Ensuring a HIPAA-Compliant Informed Consent Process

Ensuring a HIPAA-Compliant Informed Consent Process

Kimberly Irvine and Eileen Hilton (CenterWatch, Boston, MA, 2003), 158 pages, paperback, ISBN: 1930624395, $39.99.

This book is a handy size, 158 pages. Of this total, 113 pages are devoted to printing the HIPAA Privacy Rule in its entirety. With 14 pages used for a glossary and table of contents, only 31 pages remain on which to outline the informed consent process and the HIPAA Privacy Rule patient Authorization Agreement. It would have been helpful to go into further detail on some of the points of informed consent and the application of the Privacy Rule. For example, page 5 contains the statement IRB approval may not be required for the separate authorization form although organizational policy may vary. If the regulatory basis for this statement were provided, it would have given the reader a sound basis on which to make a decision. Except for patient authorization, none of the pathways included in the Privacy Rule for use of protected health information in research were outlined. Parts 160 and 164 of HIPAA Privacy Rule regulations are provided without comment or guidance of any kind.

In several places in the book, blanket or all-inclusive statements are made. It would have been helpful to list the conditions and exceptions to those statements. For example, page 5 contains the statement Specifically, subjects must authorize the use or disclosure of their protected health information (PHI). The HIPAA Privacy Rule provides for five other pathways to use PHI for research purposes. The book does not describe the pathways or state the conditions under which a patient Authorization Agreement would be required.

Another example is the statement at the top of page 6, Subjects enrolled prior to 14 April 2003, will not have to be reconsented. This statement may lead the reader into a false sense of being in compliance, as it is true only until the consent document is revised to include new information.

The endnote references to the FDA and HHS regulations are not helpful, because they refer to the general informed consent regulations but do not guide the reader to the specific regulation that contains the element. Reference 1 incorrectly cites the regulatory reference to the elements of informed consent rather than the regulation requiring written documentation of consent.

The U.S. Department of Health and Human Services Regulations at 45 CFR 46 are incorrectly referred to as the Office for Human Research Protections regulations. Also, the book incorrectly implies all of the subparts of the 45 CFR 46 regulations are contained in the Common Rule.

The requirements of the ICH Good Clinical Practice E-6 guideline are contrasted with the FDA and HHS regulations. It would have been helpful to reference the specific sections of the ICH Guideline for Good Clinical Practice.

The sample assent form on page 26 does not meet generally accepted standards for assent. It does not contain a simplified explanation of the study and the procedures to be followed, but only statements that the study procedures, discomforts, risks, and inconveniences have been explained to you.

The second entry under General Requirements on page 27 fails to mention that the copy of the HIPAA Authorization Agreement given to the study subject must have been signed and dated by the subject. This is an important point, as the FDA and HHS regulations do not specifically require the copy of the informed consent form given to the study subject to include the signature of the study subject.

The second entry under Guidance incorrectly states that all ongoing research projects will require an authorization form or consent modifications at the time of continuing review. Already enrolled subjects may continue to participate indefinitely without providing HIPAA authorization, as long as the consent document is not changed to provide new information to the subject. All new subjects enrolling into ongoing research projects on or after the compliance date (14 April 2003) must sign HIPAA-compliant authorization agreements.

The information provided for genetic substudies is very good and complete.

This book could be a useful initial reference for a first venture into HIPAA, but readers should confirm the accuracy and completeness of the information. It is not a definitive reference to practical application of either informed consent or the HIPAA Privacy Rule.