as applied to future use and future studies involving existing datasets; and (2) obtaining a waiver of the consent and authorization requirements from an IRB. In addition, note that certain restrictions and requirements apply in the event an investigator seeks to use the broad consent pathway. For example, an IRB may not waive the informed consent requirement for the storage, maintenance, or secondary research use of identifiable private information or identifiable biospecimens if an individual was asked but declined to provide broad consent for the applicable research activity.¹³⁰

Additionally, note that the elements of informed consent that are required under FDA regulations are comparable to those under the Common Rule. In particular, FDA has issued guidance indicating that the new basic and additional elements of informed consent under the revised Common Rule “are not inconsistent with FDA’s current policies and guidances,” thereby helping to avoid the need to develop separate informed consent forms to comply with FDA requirements and the revised Common Rule.¹³¹

Consistent with the parameters discussed above, an IRB-approved consent process for the creation of a research registry should include a description of the specific types of research to be conducted using registry data. For any future research that involves private identifiable information maintained by the registry, the IRB may determine that the original consent process (for the creation of the research registry) satisfies the applicable regulatory requirements because the prospect of future research and future research projects were adequately described. The specific details of that future research using registry data may not have been known when data were collected to create the registry, but that research may have been sufficiently anticipated and described to satisfy the regulatory requirements for informed consent. For consent to be informed as demanded by the ethical principle of respect for persons, however, any description of the nature and purposes of the research should be as specific as possible.

If a registry developer anticipates subsequent research use of identifiable private registry data, he or she should request an assessment by the IRB of the description of the research that will be used in the consent process for potential subjects at the time the data are initially collected. Nonetheless, in its review of any subsequent research, an IRB may require an additional consent process for each research subject or may grant a waiver for obtaining further consent.

With respect to HIPAA, historically, HHS rejected broadening the description of purpose in authorizations under the Privacy Rule to allow for future unspecified research.¹³² As a result, an authorization for the use or disclosure of health information to create a research registry could not also authorize the future research uses of the information if the specific details of the future studies were not known when the authorization was obtained.¹³³ However, under the modified HIPAA Privacy Rule released on January 25, 2013, HHS modified its prior interpretation and guidance that research authorizations must be research study specific.¹³⁴ While this modification does not make any changes to the authorization requirements at 45 CFR § 164.508, HHS no longer interprets the “purpose” provision for authorizations as permitting only study-specific descriptions. This change now allows future research to be authorized provided the authorization adequately describes the purposes of any future research such that it would be reasonable for the individual to expect that his or her health information could be used or disclosed for such future research.¹³⁵ Where an authorization for the use or disclosure of registry data for the future research does not exist, a healthcare provider or health insurance plan maintaining the registry may need to obtain an additional authorization for the research from individuals or seek a waiver of authorization from an IRB or privacy board. Alternatively, the use or disclosure of a limited dataset or de-identified registry data can occur, provided regulatory criteria are satisfied. Registries maintained by organizations to which the Privacy Rule does not apply (e.g., funding agencies for research that are not healthcare providers or insurance plans, professional societies, or non-healthcare components of hybrid entities such as in many universities) are not legally bound by the limited purpose of any original authorization that was obtained to permit data sources to disclose identifiable patient information to the registry. However, data sources or their business associates that are subject to the Privacy Rule are unlikely to be willing to provide patient information without a written agreement with the registry developer that includes legally enforceable protections against redisclosure of identifiable patient information. Regardless of whether such a written agreement is in place, a valid authorization must contain a warning to patients that their health information may not be protected by Privacy Rule protections once disclosed to recipient organizations.¹³⁶

3.3.4. Certificates of Confidentiality and Other Privacy Protections

Certificates of confidentiality (CoCs) granted by the NIH permanently protect identifiable, sensitive information about research subjects from legally compelled disclosure. For the purposes of CoCs, identifiable, sensitive information is broadly defined to include any information “through which an individual is identified,” or “for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, or other available data sources could be used to deduce the identity of an individual.”¹³⁷

Prior to the enactment of the 21^st Century Cures Act, the issuance of CoCs was discretionary by the NIH or other HHS agencies to which a researcher may submit a request for a CoC. With the passage of the 21^st Century Cures Act, the Secretary of HHS is required to issue a CoC to all ongoing or new research funded in whole or in part by the federal government as of December 13, 2016, that collects or uses identifiable, sensitive information.¹³⁸ For NIH-funded research, this includes any non-exempt human subjects research as defined under the Common Rule, as well as any research involving generating individual level, human genomic data from biospecimens or using such data, whether the data is recorded in a manner that enables the identification of human subjects as defined under the Common Rule.¹³⁹ That research involving non-identifiable genomic data is required to be protected by a CoC further underscores the diverse and shifting views on genomic privacy and the safeguards that are deemed necessary or appropriate for research involving genomic information. Separately, researchers may continue to seek a CoC for non-federally funded research involving the collection or use of identifiable, sensitive information, which HHS may issue in its discretion.¹⁴⁰ Registry developers and investigators should determine whether a registry or research conducted using the registry would be subject to the amended NIH CoC policy described above and thus be automatically issued a CoC.

