The ability of researchers to use and disclose PHI to recruit potential research subjects continues to be an issue of concern for researchers, research institutions and commercial sponsors of research, all of whom depend on sufficient enrollment for the reliability of the research they conduct, oversee and fund. This is of particular concern to researchers focusing on rare conditions and diseases, which face inherent enrollment obstacles due to limited eligible patient populations and which rely on large scale medical chart reviews and searches in existing patient databases to identify patients who might be eligible for, and benefit from, a given study. In response to earlier iterations of the Privacy Rule, the research community vocalized concern that HIPAA would seriously undermine recruitment efforts and make it nearly impossible for researchers to identify and contact potential research subjects. As a result of this initial concern, the topic of research recruitment has been addressed in several commentaries to the privacy regulations as well as guidance documents issued by the Office for Civil Rights (OCR) and the National Institutes of Health (NIH) on HIPAA and research generally. Unfortunately, the current state of guidance on this topic has left researchers and institutions in a continued state of confusion.
As background for our recommendation, we provide a brief overview of the existing guidance on research recruitment. There are currently three analytical steps that must be performed under HIPAA when determining how Covered Entities may use or disclose PHI for the purposes of subject recruitment: (1) how a researcher gets access to PHI to identify potential research subjects (e.g., reviewing patient medical records or a patient database to identify patients that meet the study's eligibility criteria); (2) how a researcher, or other individual, may contact the identified potential subjects (using the medical and contact information in the patients' records); and (3) how a researcher can maintain PHI collected from potential subjects who are not ultimately enrolled (e.g., for the purposes of maintaining a screening log).
Initially, the research community anticipated and hoped that recruitment would either be viewed as part of the "health care operations" of the Covered Entity, and thus permissible without individual authorization, or that the provisions in the Privacy Rule permitting "reviews preparatory to research" based on certain representations by investigators would be interpreted to apply to all research recruitment activities. In the version of the Privacy Rule issued in December 2000, the commentary to the regulations stated that the purpose of permitting "reviews preparatory to research" without individual authorization was to "assist in the development of a research hypothesis and aid in the recruitment of research participants," for example, for researchers to determine whether a certain Covered Entity has sufficient numbers of the patient population that would be eligible for the study in order to make the study feasible. Investigators were required to represent that PHI reviewed in the course of the preparatory review would not be removed from the premises of the Covered Entity. Furthermore, the commentary also suggested that investigators were not permitted to record any identifiers in the course of preparatory reviews. Investigators were therefore left wondering how, if at all, they could record and remove the names and contact information of subjects identified as being eligible for a given research study in order to then contact them and continue the enrollment process.
The commentary to the Notice of Proposed Rulemaking ("NPRM") in March 2002 appeared to offer an alternative solution by clarifying that the provisions of the Privacy Rule permitting IRB or privacy board waiver of the authorization requirement "are intended to encompass a partial waiver of authorization" to allow researchers to obtain PHI for recruitment purposes. The commentary to this iteration of the Privacy Rule did not mention the use of reviews preparatory to research to identify and contact potential research subjects, leaving researchers with the impression that this was not a viable option.
In the commentary to the August 2002 Final Privacy Rule, the Department refused to accept the notion that recruitment of subjects using PHI be considered part of the Covered Entity's "health care operations," and instead indicated that "[r]esearch recruitment is neither a marketing nor a health care operations activity." The commentary stated that a Covered Entity is permitted to disclose PHI to the individual who is the subject of the information; therefore, providers and patients "may continue to discuss the option of enrolling in a clinical trial" without individual authorization or IRB/privacy board waiver of authorization. However, the commentary cautioned, if a Covered Entity wishes to disclose an individual's PHI to a "third party," presumably external to the Covered Entity, for purposes of recruitment, the Covered Entity must first obtain patient authorization or waiver of authorization. This statement again appeared to undermine any reliance on the review preparatory to research exception for research recruitment activities and to require researchers who are not in a treatment relationship with a potential research subject to seek the individual's authorization or IRB waiver of the authorization requirement before any PHI could be reviewed and used for recruitment purposes. Rejecting a suggestion from the National Human Research Protections Advisory Committee (NHRPAC), SACHRP's predecessor advisory committee, the August 2002 commentary also cautioned against the use of broad authorizations from patients allowing the use of their PHI for research recruitment purposes. According to the commentary, "such blanket authorization would not provide individuals with sufficient information to make an informed choice about whether to sign the authorization."
The recruitment debate took an even more confusing turn when, on December 3, 2002, OCR published its first guidance on this topic that was not in response to public comment to the regulations (the December 2002 Guidance). In its December 2002 Guidance, OCR, for the first time, seemed to expressly allow the regulations' preparatory review exception to serve as the basis for researchers who are members of a Covered Entity's workforce, and therefore, technically an extension of the Covered Entity itself, to identify and contact potential research subjects. Yet at the same time, OCR indicated that to obtain and use PHI to recruit subjects, "external" (non-workforce) researchers would be required to obtain IRB partial waiver of authorization.
