HHS Clarifies Research Use of Data

Drug giant Eli Lilly & Company recently expressed concern to Department of Health and Human Services officials that the HIPAA privacy rule may impede clinical research trials.

Institutional review boards are backlogged with requests to review and approve thousands of patient authorizations for use and disclosure of information, according to a letter from Stan Crosley, chief privacy officer of Indianapolis-based Eli Lilly.

In a response letter, Richard Campanelli, director of the HHS Office of Civil Rights, wrote, "We wish to emphasize that the privacy rule does not require IRBs to review HIPAA authorizations for compliance with the rule's requirements. From the point of view of privacy rule compliance and enforcement, all that is required is that HIPAA authorizations used for research or other disclosures comply with the requirements of the rule, whether the HIPAA authorization form is created by the covered entity itself or by a third party. Under the privacy rule, a covered entity may disclose protected health information for research purposes with an authorization that is valid under the rule, whether or not an IRB has approved the form."

The Office for Civil Rights is responsible for enforcing the privacy rule. Full text of Campanelli's letter, along with additional guidance on the rule, is available at www.hhs.gov/ocr/hipaa.