An investigator whose research project has been granted a CoC may refuse to disclose identifying information collected for that research even though a valid subpoena demands that information for a civil, criminal, administrative, or legislative proceeding at the Federal, State, or local level. The protection provided by a CoC is intended to prevent the disclosure of personal information that could result in adverse effects on the social, economic, employment, or insurance status of a research subject.¹⁴¹ Detailed information about CoCs is available on the NIH website.¹⁴²

The grant of a CoC to a research project, however, is not intended to affect State laws requiring healthcare and other professionals to report certain conditions to State officials; for example, designated communicable diseases, neglect and abuse of children and the elderly, or threats of violent harm. If investigators are mandatory reporters under State law, in general, they continue to have a legal obligation to make these reports.¹⁴³ In addition, other limitations to the privacy protection provided by CoCs exist and may be relevant to particular research projects. Information on the NIH website describes some of these other legal limitations.¹⁴²

Registry developers should also be aware that Federal law provides specific confidentiality protections for the identifiable information of patients in drug abuse and alcoholism treatment programs that receive Federal funding.¹⁴⁴ These programs may disclose identifiable information about their patients for research activities only with the documented approval of the program director or authorization of the patient.¹⁴⁵ The basis for the director’s approval is receipt of written assurances about the qualifications of the investigator to conduct the research and the confidentiality safeguards incorporated into the research protocol, and an assurance that there will be no further disclosure of identifying information by the investigator. Moreover, an independent review of the research project should determine and verify in writing that the protocol provides adequate protection of the rights and welfare of the patients and that the benefits of the research outweigh any risks to patients.¹⁴⁵ Prior to submitting proposed consent documentation to an IRB, registry developers should consult legal counsel about the limitations of these confidentiality protections.

As a condition of approval, IRBs frequently require investigators to obtain a CoC for research involving information about substance use disorder or other illegal activities (e.g., underage purchase of tobacco products) and sexual attitudes and practices. Registry developers should consult legal counsel to determine if and how the limitations of a CoC may affect privacy protection planning for registry data. In all circumstances, the consent process should ensure that clear notice is given to research subjects about the extent of privacy protections they may expect for their health information when it is incorporated into a registry.

In the absence of a CoC, a valid subpoena or court order for registry data will usually compel disclosure of the data unless State law specifically protects the confidentiality of data. For example, Louisiana’s laws specifically protect the collection of information related to tobacco use from subpoena.¹⁴⁶ On the other hand, a subpoena or court order may supersede State law confidentiality protections. These legal instruments can be challenged in the court having jurisdiction for the underlying legal proceeding. In some circumstances, research institutions may be willing to pursue such a challenge. The remote yet definite possibility of this sort of disclosure should be clearly communicated to research subjects as a limitation on confidentiality protections, both during the consent process and in an authorization for use or disclosure of patient information.

State law may assure the confidentiality of certain quality A/I activities performed by healthcare providers as peer review activities.¹⁴⁷ When State law protects the confidentiality of peer review activities, generally, it is implementing public policy that encourages internal activities and initiatives by healthcare providers to improve healthcare services by reducing the risks of medical errors and systematic failures. Protection by peer review statutes may limit the use of data generated by quality A/I activities for any other purposes.

3.3.5. Waivers and Alterations of Authorization and Consent

Waiver or alteration of authorization and informed consent is a key potential pathway for registry developers in the creation and use of health information registries. This is particularly true where the creation of the registry is limited to the collection of data originally created for other purposes, and does not involve the collection of information, such as patient-reported outcomes, specifically for purposes of the registry. Where the needs of a registry may be satisfied through the secondary use of data, including the data of a large number of individuals, waiver of authorization and informed consent is a pathway that many registry developers may pursue.

The Privacy Rule, the Common Rule, and FDA guidance¹⁴⁸ all provide for the ability of IRBs (and, in the case of the Privacy Rule, privacy boards) to waive or alter the authorization requirement (in the case of the Privacy Rule) and informed consent requirement (in the case of the Common Rule and FDCA) for the disclosure or use of health information for research purposes, provided applicable criteria are satisfied. It is important for registry developers to keep distinct the terms “informed consent” and “authorization,” as they are not interchangeable with respect to the Privacy Rule, the Common Rule, and FDA regulations. As described above, authorization is the term used to describe individuals’ written agreement to the use or disclosure of their PHI under the Privacy Rule, while informed consent is the term used to describe research subjects’ agreement to participate in research or a clinical investigation, as required by the Common Rule and FDA regulations, respectively. There are separate and distinct requirements for obtaining and waiving or altering each of these permissions.

