|
What Is the Effect of the Privacy Rule on Research Started Before the Compliance Date?
Key Points:
- Research that is ongoing before the applicable compliance date (usually April 14, 2003) is covered by the Privacy Rule's transition provisions if the research participant's informed consent, other legal permission for the research use and disclosure, or an IRB's waiver of informed consent was obtained by the covered entity before the applicable compliance date for the Privacy Rule.
| The Privacy Rule includes a limited provision that "grandfathers" certain permissions obtained for research that were obtained prior to the compliance date. Under these transition provisions, a covered entity may use and disclose for the research purposes allowed by those permissions PHI that was created or received, either before or after the compliance date, if any one of the following is obtained before the compliance date: |
|
Transition Provisions - A section of the Privacy Rule that permits covered entities to rely on express legal permission for use and disclosure of PHI, informed consent, or IRB-approved waiver of informed consent for research, provided the legal permission, informed consent, or IRB-approved waiver was obtained prior to the compliance date.
|
- An Authorization or other express legal permission from an individual to use or disclose PHI for the research.
- The informed consent of the individual to participate in the research.
- A waiver of informed consent by an IRB.
However, if a waiver of informed consent was obtained prior to the compliance date, but informed consent is sought from the research subject after the compliance date, the covered entity must obtain the individual's Authorization as required under the Privacy Rule unless such use or disclosure is permitted without Authorization. For example, if there had been a temporary waiver of informed consent for emergency research under the FDA Protection of Human Subjects Regulations, and informed consent was later sought after the compliance date, a covered entity would have to obtain an individual Authorization before it could use or disclose PHI for the research, unless the activity is otherwise permitted by the Privacy Rule.
The Privacy Rule allows covered entities to rely on express legal permission, informed consent, or IRB-approved waiver of informed consent obtained before the compliance date to use and disclose PHI for research studies, as well as for any future research that may be included in such permission. This provision is different from those applying to an Authorization or a waiver obtained after the compliance date. Authorizations and waivers after the compliance date will only permit the use or disclosure for the specific research study for which they were obtained.
In some instances, existing express legal permissions, informed consents, or IRB-approved waivers of informed consents are not study specific. These permissions for research and waivers, even if provided for future unspecified research, are grandfathered by the transition provisions provided the permission or waiver was obtained prior to the compliance date and informed consent for research is not sought later.
|