The positions taken by OCR in the December 2002 Guidance have resulted in much debate and confusion throughout the research community. As a preliminary matter, the rules for "internal" researchers appear inconsistent with prior December 2000 commentary which specifically prohibited the recording of identifiable information during any review preparatory to research, and which did not distinguish between researchers internal or external to a Covered Entity. Second, although the December 2002 Guidance appeared to permit internal researchers to use PHI collected during a preparatory review to both identify and contact potential subjects, such a result ran counter to the existing recruitment policies of many institutions and IRBs, which historically have tended to require any communication about an available research study to come from the individual's treating physician or caregivers, not from an investigator unknown to the potential subjects. (In this way, interestingly, traditional Common Rule interpretations are much more protective of subjects' privacy than the positions OCR has most recently offered under the Privacy Rule.) Furthermore, the distinction between workforce and non-workforce, internal and external investigators appears arbitrary and in conflict with the regulations' provisions on reviews preparatory to research, which are available to both internal and external researchers. In other words, it has been unclear why external researchers would not be permitted to rely on the preparatory review provision to identify potential subjects, even if they could not contact subjects without seeking a limited waiver from an IRB or privacy board. Another matter of continued uncertainty has been whether the maintenance of potential subjects' PHI on screening logs (and the disclosure of the PHI in screening logs to research sponsors and others) would be permissible under the preparatory review exception.
In the NIH's most recent guidance on Clinical Research and the HIPAA Privacy Rule, published February 2004 (the February 2004 Guidance), some clarity was provided. According to that guidance, with respect to identifying potential subjects, Covered Entities may use the preparatory review exception to use or disclose PHI to researchers to aid in study recruitment. Specifically, the Covered Entity may allow a researcher, either internal or external to the Covered Entity, to identify, but not contact, potential study participants so long as the researcher provides the representations required by the preparatory review provision. In order to contact potential subjects, however, the guidance continued to draw a distinction between internal and external researchers. For the first time, the NIH indicated that researchers who are members of the Covered Entity's workforce may contact potential study participants as part of the Covered Entity's "health care operations." This appears to be inconsistent with the commentary in the Final Privacy Rule stating expressly that research recruitment is not health care operations. The only possible way to reconcile these two positions would be to assume that the contacting of subjects to seek authorization to enroll in a research study is not part of what the Department considers "research recruitment" - a very illogical conclusion.
Because the contacting of potential subjects to seek authorization to enroll in the study may now, under the February 2004 Guidance, be regarded as a health care operation, the Covered Entity can also do this activity through a "business associate." Therefore, researchers who are not members of the Covered Entity's workforce can be retained as business associates for the purposes of contacting identified potential subjects. Alternatively, a non-workforce researcher who does not have the benefit of becoming a business associate needs to seek a partial waiver of authorization in order for the Covered Entity to disclose to the researcher the PHI necessary for the researcher to contact identified potential subjects. The February 2004 Guidance reiterated and clarified that a health care provider can continue to discuss treatment alternatives, which may include participating in a clinical trial, with an individual, whether or not the individual is a patient of the provider, as part of the patient's treatment or the Covered Entity's health care operations. This Guidance also stated, notwithstanding previous commentary prohibiting broad authorizations for research recruitment purposes, that Covered Entities may include an individual's PHI in a clinical research recruitment database and grant researchers access to the database, provided that the individual has signed an authorization permitting such a use and disclosure of the individual's PHI. This method is now permitted as an alternative to relying on the preparatory review exception in order to identify potential research subjects.
In sum, researchers are currently faced with a universe of confusing and, in many cases, seemingly contradictory guidance statements on how PHI can be used to identify and contact potential research subjects. As it currently stands, it appears that researchers, both internal and external to the Covered Entity, may conduct a review preparatory to research to identify potential research subjects. Once potential research subjects have been identified, researches who are workforce members may contact the potential subjects about the possibility of enrolling, while researchers who are external to the Covered Entity would require another basis for receiving PHI from the Covered Entity to be used to contact potential subjects (either by signing a business associate agreement with the Covered Entity or by obtaining a limited waiver of authorization from an IRB or privacy board permitting the disclosure of PHI to the researcher for the purposes of contacting potential subjects).
The consequence of these confused and complex interpretations of research recruitment requirements has been to layer unnecessary, and extremely burdensome, tasks onto human subjects research. It appears, for example, that in some institutions, boilerplate business associate contracts are being signed, and that template applications for partial waivers of authorization are being routinely granted, as methods of perfunctory compliance with these confusing Privacy Rule requirements. Another effect of the enormous confusion has been that other institutions are hesitant to permit many recruitment activities critical to the continuation of the research enterprise, out of fear that they are in some way misinterpreting the government's current positions on research recruitment. SACHRP is very concerned that the bureaucratic complexities here undermine, rather than enhance, the attention that needs to be paid to the welfare and interests of subjects in the research recruitment process.
Of primary concern to SACHRP is the fact that under the current interpretation of the regulations, researchers who are affiliated with, but not part of the "workforce" of, a Covered Entity-for example, researchers in an organized health care arrangement with the Covered Entity by virtue of their medical staff privileges-are treated differently from those researchers who are employed by the Covered Entity. The former are "external," while the latter are "internal." Under current OCR interpretation, the former must sign a business associate agreement or apply for partial waiver of authorization before contacting any subjects; the latter can contact subjects as part of the Covered Entity's health care operations. This disparate treatment occurs regardless of whether the different classes of researchers are equally subject to the Covered Entity's policies and procedures, including medical staff bylaws and faculty rules and regulations, the threat of faculty or medical staff discipline, and the jurisdiction of the same IRB.
As noted above, in characterizing the contacting of research subjects as "health care operations," the February 2004 Guidance opened the door to any internal researcher contacting patients regarding the possibility of enrolling in a research study, notwithstanding the standard research practice of requiring any communication about an available research study to come from the individual's treating physician or his/her staff. Although researchers remain subject to the policies of the institution and the IRB under which they operate, SACHRP encourages the Department to clarify that its interpretation in the February 2004 Guidance addresses only what is permissible under the HIPAA Privacy Rule and in no way suggests a "best practices" standard for subject recruitment methods.
