HIPAA regulations that apply to clinical research

HIPAA regulations that apply to clinical research are designed to protect the privacy and security of individuals' health information while allowing for the advancement of medical knowledge through research.

Understanding and adhering to HIPAA regulations is essential for researchers, healthcare providers, and institutions involved in clinical research. Compliance not only ensures legal adherence but also upholds ethical standards in the responsible conduct of research involving individuals' health information.

What is clinical research?

Clinical research is a branch of medical and healthcare research that systematically investigates the safety, efficacy, and effectiveness of new drugs, medical devices, treatments, and interventions in human subjects. The primary goal of clinical research is to generate valuable knowledge and evidence to improve the prevention, diagnosis, and treatment of diseases and medical conditions.

The importance of HIPAA regulations in clinical research

The Health Insurance Portability and Accountability Act (HIPAA) regulations provide clinical research with a robust framework for safeguarding the privacy and security of individuals' health information. Here are some reasons why HIPAA regulations are important in clinical research:

Protection of participant privacy

• Confidentiality assurance: “Between privacy and confidentiality, confidentiality is arguably the more important one in research,” says the University of Virginia. This is because “privacy is easily assured with proper consent procedures, confidentiality of data takes more effort to maintain.” HIPAA establishes strict guidelines to protect the confidentiality of individuals' health information. This is particularly significant in clinical research, where participants often share sensitive medical details.
• Informed consent: Adherence to HIPAA ensures that participants are fully informed about the use of their protected health information (PHI) in the research. This transparency is important for obtaining informed consent, an important aspect of ethical research.

Read more: 9 elements of informed consent

Ethical conduct of research

• Respect for autonomy: Respecting individuals' autonomy and privacy is a fundamental ethical principle in research. HIPAA regulations provide a legal framework that reinforces ethical conduct and ensures that participants' rights are upheld throughout the research process.
• Institutional review board (IRB) oversight: IRBs are responsible for reviewing and approving research protocols and often require compliance with HIPAA regulations. This ensures that research involving PHI meets ethical standards.
  
  

Legal compliance and accountability

• Avoiding legal consequences: Non-compliance with HIPAA can lead to severe legal consequences, including fines ranging from $137 to  $2,067,813, and penalties. Researchers, institutions, and sponsors have a legal obligation to adhere to HIPAA standards in the handling of health information.
• Breach notification: HIPAA mandates the timely notification of individuals and relevant authorities in the event of a breach of unsecured PHI. This requirement promotes accountability and transparency in addressing and rectifying potential breaches.

Read more: The basic elements of a HIPAA compliant breach notification

Data security and integrity

• Securing PHI: HIPAA outlines specific security measures, such as encryption and access controls, to safeguard the integrity and confidentiality of health information. This prevents unauthorized access, data breaches, and the compromise of sensitive research data.
• Data accuracy: The integrity of research outcomes depends on the accuracy and reliability of health data. Adherence to HIPAA standards ensures that the collection, storage, and transmission of PHI maintain a high level of data accuracy.  
  
  

Interoperability and collaboration

• Facilitating data sharing: HIPAA compliance supports interoperability and the exchange of health information among different entities. This is essential for collaborative clinical research efforts that involve multiple institutions, ensuring seamless and secure data sharing.
  
  

Global considerations

• International collaboration: For researchers involved in international studies, compliance with HIPAA assures privacy protection and aligns with global standards. 

What regulations apply to clinical research?

Authorization for use and disclosure 

• Researchers must obtain written authorization from individuals before using or disclosing their PHI for research purposes.
• The authorization must clearly state the purpose of the research, the specific PHI to be used, and how the information will be protected.
  
  

Limited data sets 

• A limited data set is PHI that excludes direct identifiers (e.g., names, addresses) but may include dates, geographical information, and other quasi-identifiers.
• Limited data sets can be used for research purposes without individual authorization, provided a data use agreement is in place.

Data use agreements

• When using a limited data set, researchers must establish a data use agreement with the covered entity (e.g., healthcare provider) specifying the permitted uses and disclosure of the data.
  
  

Research authorization waiver 

• In certain circumstances, an IRB may waive the requirement for individual authorization if the research meets specific criteria, such as minimal risk to participants.
  
  

Institutional Review Board (IRB) approval 

• HIPAA requires that researchers obtain approval from an IRB or a privacy board before accessing PHI for research purposes.
  
  

De-identification of PHI

• Researchers can de-identify PHI by removing 18 specified identifiers. Once de-identified, the data is not subject to HIPAA regulations.
• Alternatively, an expert can determine that the risk of re-identification is very small, allowing for the use of the data in research.

Watch: What are the 18 PHI identifiers?

Security safeguards

• Covered entities and their business associates must implement safeguards to protect electronic PHI's (ePHI) confidentiality, integrity, and availability.
• Entities must conduct regular risk assessments and implement measures to address identified vulnerabilities.
  
  

Breach notification

• Covered entities must notify affected individuals, the Secretary of Health and Human Services (HHS), Mr. Xavier Becerra, and, in some cases, the media, in the event of a breach of unsecured PHI.
• Notifications must be made without unreasonable delay and within 60 days of discovering the breach.
  
  

HIPAA training 

• Covered entities are required to provide training to employees on HIPAA regulations and their internal policies to ensure compliance.
• Training should be periodically updated to reflect changes in policies and regulations.

Ensuring HIPAA compliance

Achieving HIPAA compliance in clinical research requires a comprehensive and systematic approach to protect the privacy and security of individuals' health information. 

Here are the steps to ensuring HIPAA compliance:

• Establish robust administrative, technical, and physical safeguards for the handling of PHI. This includes implementing secure data storage, encryption, and access controls. 
• Obtain written authorization from participants before using their PHI, ensuring transparency about the purpose and scope of the research. 
• Collaborate with IRBs, as their ethical oversight ensures that research protocols align with HIPAA guidelines. 
• Conduct ongoing staff training on HIPAA regulations to maintain awareness and ensure compliance across all levels of the research team. 
• Conduct regular risk assessments and audits to help identify vulnerabilities and strengthen security measures.

FAQs

May a covered entity accept documentation of an IRB waiver of authorization?

Yes. The HIPAA Privacy Rule explicitly permits a covered entity to reasonably rely on a researcher’s documentation of an Institutional Review Board (IRB) or Privacy Board waiver of authorization

What practices ensure the confidentiality of research participants?

Confidentiality can be ensured by using good data collection and storage practices.

What is an example of the right to privacy in research?

Examples of privacy protections include:

• Interviewing participants about sensitive topics individually instead of in front of a group. Interviewing the participant in their home or a private office instead of a public place. 
• Providing a private exam room for study procedures.