Hi Pamela,
Good question, but I think your issue is more basic than the OHCA.
'Healthcare operations' as defined in Part 164 is intended for quality
control, improving the delivery of health care, reducing costs and other
internal evaluations of the Covered Entity (CE). Research with the
intent to develop generalizable knowledge is specifically excluded
(164.501 Health Care Operations)
"Health care operations means any of the following activities of the
covered entity to the extent that the activities are related to covered
functions:
(1) Conducting quality assessment and improvement activities, including
outcomes evaluation and development of clinical guidelines, provided
that the obtaining of generalizable knowledge is not the primary purpose
of any studies resulting from such activities; ..."
Any use or disclosure of PHI for research purposes (except those allowed
as 'preparatory to research') MUST be done with a waiver, alteration of
authorization, or signed authorization in place. The OHCA may have the
appropriate agreements in place to function as a unified CE, but that
does not eliminate the role of a Privacy Board, IRB, or the subject in
the research process. The OHCA can't do anything that the individual CEs
would be allowed to do.
On a related topic, since research is not a TPO function (Treatment,
Payment, or Health Care Operations), the consulting statistician(s)
cannot be a Business Associate of the OHCA for the data analysis and
would need to execute a Data Use Agreement [Part 164.514(e)] for each
study involved.
Bruce Steinert, PhD, CCRA
Director, Clinical Trials Administration
The Children's Mercy Hospital
Kansas City, MO
-----Original Message-----
From: Pamela Coburn-Litvak [mailto:xxxxxx@UNIV.LLU.EDU]
Sent: Friday, February 25, 2005 3:11 PM
To: xxxxxx@HRINET.ORG
Subject: [RESADM-L] HIPAA question
Greetings all --
I have a HIPAA Privacy Rule question. For HIPAA purposes, my
institution
has designated itself as an organized health care arrangement (OHCA),
including a hospital, university, and assorted clinics. It's our
understanding that the Privacy Rule does not restrict the free flow of
protected health information between these entities for joint health
care
purposes (45 CFR 164.506(c)(5) states: "A covered entity that
participates
in an organized health care arrangement may disclose protected health
information about an individual to another covered entity that
participates
in the organized health care arrangement for any health care operations
activities of the organized health care arrangement"). However, the
Privacy Rule is unclear whether "free" data sharing is allowed between
entities of an OHCA for research purposes.
The specific example in mind are physicians in the hospital wanting to
send
research data to a statistical consulting service in the university. I
would love to know how other institutions handle this. For example, do
you
allow this sort of data sharing within the OHCA without patient
authorization or waiver of authorization? Or (what seems to be the
easiest
solution) do you ask the PI to list the consulting group on the
authorization?
Scouring the OCR and HHS websites have not yet uncovered a direct answer
to
this question, but practical suggestions from other institutions would
be
invaluable. Thanks in advance.
Pamela S. Coburn-Litvak
Office of Research Affairs
Loma Linda University
Loma Linda, CA 92354
======================================================================
Instructions on how to use the RESADM-L Mailing List, including
subscription information and a web-searchable archive, are available
via our web site at http://www.hrinet.org (click on "Listserv Lists")
======================================================================
======================================================================
Instructions on how to use the RESADM-L Mailing List, including
subscription information and a web-searchable archive, are available
via our web site at http://www.hrinet.org (click on "Listserv Lists")
======================================================================
