Re: HIPAA question Steinert, Bruce, W 25 Feb 2005 16:24 EST
Hi Pamela, Good question, but I think your issue is more basic than the OHCA. 'Healthcare operations' as defined in Part 164 is intended for quality control, improving the delivery of health care, reducing costs and other internal evaluations of the Covered Entity (CE). Research with the intent to develop generalizable knowledge is specifically excluded (164.501 Health Care Operations) "Health care operations means any of the following activities of the covered entity to the extent that the activities are related to covered functions: (1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; ..." Any use or disclosure of PHI for research purposes (except those allowed as 'preparatory to research') MUST be done with a waiver, alteration of authorization, or signed authorization in place. The OHCA may have the appropriate agreements in place to function as a unified CE, but that does not eliminate the role of a Privacy Board, IRB, or the subject in the research process. The OHCA can't do anything that the individual CEs would be allowed to do. On a related topic, since research is not a TPO function (Treatment, Payment, or Health Care Operations), the consulting statistician(s) cannot be a Business Associate of the OHCA for the data analysis and would need to execute a Data Use Agreement [Part 164.514(e)] for each study involved. Bruce Steinert, PhD, CCRA Director, Clinical Trials Administration The Children's Mercy Hospital Kansas City, MO -----Original Message----- From: Pamela Coburn-Litvak [mailto:xxxxxx@UNIV.LLU.EDU] Sent: Friday, February 25, 2005 3:11 PM To: xxxxxx@HRINET.ORG Subject: [RESADM-L] HIPAA question Greetings all -- I have a HIPAA Privacy Rule question. For HIPAA purposes, my institution has designated itself as an organized health care arrangement (OHCA), including a hospital, university, and assorted clinics. It's our understanding that the Privacy Rule does not restrict the free flow of protected health information between these entities for joint health care purposes (45 CFR 164.506(c)(5) states: "A covered entity that participates in an organized health care arrangement may disclose protected health information about an individual to another covered entity that participates in the organized health care arrangement for any health care operations activities of the organized health care arrangement"). However, the Privacy Rule is unclear whether "free" data sharing is allowed between entities of an OHCA for research purposes. The specific example in mind are physicians in the hospital wanting to send research data to a statistical consulting service in the university. I would love to know how other institutions handle this. For example, do you allow this sort of data sharing within the OHCA without patient authorization or waiver of authorization? Or (what seems to be the easiest solution) do you ask the PI to list the consulting group on the authorization? Scouring the OCR and HHS websites have not yet uncovered a direct answer to this question, but practical suggestions from other institutions would be invaluable. Thanks in advance. Pamela S. Coburn-Litvak Office of Research Affairs Loma Linda University Loma Linda, CA 92354 ====================================================================== Instructions on how to use the RESADM-L Mailing List, including subscription information and a web-searchable archive, are available via our web site at http://www.hrinet.org (click on "Listserv Lists") ====================================================================== ====================================================================== Instructions on how to use the RESADM-L Mailing List, including subscription information and a web-searchable archive, are available via our web site at http://www.hrinet.org (click on "Listserv Lists") ======================================================================