Spotlight on Compliance
Is data collection research? It depends
OHRP clarifies use of data in research
By J. Mark Waxman,
JD
General Counsel
CareGroup Healthcare System
Boston
One of the challenges faced by clinicians and investigations in accumulating data that might be used for research, is to determine the rules that apply to ensure its availability if and when the research moves forward. The challenge that arises stems from the need to protect patients’ privacy, as well as meeting other requirements of HIPAA and the IRB process. Meeting this challenge requires an understanding of a series of issues:
- What is research?
- What is human subjects research?
- Under what circumstances can the accumulation of data be considered the creation of a data repository?
- What rules apply to research involving coded private information?
OHRP has addressed these issues on several occasions in the past, most notably though its guidelines published in November 1997, and the HHS guidance on research repository databases published in January 2004. Notwithstanding these publications, many questions remained. The publication in August of its Guidance on Research Involving Coded Private Information or Biological Specimens helps to clarify OHRP’s views on a number of the key issues.
The definitions
What Is Human Subjects Research? Research is defined by regulation [45 CFR § 46.102(d)] to be "a systematic investigation, including research development, testing, and evaluation designed to develop or contribute to generalizable knowledge." The definition is flexible and, at the same time, leaves a number of open questions. For example:
- Are all quality reviews designed to develop best practices research?
- If risk management activities are reported to carriers, are they research?
- Is simply collecting data in the hopes that it could be used at some point in the future for an as yet undefined research activity, classified as research?
The regulations also defines "human subject" [45 CFR § 46.102(f)] and delineates parameters of human subjects research which would be subject to IRB oversight:
Human subject means a living individual about whom an investigator (whether professional or student) conducting research obtains:
1. data through intervention or interaction with the individual;
2. identifiable private information.
Intervention would include direct physical activity — gathering blood — or environmental changes for research purposes. Interactions would expand the reach to the communication process, such as when an investigator takes a history.
Information, which for these purposes, is private, is the product of the reasonable expectations of the subject. If information is gathered in a setting or from a record in which the subject would not expect an observation to occur or to be made public (e.g., the patient’s chart), then, under the regulations, it is private. The definition is designed to be flexible and protect the privacy expectations of the patient/subject. It is not, however, a black-and-white test. (Are photographs of people sunbathing in a private club private information? At the beach?)
To actually constitute human subjects research, the private information must be individually identifiable. This means that the subject’s identity is or can be readily ascertained by the investigator or associated with the information.
For purposes of this guidance, coded also is defined as: identifying information (such as name or Social Security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.
Finally, the scope of coverage of the guidance, and, in turn, the rules, is important. Those covered by the applicable research structures would include not just the principal investigator or those investigators specifically responsible for the conduct of the study, but anyone actually involved in conducting the research. Hence, those who study, interpret, or analyze data; author research reports; or participate in presentations related to the research would also be bound to adhere to the rules governing human subjects research.
OHRP notes, however, that the conduct of research does not occur solely by providing coded private information or specimens. This may mean that simply gathering data for some unspecified future use is neither research nor is the individual performing such a function engaging in research. On the other hand, if the same person who provided coded information collaborates on other activities, they would, of course, be a part of the research team.
OHRP’s guidance presents a concerted effort to let the research community know where the boundaries will be. From OHRP’s perspective, in interpreting the regulatory requirements [45 CFR § 46.102(f)], the key is to understand what it means to "obtain" the information or specimens in question. For OHRP, obtaining means:
- receiving or assessing them for research purposes;
- an investigator’s use, study, or analysis for research purposes.
Private for these purposes means that the information or specimens can be linked to specific individuals — directly or indirectly (such as through coding system). Where that linkage does not exist, or cannot be made, human subjects research subject to the applicable rules is not occurring.
Importantly, this means that if the information (or specimens) is not collected specifically for a currently proposed research project through an interaction with living individuals, and the identities of those providing the information or specimens is not readily ascertained by the research team, human research is not involved. This formulation is at the core of any analysis.
OHRP points out, it means that human subjects research is not occurring if:
- the ability to decipher the code is destroyed before the initiation of research;
- the investigators and those creating or holding the keys to deciphering the code enter into an agreement prohibiting their release under any circumstances, provided any of the individuals involved remain alive (an agreement that OHRP says need not receive IRB approval);
- the IRB itself adopts formal policies and procedures for a repository or data management that prevent release of the code key while patients remain alive;
- there are some other legal requirements which accomplish the same goals.
Applying these parameters to daily experiences mean that, at least, routine hospital or physician information or specimen gathering, observations and analysis would not be human subjects research — absent a specific gathering of such for currently proposed research. In this group of activities, there would be ordinary creation and maintenance of medical records or the ongoing collection of a tissue repository.
To implement the guidance requires education of those who will be affected. The approval that may be useful is through a Q&A type of communication to the academic and research community within the institution. That communication could also provide examples of the application of the underlying principles. For example: What happens if an appropriate agreement exists not to release or share the material necessary to decipher coded information, but the identity of one of the individuals is unexpectedly or accidentally disclosed?
In other words, the investigator now knows, or could readily discern, the identity of a participating patient, and the information related to that subject no longer meets the definition of private. The guidance tells us that human subjects research now is being conducted, and absent the application of some exemption [see 42 CFR § 101(b)], the IRB processes must be involved including, where appropriate, informal consent.
Or what happens if information unexpectedly comes to light where it is necessary to identify one of the participants, and it is possible to do so? Again, to proceed, the information would no longer be private, and human subjects research processes would be required.
To address the myriad situations that may arise, the OHRP also recommends that there be an individual nested with decision-making authority. That individual should be someone other than an investigator to ensure an independent determination.
To assist the decision-making process itself, the OHRP Guidance provides a helpful sequential assessment process. (See chart.)
To apply the outlined process, the focus must be on what actually is being obtained by the investigators. If it is limited to information or specimens where the investigator — as opposed to the patient’s own physician — is not able to readily ascertain the patient’s identity, then the investigation is not engaged in human subjects research. Neither, of course, is the physician.
Where the patient’s physician also is the investigator, the opposite conclusion is the case.
A closer question exists when, for example, a physician begins collecting data without a current research project in mind. Later, the physician decides that the data bear investigation for research purposes and asks a third party to mask the data to prevent identity discovery. To be safe, this should be considered human subjects research, even though technically arrangements could be made to ensure privacy requirements were met.
If the information was coded from the inception, however, although human subjects research was being conducted, the research study could potentially still qualify for an exemption under 45 CFR 46.101(b)(4) as that data could be adequately masked.
Finally, OHRP cautions that the Privacy Rule, which is the product of HIPAA legislation, has its own rules and requirements. Thus, in contrast to the HIPAA privacy requirements, information that is linked with a code derived from identifying information is not considered to be individually identifiable under the research rules [45 CFR § 46.102(f)] provided the investigations cannot readily ascertain subject identities.
The guidance can be accessed at www.hhs.gov/ohrp/humansubjects/guidance/cdebiol.pdf.
One of the challenges faced by clinicians and investigations in accumulating data that might be used for research, is to determine the rules that apply to ensure its availability if and when the research moves forward.Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.