NRPM: Standards for Privacy of Individually Identifiable Health Information. d. Exception for research information unrelated to treatment.


Given the voluntary, often altruistic, nature of research participation, and the experimental character of data generated from many research studies, research participants should have assurances that the confidentiality of their individually identifiable information will be maintained in a manner that respects these unique characteristics. In the process of conducting health research, some information that is collected could be related to the delivery of health care to the individual and some could be unrelated to the care of the individual. Some information that is generated in the course of a research study could have unknown analytic validity, clinical validity, or clinical utility. In general, unknown analytic or clinical validity means that the sensitivity, specificity, and predictive value of the research information is not known. Specifically, analytic validity refers to how well a test performs in measuring the property or characteristic it is intended to measure. Another element of the test’s analytical validity is its reliability – that is, it must give the same result each time. Clinical validity is the accuracy with which a test predicts a clinical condition. Unknown clinical utility means that there is an absence of scientific and medical agreement regarding the applicability of the information for the diagnosis, prevention, or treatment of any malady, or the assessment of the health of the individual.

We would define "research information unrelated to treatment" as information that is received or created by a covered entity in the course of conducting research for which there is insufficient scientific and medical evidence regarding the validity or utility of the information such that it should not be used for the purpose of providing health care, and with respect to which the covered entity has not requested payment from a health plan.

Such information should never be used in a clinical treatment protocol but could result as a byproduct of such a protocol. For example, consider a study which involves the evaluation of a new drug, as well as an assessment of a genetic marker. The drug trial includes physical and radiographic examinations, as well as blood tests to monitor potential toxicity of the new drug on the liver; all of these procedures are part of the provision of health care, and therefore, would constitute "protected health information," but not "research information unrelated to treatment." In the same study, the investigators are searching for a genetic marker for this particular disease. To date, no marker has been identified and it is uncertain whether or not the preliminary results from this research study would prove to be a marker for this disease. The genetic information generated from this study would constitute "research information unrelated to treatment".

We solicit comment on this definition of "research information unrelated to treatment" and how it would work in practice.

Because the meaning of this information is currently unknown, we would prohibit its use and disclosure for treatment, payment and health care operations unless a specific authorization is obtained from the subject of the information. Failing to limit the uses and disclosures of this information within the health payment system would place research participants at increased risk of discrimination, which could result in individuals refusing to volunteer to participate in this type of research. Without the special protections that we are proposing, we are concerned that much potentially life-saving research could be halted. Moreover, because this information that lacks analytical or clinical validity and clinical utility, and because we have defined it terms that preclude researchers from seeking third-party reimbursement for its creation, there would not be a reason for this information to be further used or disclosed within the treatment and payment system without individual authorization.

We also propose that covered entities not be permitted to condition treatment or payment decisions on a requirement that an individual provide a specific authorization for the use or disclosure of research information unrelated to treatment. The special protections that are being proposed would not be meaningful if covered entities could coerce individuals into authorizing disclosure by conditioning treatment or payment decisions on a requirement that the individual authorize disclosures of such information. This requirement would not prohibit the covered entity that creates the information from using the information for the research purposes for which it was collected. The entity could not, however, condition the provision of treatment on a requirement that the individual authorize use of research information unrelated to treatment by the covered entity for other purposes or the disclosure of the information by the covered entity to others.

We considered including other of the uses and disclosures that would be permitted under § 164.510 within the prohibition described in this provision, but were unsure if research information unrelated to treatment would ever be relevant to the public policy purposes underlying those disclosures. We solicit comment on whether there are additional categories of uses or disclosures that would be permitted under proposed § 164.510 for which the use or disclosure of such information by covered entities without specific individual authorization would be appropriate.