Greetings all --

I have a HIPAA Privacy Rule question.  For HIPAA purposes, my institution
has designated itself as an organized health care arrangement (OHCA),
including a hospital, university, and assorted clinics.  It's our
understanding that the Privacy Rule does not restrict the free flow of
protected health information between these entities for joint health care
purposes (45 CFR 164.506(c)(5) states:	"A covered entity that participates
in an organized health care arrangement may disclose protected health
information about an individual to another covered entity that participates
in the organized health care arrangement for any health care operations
activities of the organized health care arrangement").	However, the
Privacy Rule is unclear whether "free" data sharing is allowed between
entities of an OHCA for research purposes.

The specific example in mind are physicians in the hospital wanting to send
research data to a statistical consulting service in the university.  I
would love to know how other institutions handle this.	For example, do you
allow this sort of data sharing within the OHCA without patient
authorization or waiver of authorization?  Or (what seems to be the easiest
solution) do you ask the PI to list the consulting group on the
authorization?

Scouring the OCR and HHS websites have not yet uncovered a direct answer to
this question, but practical suggestions from other institutions would be
invaluable.  Thanks in advance.

Pamela S. Coburn-Litvak
Office of Research Affairs
Loma Linda University
Loma Linda, CA 92354

======================================================================
 Instructions on how to use the RESADM-L Mailing List, including
 subscription information and a web-searchable archive, are available
 via our web site at http://www.hrinet.org (click on "Listserv Lists")
======================================================================