Doctors can get a privacy exemption for data used for research purposes

There are exceptions to the rules barring sharing of patient information.

By Joel B. Finkelstein, AMNews staff. March 24/31, 2003.

HIPAA Minute
A series of brief explanations to help physicians prepare for the medical privacy rule, effective April 14, 2003.

There is more than one way to skin the proverbial cat when sharing protected health information with researchers.

There are two ways, to be exact: A waiver from an oversight board or permission from individual patients. Information-sharing on a more limited basis is permitted without meeting either condition.

Under the Health Insurance Portability and Accountability Act's privacy rule, an institutional review board or, where none is available, a privacy board as defined by the rule, can approve a waiver based on set assurances that there is minimal risk to individuals' privacy.

This rule applies to all medical research and was written to avoid conflict with the existing Common Rule, which requires patients' informed consent when recruiting for federally funded research.

Unlike the privacy rule, the Common Rule requires both patient consent and IRB approval, when applicable. But because the privacy rule has been structured to closely follow the requirements of the Common Rule for IRB approval, satisfying one usually satisfies both.

The privacy rule's requirements for patient authorization can be bundled in with a consent form that fulfills Common Rule criteria.

The new rule's authorization requirements for research purposes are similar to authorization for other uses of patient information, except that no expiration date is needed.