As technological advances enable and facilitate the collection and sharing of vast amounts of data regarding thousands or even millions of individuals, the use of waivers should be considered in view of the potential risks to the patients participating in the registry. A waiver of authorization potentially imposes the risk of a loss of confidentiality and consequent invasion of privacy. A waiver of consent potentially imposes risks of harm from the loss of self-determination, dignity, and privacy expected under the ethical principles of respect for persons and beneficence. Acknowledging these potential risks, regulatory criteria for waiver and alterations require an IRB or privacy board to determine that risks are minimal, in addition to other criteria. This determination is a necessary condition for approval of an investigator’s request for a waiver or alteration of these permissions.

The following discussion refers only to waivers; registry developers should note that privacy boards and IRBs may approve alterations to authorizations or the consent process, provided a requested alteration satisfies all of the criteria required for a waiver by the Privacy Rule, Common Rule, or FDA regulations and guidance, as applicable. While alterations are arguably more aligned with the principle of respect for persons because they entail obtaining some (albeit altered) form of authorization or informed consent from the subject, they may be less practicable where very large numbers of individuals are contemplated as participants.

The Privacy Rule permits a covered entity to obtain the approval of an IRB or privacy board for a waiver of authorization if the following criteria are met: (1) the use or disclosure involves no more than minimal risk to the privacy of individuals; (2) the research cannot practicably be conducted without the waiver; and (3) the research cannot be practicably conducted without access to, and use of, the health information. The determination of minimal risk to privacy includes several elements: an adequate plan to protect identifiers from improper use or disclosure; an adequate plan to destroy identifiers at the earliest opportunity, unless a health or research justification exists to retain them; and adequate written assurances that the health information will not be reused or disclosed to others, except as required by law, as necessary for oversight of the research, or as permitted by the Privacy Rule for other research.¹⁴⁹ The registry developer should provide detailed documentation of the IRB or privacy board’s decision to the healthcare provider or insurance plan (covered entity) that is the source of the health information for registry data. The documentation should clearly communicate that each of the criteria for a waiver required by the Privacy Rule has been satisfied.¹⁵⁰ The privacy board or IRB documentation should also provide a description of the health information it determined to be necessary to the conduct of the research and the procedure it used to approve the waiver.¹⁵¹ A healthcare provider or insurance plan might insist on legal review of this documentation before disclosing any health information.

The criteria for waiver of consent under the Common Rule are similar to those for a waiver of authorization under the Privacy Rule. Specifically, an IRB may waive the requirement to obtain informed consent under the Common Rule if the following criteria are met: (1) the research involves no more than minimal risk to subjects; (2) the research could not practicably be carried out without the requested waiver; (3) if the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format; (4) the waiver will not adversely affect the rights and welfare of the subjects; and (5) whenever appropriate, the subjects or legally authorized representatives will be provided with additional information after participation.¹⁵² The criterion for additional information can be satisfied at least in part by public disclosure of the purposes, procedures, and operations of a registry, as discussed below.

While the FDA has not always permitted IRBs to waive the informed consent requirement under FDA regulations, it has initiated notice and comment rulemaking to allow for such IRB waiver.¹⁵³ Prior to publishing its proposed rule, FDA issued guidance indicating that it does not intend to object to clinical investigations for which an IRB has waived consent pursuant to the criteria set forth in the guidance.¹⁵⁴ Specifically, the guidance states that an IRB may waive the FDA’s consent requirement if it determines that: (1) the clinical investigation involves no more than minimal risk to subjects (as defined under 21 CFR 50.3(k) or 56.102(i)); (2) the waiver will not adversely affect the rights and welfare of subjects; (3) the clinical investigation cannot practicably be carried out without a waiver; and (4) whenever appropriate, subjects will be provided with additional information after participation.¹⁵⁵ It remains to be seen whether FDA will align its waiver criteria with those under the revised Common Rule as set forth above, which added a fifth criterion requiring that the research could not practicably be carried out without the use of information in an identifiable format.

