New Disclosure, Privacy Rules Challenge Biomedical Research Operations

The long wait is finally over for much-anticipated regulations governing disclosure of pharmaceutical company payments to physicians, and on the rights of patients to protect access to their personal health information (PHI). The "Sunshine" rule, issued February 1, 2013 by the Centers for Medicare and Medicaid Services (CMS), promotes transparency in the healthcare market to prevent undue industry influence on prescribing and medical research; the privacy rule similarly aims to build public confidence in the nation's healthcare system by limiting unauthorized use of patient medical records, including those useful in biomedical research.

The physician payment disclosure program was enacted as part of the Affordable Care Act of 2010 to establish a system for tracking financial relationships that could create conflicts of interest between drug and device makers and physicians and teaching hospitals. The final rule sets timeframes and specifics for manufacturers to file information with CMS on payments and "transfers of value" to "covered recipients"—doctors and teaching hospitals. Disclosure covers research activities, consulting fees, gifts, meals, travel costs and speaking fees, plus ownership and investment interests of a doctor and his family in an "applicable manufacturer." Physicians protested that inflated financial numbers will taint often valid activities, and HHS gave them an extra 15 days, in addition to an initial 45 days, to review and challenge industry data before it is posted on the public website.

Questions were raised during the lengthy rule-writing process about the need and wisdom of reporting payments to physicians for conducting research, with a specific focus on the potential for double counting payments made to investigators at research institutions. The final rule permits sponsors to file one report on a payment to a research organization to clarify that not all the money goes to an individual investigator. HHS also confirms it will delay posting payment information related to preapproval trials until after market approval to prevent premature disclosure of confidential research. That delay, however, does not apply to studies for new indications of an approved therapy. And the final rule specifies that sponsors have to report payments to investigators via contract research organizations or site management organizations to prevent using contractors to skirt disclosure.

It remains to be seen if "Sunshine" discourages physicians from serving as investigators in commercial clinical trials. To avoid disputes over financial filings and inadvertent embarrassment of investigators, many pharma companies are establishing electronic "aggregate spend" tracking systems that permit them to share and confirm payment data with physicians prior to CMS filing. All parties appreciate CMS' go-slow approach in launching the much-delayed program: manufacturers have until August 2013 to start official collection of payment data for five months of this year. That will be submitted next March (2014) for posting in September, and in annual reports thereafter. CMS indicates it will post research payment data separately, to be clarified in further guidance.

Protecting privacy

Another important federal policy sets requirements for hospitals, providers, and health plans to ensure that they and their "business partners" (service companies and data management firms) prevent unauthorized access to patient PHI. The premise is that strong privacy protections and stiffer penalties for security "breaches" will build public support for electronic health records and data transmission activities designed to improve health and lower costs.

Congress enacted legislation in 2009 to clarify and close loopholes in the privacy rule of the Health Insurance Portability and Accountability Act (HIPAA) of 1996, and a final rule issued in January 2013 set new limits on the use of PHI for commercial and marketing purposes and addresses questions about using data for biomedical research. A key provision clarifies that providers and plans cannot sell patient information for marketing or fundraising purposes without consent.

Important for research sponsors, the new rule permits compound research authorizations—i.e., an initial consent to use PHI could apply to a clinical study as well as to specimen collection for a central repository. HHS also says that authorizations for research studies no longer have to be "study specific" provided a consent document "adequately describes" how the PHI will be used in future research. These provisions should reduce paperwork for clinical sites collecting consent from study subjects. But such research authorization "has to be reasonable for a patient to understand," explains attorney Patricia Calhoun of CarltonFields. She anticipates further discussion and litigation about just what is "reasonable," but considers the compound authorization language "a huge win" for the research community.

—Jill Wechsler