Implications And Next Step

In our view, there are several key aspects of the existing legal scheme that are cumbersome impediments to the conduct of large-scale epidemiologic studies. In order to make this scheme workable, we will need to:

• Engage in significant education of data sources and IRBs in order to integrate the new privacy

39 See id. at 82 817 (codified at 45 C.F.R. § 164.512(i)(2)(iv)(A)).

42 See id.

43 Although an IRB might be inclined to grant such a waiver under the Common Rule criteria (particularly since deceased individuals are not "human subjects''), the privacy regulation provides a process for obtaining authorization from the executor of an individual's estate or other personal representative, so it is not clear how these new rights and responsibilities may affect the deliberations of IRBs.

authorization requirements with the existing Common Rule process for waiver of consent. Timely education will be key to avoiding IRB gridlock as the compliance date approaches.

• Engage in significant education of the public regarding the value of epidemiologic research and the protections routinely used to protect individuals' privacy interests. Because the privacy regulation also provides ordinary persons with access to information about all the people who have had access to their records—including researchers who access information under a waiver of authorization—there is a danger of public backlash if individuals are merely given a list of third parties that conduct research programs without an understanding of the purpose and importance of such uses and how the privacy of individual data subjects is protected.44

• Assist in developing de-identification strategies that will meet epidemiologists' data needs, and monitor the use of resources invested in building an information infrastructure to ensure that the public interest in research is protected in a cost-effective manner.

At a more basic level, we must return to the more fundamental policy issue that a consent-based regulatory model (with waiver by a Review Board) is little more than an abdication of the government's responsibility for using its power to protect both privacy and the public interest in research. Although this may be an ethically sound model in interventional research where a specific individual is being asked to subject him or herself to risks in the name of scientific curiosity, the ethical issues arguably are entirely different in data studies undertaken for public health and health care quality purposes. The consent model shifts responsibility to the individual: if the individual consents, then the individual assumes the risk of loss. As implemented under the new federal regulation,

44 For example, because data that is stripped of "direct identifiers" is nonetheless "protected health information", the covered entity must keep track for each individual of every researcher who has obtained access to a data set. The fact that the data available to the researcher bore no direct identifiers is not a fact to which the data subject has access.

government authority is used merely to ensure that each individual is appropriately warned of the risks, and that those who nonetheless attempt to persuade individuals to consent, keep records of those warnings and of the consent, and are accountable for the inappropriateness of their procedures. From a legal perspective, waiver of consent by an IRB may be construed as an indication that the IRB or its institutional sponsor is accepting this responsibility on behalf of the individual. In our litigious society, this is not a legal model that over the long run will make it economically viable for hospitals, doctors, and health plans to provide data to researchers under a waiver.

To bring the discussion full circle, if this approach had been used as the framework for monetary regulation, it would be analogous to forsaking the secure, regulated banking system for one more like venture capital: bankers would have to poll the public for funds, and each would-be investor would bear responsibility for approving the subject matter of each project and, having signed the forms, bear the risk of loss. In our view, the public interests in privacy and in the quality of health care that research makes possible argues for a more equitable approach to assuring that the burdens of research are shared by those who benefit, and that government and/or private oversight is used to minimize risks to all by establishing data security standards and holding individuals accountable for violations.

Drug Free Life

Drug Free Life

How To Beat Drugs And Be On Your Way To Full Recovery. In this book, you will learn all about: Background Info On Drugs, Psychological Treatments Statistics, Rehab, Hypnosis and Much MORE.

Get My Free Ebook


Post a comment