Some IRBs produce guidance about what constitutes “not practicable” justifications and the circumstances in which justifications are applicable. For population-based research projects, registry developers may also present the scientific justification of avoiding selection bias. A waiver permits the registry to include the health information of all patients who are eligible. As patient portals, email, and other electronic platforms make it easier to communicate remotely with digitally connected patients, registry developers should be mindful of whether the circumstances support a finding of “not practicable.”¹⁵⁶ Likewise, where a registry involves the collection of particularly sensitive information, or use for research that may be potentially stigmatizing, registry developers and users should consider whether the “minimal risk” criterion is satisfied.¹⁵⁷

Separately, the Common Rule and FDA regulations also permit an IRB to waive documentation of the consent process under certain circumstances. Waiver of documentation may be particularly useful where registry developers have a platform that enables electronic consent but not the ability to obtain an electronic signature that meets requirements under applicable law. For purposes of the Common Rule, one set of conditions for approval of this limited waiver requires that the only record linking an individual subject to the research is the consent document, and that the principal risk to subjects is the potential harm from a breach of confidentiality. Each subject individually determines whether his or her consent should be documented.¹⁵⁸ Alternatively, as permitted under the Common Rule and FDA regulations, an IRB can waive documentation of consent if the research involves no more than minimal risk of harm to subjects and entails no procedures for which written consent is normally obtained outside of a research context.¹⁵⁹ For any of these circumstances, the IRB may require the investigator to provide subjects with written information about the research activities in which they participate.¹⁶⁰ The written information may be as simple as a statement of research purposes and activities, or it may be more elaborate, such as a website for regularly updated information describing the progress of the research project.

3.3.6. Patient Safety Organizations

This section provides basic information about the Patient Safety and Quality Improvement Act of 2005 (PSQIA) and an overview of some considerations for registries that are considering becoming or working with a Federally-listed Patient Safety Organization (PSO). The PSQIA was enacted in response to a 1999 report by the Institute of Medicine (now the National Academy of Medicine) that identified medical errors as a leading cause of hospital deaths in the United States, with many such errors being preventable.¹⁶¹ It creates Federal confidentiality and privilege protections for certain information that meets the criteria in the statute to qualify as patient safety work product (PSWP). The Patient Safety Rule at 42 CFR Part 3, the implementing regulation for the PSQIA, became effective on January 19, 2009.

The PSQIA authorized the U.S. Department of Health and Human Services (HHS) to list PSOs, entities with patient safety expertise, to which providers can voluntarily report patient safety events with the aim of improving patient safety and the quality of care. PSOs provide feedback to providers to assist them with improving patient safety, encouraging a culture of safety and minimizing patient risks. The HHS Agency for Healthcare Research and Quality (AHRQ) is responsible for listing PSOs.

Generally, PSWP is any data, reports, records, memoranda, analyses, or written or oral statements which: (1) could improve patient safety, healthcare quality, or healthcare outcomes and are assembled or developed by a provider to be reported to, and are reported to a PSO, or are developed by a PSO to conduct patient safety activities; or (2) identify or constitute the deliberations or analysis of, or fact of reporting to, a patient safety evaluation system. Information collected, maintained, or developed separately from, or existing separately from, a patient safety evaluation system as defined in the statute is excluded from the definition of PSWP. Thus, individual patient medical records, billing and discharge information, and any other original patient or provider records are not confidential and privileged under the PSQIA.

With specified exceptions, PSWP is privileged and confidential and is not subject to subpoena, order or discovery in connection with a Federal, State, or local civil, criminal, or administrative proceeding, including a Federal, State, or local civil or administrative disciplinary proceeding; may not be admitted as evidence in any Federal, State, or local governmental civil, criminal or administrative rulemaking proceeding, or administrative adjudicatory proceeding; is not subject to disclosure under the Federal Freedom of Information Act or any other similar Federal, State, or local law; and may not be admitted in a professional disciplinary proceeding of a professional disciplinary body established or specifically authorized under State law.

Once PSWP is received by a PSO, it may be aggregated and analyzed by the PSO to assist a provider in determining and addressing underlying factors that contribute to patient safety risks. Under the PSQIA, PSWP may not be disclosed unless specified requirements in the Patient Safety Rule are met. Civil money penalties may be imposed for confidentiality violations.¹⁶² In addition, the HIPAA Privacy Rule’s limitations on uses and disclosures may apply where PSWP includes protected health information (PHI).

Information collected by a provider to comply with external reporting requirements (for example, State incident reporting requirements) is not PSWP, and PSWP generally may not be used to comply with such obligations. Thus, a significant amount of data in its original form remains outside the PSWP definition. This includes registry data that is not developed by a provider or an AHRQ-listed PSO in a manner that meets the definition of PSWP. The statute and regulation provide no protection for information in registries acting outside the protected scope of the PSO arena. For example, if a PSO also operates a registry that submits data to the Centers for Medicare and Medicaid Services (CMS) on behalf of individual clinicians or groups to meet the requirements for their participation in a quality payment incentive program, neither the data submitted by the provider to the registry for this purpose nor the data submitted by the registry to CMS is PSWP. A provider may submit a copy of these registry data to the PSO, and the copy may be protected as PSWP, as long as the original exists outside of the patient safety evaluation system.

