Human
Investigation Committee
Yale University
School of Medicine
47 College Street,
Suite 204
New Haven, CT
06520-8010 USA
Phone:
(203) 785-4688
Fax:
(203) 785-2847
 |
 |
 |
 |
 |
 |
 |
|||||
Patient's Rights to Provisions in Research
HIPAA gives patients certain rights with respect to their health information. In research that includes a treatment component, subjects have the right (1) to receive a Notice regarding Yale's Privacy Practices and (2) to access and amend their records. Subjects have the right to an accounting of disclosures of their PHI, regardless of whether or not the disclosures were related to treatment. For example, when conducting a study in which research results will be incorporated into subjects' permanent medical records, a researcher must (1) provide the subjects with NOPPs and (2) address in the Research Authorization Form the issue of access to the medical records generated in the research study. When conducting studies that do not involve treatment, e.g., basic research involving healthy volunteers, researchers do not need to provide subjects with the NOPP or address in the RAF the research record access issue. However, in both of the types of studies described in the above examples, researchers must be able to provide an accounting of disclosures to subjects upon request.
Notice of Privacy Practices
Under HIPAA, individuals have the right to receive adequate notice of (a) how Yale may use or disclose their PHI; (b) their rights under HIPAA; and (c) Yale's legal duties under HIPAA. This information is communicated via Yale's Notice of Privacy Practice (NOPP). http://hipaa.yale.edu/
Yale is required to provide a NOPP to any person with whom it has a direct treatment relationship and to any person who asks for a copy. Yale is also required to post the NOPP in a prominent location. The NOPP must be provided no later than the first date of service delivery.
Additionally, the institution, provider, or researcher must make a good faith effort to obtain the individual's written acknowledgement of receipt of the NOPP. Given that individuals need only be given one copy of a current or revised NOPP, investigators should verify that the subject has received the NOPP or provide the subject with a NOPP prior to commencing any research procedures. Patients of Yale School of Medicine (YSM) who receive the NOPP will be listed in IDX. Patients of Yale-New Haven Hospital (YNHH) who receive the NOPP will be listed in the SDK system, the data from which is periodically transferred to the YSM IDX system. Researchers should provide a NOPP to a subject whenever the subject's previous receipt of a NOPP cannot be verified through IDX or paper records. Most YSM business offices have access to IDX and can assist in verifying whether a subject has received the NOPP.
YSM and YNHH use a joint NOPP. The Yale School of Nursing and the Yale Psychology Department clinics each have their own NOPPs. Researchers should provide subjects with a copy of the relevant NOPP when required. For more information see http://hipaa.yale.edu
Individual Right to Access and Amend
HIPAA gives each patient the right to access and request amendment of his or her PHI that is maintained by Yale or its business associates in that patient's designated record set (DRS). Therefore, a patient has access to research information about him or her upon request if the research information is stored in the patient's DRS. The DRS includes any health information that was used to make a treatment decision, i.e., the patient's medical record.
Investigators conducting research that includes treatment can decide whether research notes will be included in the DRS. This is true only for data that is collected purely for research purposes. Any data collected during a research study that is used for treatment decisions must be included in the DRS. If research records will be stored separate from the DRS, the storage must be done in such a way that the patient will not have access to edit the research record.
Researchers can deny subjects access to information contained in the research record or researchers can delay granting such access until after the study is completed. If researchers decide to restrict access during the course of the study, the restriction must be included in the Research Authorization Form. If researchers decide to delay granting access, then upon completion of the study, subjects may request and researchers must provide the subjects with a copy of their records.
Researchers should refer all subject requests for access to PHI obtained in the course of research to the appropriate Yale Records Department for processing in accordance with Yale policy. The policy is located at http://www.yale.edu/ppdev/policy/5002/5002.pdf and provides detailed guidelines for responding to such requests. The Records Department will determine, with assistance from the researcher and the HIPAA Privacy Officer, whether subject access to the PHI should be denied under established exceptions described in the policy.
Under HIPAA, patients have the right, upon request, to obtain a list of individuals or entities who have had access to or been provided with a copy of the patients' medical records for any reason other than treatment, payment, healthcare operations or with the patient's authorization. In order to meet this requirement, the medical record personnel responsible for a given record must maintain accounting logs for that record. The logs must include the names of those individuals who accessed the record, the reason for the access, and the date(s) the record was accessed. The entity responsible for the PHI must document a researcher's access to the record(s) at the time of access:
- under a waiver of Research Authorization,
- for recruitment purposes, and/or
- for research on decedents.
In order to minimize HIPAA violations and the burden on record holders, researchers may be asked to complete accounting logs for clinical departments or for YNHH. These logs may be stored with patient records or in an electronic database. When the researcher is also a treating clinician and the research use involves other members of a research team, the researcher must maintain the log.
Research records themselves are subject to HIPAA's accounting requirement when study PHI is:
- accessed for secondary data analysis by another researcher,
- accessed by additional researchers or entities not included in the Research Authorization Form signed by the subject, or
- disclosed in unanticipated events, e.g., theft or loss of records.
Record Retention
HIPAA related documentation must be maintained for 6 years. This requirement applies to accounting for disclosures records, Research Authorization Forms, Data Use Agreements, and all other HIPAA forms.
If investigators request access to records for research purposes, they must provide the record holder with a "Request for Access to PHI for Research Purposes," IRB approval for the study, and any other relevant documentation outlined in the Request for Access form. This form must be maintained for the requisite six years.
Researchers should de-identify the data as soon as possible following completion of the study. If a researcher wishes to retain identified data after completion of a study, he or she must justify such retention to the IRB, and the IRB must approve the retention, including plans for securing the data.
Return
to the Table of Contents
 |
 |
 |
 |
Last modified: Friday, 14-Dec-2007 09:55:38 EST. (JJ)