Your recruitment strategy should consider HIPAA
HIPAA rules have become more flexible
Federal privacy rules have caused considerable confusion among research institutions over the past few years, causing some clinical trial sites to avoid practices that would help with subject recruitment out of regulatory concerns.
However, clinical trial sites might be too conservative in their use of patient records to find potential research subjects, underestimating the flexibility of HIPAA, says Stephen W. Bernstein, JD, a partner with McDermott Will & Emery of Boston. Bernstein is the co-chair of the HIPAA practice group at the law firm, and he co-chairs the firm’s health ventures group.
While HIPAA hasn’t changed, interpretations of the law have evolved such that HIPAA is now thought to permit parties who are considered business associates of a physician group to search through patient medical records for the purpose of identifying potential research subjects, Bernstein says.
"The bottom line with regard to HIPAA is there is more flexibility based on the commentary than there was when the rule originally came out," Bernstein says.
This interpretation is less strict than the initial interpretation, which held that no one outside of the patient’s clinicians could look through records in which identifiable information existed.
Looking for potential subjects on a one-by-one basis is the old-fashioned and slow way to find clinical trial recruits, Bernstein says.
"The new way is to go online, where vast amounts of patient information may be searched to look for a cohort type that is appropriate for a specific study," he says.
Although HIPAA may permit this type of record review, there still are issues to consider, including how patients might react to being contacted by outsiders about their medical condition, Bernstein notes.
"The practical issue is to avoid a situation where a patient would ever be contacted and surprised for the purposes of a study by someone they don’t know," Bernstein says. Even if someone were to call saying he or she was calling on behalf of the patient’s doctor, it’s likely most people would be upset by the phone call, he says.
"So how do you target patients to do the research? The doctor can do it himself, or the nurse can call from the doctor’s office," Bernstein says.
Another strategy would be to manage patients’ expectations by having patients sign a form saying, "We regularly look through records looking for candidates for research, and do you want us to do that with your records? Do we have your permission to do that and to then contact you?" Bernstein suggests.
This would eliminate the possibility of hostility and discomfort on the patient’s part, but it could create other problems, Bernstein says.
Another issue is that while HIPAA might be more flexible than originally thought, there still are the Common Rule and ethics review requirements to consider, Bernstein says.
"Under the Common Rule, there is some concern about the ability to cull through records, even of your own patients," he says. "Then the question is whether you need to go to the IRB and get a partial waiver of informed consent even to do that."
IRBs are now being approached for authorizations more often, Bernstein adds.
The third issue is state law, which in some states is concerned about having outsiders look through medical records, Bernstein says. "In Massachusetts, there are fairly strict confidentiality rules," he says.
So clinical trial sites and institutions remain fairly conservative in their use of patient medical records for recruiting purposes because of the Common Rule and state law, even if they are aware of the increasing flexibility under evolving interpretations of HIPAA, Bernstein says.
"The balancing test and how it should work still is being determined on a case-by-case basis," he says. "It’s not impossible; it’s doable, but you have to engineer the process and manage HIPAA, state law, and the Common Rule at the same time, and it takes some planning."
Use call centers cautiously
Clinical trial sites also should be cautious about how they use call centers for recruitment, Bernstein advises.
"My sense of it is that most of those call-center advertisements are designed to look to the public as though they’re calling into the hospital or academic medical center," he says. And if this is true and potential clinical trial participants call in to say they’re interested in a study but they’re determined to be ineligible by the call center screener, then the question is whether the information the person gave to the call center is protected under HIPAA, Bernstein says.
"If the hospital has received the information, then it’s protected health information under HIPAA," Bernstein says.
This is true even if the call center is off site and is a contractor with the health care provider. A better strategy would be for the call center to have a contract with the sponsor when the sponsor is a pharmaceutical company or another entity that is not covered under HIPAA, Bernstein suggests.
"If there are call centers to recruit patients, it would be better if those call centers were outside the covered entity and not a business associated with the covered entity," he explains.
Federal privacy rules have caused considerable confusion among research institutions over the past few years, causing some clinical trial sites to avoid practices that would help with subject recruitment out of regulatory concerns.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content