A registry may choose to seek listing by AHRQ as a PSO so long as it meets the requirements to become listed as a PSO. However, the registry should carefully assess whether it would be able to conduct all of its intended operations as a PSO. The disclosure of PSWP is limited to specific permissible disclosures enumerated in 42 CFR § 3.206(b) (and is also subject to the HIPAA Privacy Rule and other requirements, if applicable). The limitations on disclosure in the Patient Safety Rule might not allow a registry to conduct research, publish or disseminate PSWP to the same extent or in the same way it would do so with registry information that is not PSWP.

There are some additional points an entity operating a registry may want to consider before seeking listing as a PSO:

• Information received by a registry from providers prior to the registry becoming an AHRQ-listed PSO would not be PSWP unless the information was PSWP prior to being provided to the registry. However, a provider could submit or authorize the submission of a copy of non-PSWP it previously reported to the registry to the PSO, as long the original is maintained separately. The copy could become PSWP, provided the copy satisfies all other requirements of the definition of PSWP. Before preparing copies for reporting to the PSO of information originally developed for a registry, the provider will want to ensure that making such copies is permissible; that disclosing the information to a PSO does not affect other confidentiality or privilege protections, such as those under State law; and that the disclosure is not prohibited by other laws, regulations or contractual obligations.
• When PHI is contained in PSWP, both the Patient Safety Rule and HIPAA Privacy and Security Rules must be taken into account. The Patient Safety Rule permits PSWP containing PHI to be disclosed to a PSO for the conduct of patient safety activities, which are considered healthcare operations under the HIPAA Privacy Rule.
• The Patient Safety Rule definition of provider primarily relates to individuals or entities licensed or otherwise authorized under U.S. State law to provide healthcare services and individuals or entities that deliver healthcare as part of U.S. Federal, State, local, or tribal governments. Data reported to a PSO from healthcare providers who do not satisfy this definition is not confidential or privileged PSWP. Additionally, the PSQIA privilege protections only apply in U.S. tribunals.
• A registry should also consider the long-term implications for any data that are PSWP if its PSO is subsequently delisted. The regulations do not permit a former PSO to retain any of the PSWP it collected during its period of listing, even if the PSO delists voluntarily. All PSOs must meet the PSWP disposition requirements set forth at 42 CFR § 3.108(b)(3) at the time of delisting.

Finally, it is important for registry developers to know that, instead of becoming a PSO itself, a registry may elect to form a separate unit or division of a legal entity, or a separate legal entity that can become listed as a PSO. The Patient Safety Rule defines this type of PSO as a “component PSO.” The Patient Safety Rule prohibits health insurance issuers from becoming listed as or forming a PSO. However, the other excluded entities may create or designate a component organization to seek listing as a PSO. (see 42 CFR § 3.102(a)(2)) Whether the component PSO is part of an excluded entity or not, the Patient Safety Rule’s additional requirements regarding component PSOs must be satisfied. A component PSO must maintain PSWP separately from non-PSWP and from the rest of the parent organization.

3.4.1. The Institute of Medicine Report

On February 4, 2009, the Institute of Medicine (IOM) published a report that examined how research was being conducted within the framework of the Privacy Rule. The IOM Report presented findings and recommendations of an IOM Committee tasked with assessing the impact of the HIPAA Privacy Rule on health research. This group had proposed recommendations to ensure that important health research might be conducted while maintaining or strengthening privacy protections for research subjects’ health information.¹⁶³ The IOM Report stated that certain Privacy Rule requirements were difficult to reconcile with other regulations governing the conduct of research, including the Common Rule and the FDA regulations, and it noted a number of inconsistencies among applicable regulations related to the de-identification of data and the ability to obtain informed consent for future research studies, among other differences.

Citing more uniform regulations in other countries, the IOM Report affirmed that “a new direction is needed, with a more uniform approach to patient protections, including privacy, in health research.”¹⁶⁴ As its primary recommendation, the IOM Committee held that Congress should authorize HHS and other Federal agencies to develop a new approach to protecting privacy that would apply uniformly to all health research and to exempt health research from the Privacy Rule when this new approach was implemented. Until such an overhaul could be accomplished, the IOM Committee called upon HHS to revise the Privacy Rule and associated guidance to address certain issues. HHS addressed some of these issues in the January 25, 2013, modifications to the Privacy Rule, such as by allowing HIPAA authorizations to encompass future research and removing prohibitions on combining certain HIPAA authorizations for multiple research studies, thereby harmonizing these HIPAA Privacy Rule requirements with the Common Rule. Nevertheless, registry operators should be aware that additional clarifications or modifications to the Privacy Rule as it relates to research activities may continue to be made in the future.

3.4.2. The Genetic Information Nondiscrimination Act of 2008

The Genetic Information Nondiscrimination Act of 2008 (GINA) was signed into law on May 21, 2008. In general, GINA prohibits discrimination in health insurance coverage (Title I) and employment (Title II) based on genetic information. GINA defines genetic information as, with respect to any individual, information about the individual’s genetic tests, the genetic tests of the individual’s family members, and the manifestation of a disease or disorder in the individual’s family members (e.g., family health history). Title I of GINA took effect for most health insurance plans on May 22, 2009, and Title II became effective for employers on November 21, 2009. GINA also specifies that the definition of genetic information includes the genetic information of a fetus carried by a pregnant woman and an embryo legally held by an individual or family member utilizing an assisted reproductive technology. Pursuant to GINA, health insurers are prohibited from using the genetic information of individuals for underwriting purposes (e.g., determining health insurance eligibility and coverage, or premium setting), and employers are prohibited from using genetic information in making employment-related decisions.

In addition to its nondiscrimination requirements, GINA also required related amendments to the Privacy Rule to clarify that genetic information is PHI for purposes of the Privacy Rule, and to prohibit certain health plans from using or disclosing genetic information for underwriting purposes.¹⁶⁵

3.4.3. The HITECH Act

The American Recovery and Reinvestment Act of 2009 (ARRA) was signed into law on February 17, 2009. Funds appropriated as a result of passage of ARRA are supporting new registries developed to study comparative effectiveness of treatments and protocols. It should be noted that there are no specific exceptions to regulatory or ethical requirements for such comparative effectiveness registries. Title XIII of division A and Title IV of division B of ARRA, the Health Information Technology for Economic and Clinical Health Act (HITECH Act) significantly modified the obligations of HIPAA covered entities and their business associates.

Perhaps most significantly, the HITECH Act extends to business associates direct liability for compliance with many of the key privacy and security obligations contained in the HIPAA Rules, whereas business associates were previously only contractually liable for failing to protect PHI in accordance with the terms of their business associate agreement with covered entities. Specifically, the HITECH Act imposed direct liability on business associates for compliance with the HIPAA Security Rule’s requirements for implementing administrative, physical, and technical safeguards to protect electronic PHI, as well as for compliance with the use and disclosure provisions of the Privacy Rule and the terms of business associate agreement into which they enter. While many business associate agreements previously contained general safeguarding requirements (e.g., requiring the business associate to maintain appropriate technical safeguards), these agreements often had not imposed specific security requirements (e.g., a requirement that the business associate establish a security management process, which includes conducting security risk assessments and developing risk management plans). The HITECH provisions now subject business associates to civil and criminal penalties once reserved only for covered entities under the HIPAA Rules. The HITECH Act obligations imposed on business associates were finalized through HHS rulemaking on January 25, 2013, with compliance required by September 23, 2013.

The HITECH Act also created new breach notification requirements for covered entities and business associates. The Breach Notification Rule requires covered entities to notify the affected individuals, HHS, and in some cases, the media, of a breach of unsecured PHI. Notification must be provided without unreasonable delay but in no case later than 60 calendar days after the breach is discovered (except in cases of reports to HHS of breaches affecting less than 500 individuals, in which case, notification to HHS is required within 60 days after the end of the calendar year in which the breach was discovered). Depending on the circumstances, individual notification may include both direct, written notification to affected individuals via first-class mail or email, as well as substitute notice via conspicuous posting on the entity’s website or in major print or broadcast media.

If a business associate experiences a breach of any unsecured PHI it maintains, the business associate must provide notification to the applicable covered entity without unreasonable delay, and in no case later than 60 calendar days after the breach is discovered, so that the covered entity can provide the notifications described above with respect to the breach or delegate that responsibility to the business associate. Any notification by a business associate must include the identification of any individual(s) whose information was accessed, acquired, or disclosed during the breach. The Department issued an interim final rule to implement the breach notification requirements on August 24, 2009, which became effective on September 23, 2009. On January 25, 2013, the Department published modifications to and made permanent these breach notification requirements.¹⁶⁶

3.4.4. Summary of Regulatory Requirements

The use and disclosure of health information by healthcare providers and insurance plans for research purposes, including for registries, are assumed by the authors of this chapter to be subject to regulation under the HIPAA Rules and may be subject to the Common Rule and/or FDA regulations.

In general, the Privacy Rule permits a covered entity (or business associate on its behalf) to use or disclose patient information for registry purposes, subject to specific conditions, where the use or disclosure is: (1) for a registry supporting certain public health activities, including registries developed in connection with FDA-regulated products; (2) for a registry supporting the healthcare operations of a healthcare provider or insurance plan (covered entities), such as for quality A/I; (3) for a registry created by health oversight authorities for health system oversight activities authorized by law; (4) limited to de-identified health information; (5) limited to a “limited dataset” of patient information that lacks specified direct identifiers, and a data use agreement is in place with the recipient; (6) pursuant to patient authorizations; or (7) consistent with a waiver or alteration of authorization by an IRB or privacy board.

The Common Rule will apply to the creation and use of registry data if (1) the registry is funded by a Common Rule Agency or the organization responsible for the registry has an FWA that encompasses the registry project, regardless of funding,¹⁶⁷ and (2) the creation of the registry and subsequent research use of the registry data constitute nonexempt human subjects research as defined by the Common Rule. As interpreted by OHRP, human subjects research includes the creation or use of a registry that has any research purpose, even if the main purpose of the registry or use of the registry is not research. Registry developers are strongly encouraged to consult the IRB, not only about the applicability of the Common Rule, but also about the selection of data elements, the content of the consent process or the regulatory criteria for waiver, and any anticipated future research involving identifiable registry data.

FDA GCP requirements may apply to the creation and/or use of a registry if the registry involves the collection of data specifically for purposes of gathering information regarding the safety or effectiveness of a product in a manner that influences treatment decisions, or if the registry data relates to the use of an FDA-regulated product and the data or analyses thereof are intended to be submitted to or held for inspection by the FDA. The scope and requirements of FDA regulations with respect to the use of real world data continue to evolve, and registry developers should be mindful of the purposes for which the registry is developed and/or used to assess the potential applicability of FDA requirements for the protection of human subjects (even if the registry or downstream use of the registry is limited to de-identified data). With the FDA’s harmonization of its consent waiver and alteration requirements with those under the Common Rule and HIPAA, it is possible that more registries will be used to support FDA-regulated research.

State laws regulate public health activities and may also apply in various ways to the research use of health information. NIH may issue – either as a matter of course or upon request, depending on the funding source of the study – CoCs to particular research projects for the protection of identifiable, sensitive information from most legally compelled disclosures. Federal law provides specific privacy protections to the health information of patients in substance use disorder programs that receive Federal funding (42 CFR Part 2). Under recent revisions to 42 CFR Part 2 that became effective in 2017, HIPAA covered entities and business associates may conduct research on information from a federally supported substance use disorder program if the HIPAA covered entity or business associate has obtained and documented authorization from the patient, or a waiver of authorization consistent with the Privacy Rule and complied with the Common Rule in obtaining informed consent (if applicable to it). Researchers subject to the Common Rule and not HIPAA may also conduct research substance use disorder information covered by 42 CFR Part 2 if they conduct the research in compliance with the Common Rule. Note, the Coronavirus Aid, Relief and Economic Security Act (CARES Act), which was signed into law on March 27, 2020, amended certain confidentiality protections and requirements for substance-use disorder records under 42 CFR Part 2. HHS is expected to issue the regulations amending 42 CFR Part 2 later in 2020 or early 2021. Although there will remain some discrepancies, the new regulations are expected to more closely align 42 CFR Part 2 and the HIPAA Privacy Rule.

The institutional policies of healthcare providers and insurance plans may also affect the use and disclosure of the health information of their patient or insured populations. Legal requirements applying to use or disclosure of health information for research are evolving and can significantly influence the planning decisions of registry developers and investigators. It is prudent to obtain early and frequent consultation, as necessary, with institutional privacy officers, privacy board or IRB staff and members, information system representatives of healthcare providers and insurance plans, funding agencies and the FDA (as applicable), the developers of any device or application from which the registry will directly collect data, and technology transfer representatives and legal counsel.

4.3.1. Health Information Ownership and Value Proposition

There is no general consensus with respect to the ownership of health information, and multiple stakeholders assert ownership claims to health information in various forms. Certain States have enacted laws that seek to clarify ownership of health records, aiming to strike the balance between healthcare provider’s rights to these records and patients’ rights to maintain confidentiality of, and have access to, the information in their records. However, there is much inconsistency among these laws,¹⁷¹ and, accordingly, these laws are helpful to outline providers’ and patients’ rights, but do not definitely answer the ownership question. In addition to healthcare providers and individuals, any number of stakeholders could claim ownership of health-related information, including insurance plans, funding agencies for registry projects, research institutions, government agencies, registry developers, and investigators. The basis for these claims is typically possession or control of the tangible expression of the health information or an interest in controlling its use.

While many entities claim ownership of healthcare data, the central question should be who has the possession of the data and the right to control its use. As a general matter, there is no legal basis for assertions of ownership of facts or raw data elements. In fact, long-established public policy supports the free exchange of ideas and wide dissemination of facts as fundamental to innovation and social progress.¹⁷² However, an entity in possession or control of health information in the form of raw data elements has the ability to control it by maintaining it as confidential, thereby acting as if it is the owner of the information because it can control how such information is shared and used. For example, an entity in possession or control of health information may transfer it to another party under contractual conditions that restrict the recipient’s use and disclosure. In addition, entities that are in possession or control may allocate “ownership” of health information by contract as between them – without reference to the true owner. This may permit, for example, the funding agency for a registry to assert claims to ownership as a matter of contract law in their sponsorship agreements with research organizations.

U.S. copyright law allows an individual or entity to claim ownership of compilations of facts if the facts are selected, coordinated or arranged in a manner that meets a degree of originality.¹⁷³ Electronic health records systems and data warehouses contain vast amounts of heath information that can be aggregated or complied in unique way, leading to datasets that may be protected under U.S. copyright law. Accordingly, it is possible to create a registry that is selected, coordinated or arranged in such a way to be protect the registry under U.S. copyright law; however, stakeholders developing registries should be aware that protection of registries as a compilation under U.S. copyright law will be thin, and will not protect the underlying data. Therefore, it is advisable to develop a protection strategy for registries that includes a combination of confidentiality requirements and copyright protection.

Notwithstanding any copyright protection that may be available, stakeholders need to bear in mind that registry data constitutes legally protected, confidential information about individual patients to which independent and varied legal protections apply. Copyright protections may marginally enhance, but do not diminish, other legal restrictions on access to and use of health information and registry data.

For more information on copyright law, see Appendix B.

4.3.2. Publications

For academic institutions, publication rights are an important component of the value proposition of healthcare data, and any publication itself (but not the data therein) constitutes a literary work under U.S. copyright law. Formal institutional policies may address publication rights resulting from faculty educational and research activities. Moreover, the social utility and benefit of any registry is evaluated on the basis of its publicly known findings and any conclusions based on them. The authors strongly encourage registry developers to maximize public communication of registry findings through the customary channels of scientific conferences and peer-reviewed journals. The goal of public communication for scientific findings and conclusions applies equally to registries operated outside of academic institutions (i.e., directly by industry or professional societies). For further discussion of developing data access and publication policies for registries, see Chapters 2 and 8.

4.3.3. Intersection of Ownership Rights With Other Considerations

The concept of ownership does not fit comfortably in the context of health information, because it largely fails to acknowledge individual patient privacy interests in health information. An inescapable personal nexus exists between individuals and information about their health. Considerations for rights with respect to health information may derive from applicable Federal or State law. The Privacy Rule, for example, provides individuals with the right to access, amend, and obtain an accounting of disclosures of their PHI contained in a designated record set, although it does not directly affect existing laws, if any, regarding property rights in health information.¹⁷⁴ A designated record set means a group of records maintained by or for a covered entity that is: (i) the medical records and billing records maintained by or for a covered entity healthcare provider; (ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan, or (iii) used by or for the covered entity to make decisions about individuals.¹⁷⁵ The assessment of whether a registry would contain data that constitutes a designated record set is a fact-specific one. Where applicable, such individual rights with respect to health information in a registry may inform the extent to which an individual has ownership rights in the information.

At the time of this writing, health information sources and other users privately reach agreement to manage access and control. The question of the extent to which individuals have rights in their own health information will likely become more pronounced insofar as registries seek to expand the collection of patient-reported outcomes. Likewise, as more health information becomes generated through connected devices, mobile applications, and other digital platforms that are deployed in a consumer context, it will be important for registry developers and the entities that collect and make available to the registry such data to consider the terms and conditions and privacy policies that apply to the platforms, and the attendant implications for the ability of individuals to access or otherwise assert rights with respect to such data. These contractual terms, the legal and regulatory requirements described above, as well as claims of property rights and concerns about legal liability, will inform the formal written agreements for the establishment and use of registries. Registry developers should also consider what, if any, rights they are willing to or should provide to the individuals whose data is being used, such as by giving individuals the ability to access or request the sharing of their own data, receive reports or updates regarding the use of their data, or other means of engagement that may enhance transparency or buy-in from the individuals with respect to the registry’s mission or activities.