Health information disclosure

One assumption frequently made by researchers and policy makers about individuals willingness to participate in genetic research (as well as other forms of medical research) is that as the research involves greater disclosure of personal health information, individuals will be less likely to participate. Prior research supports this assumption (National Health Council, 2000, p. 18). We asked the following four questions (Questions 4A, 4B, 4C, 4D) related to this issue ... 

Finally, another obstacle is that some clients will not seek help out of fear that others will discover that they have drug problems and use that information against them. One solution is to educate the client about federal confidentiality laws that protect against disclosure while in treatment, or state laws that protect client confidentiality in therapy. Flowever, you also should be very honest that there are ways in which confidentiality can be suspended, or when outside institutions can access personal health information. For example, make sure to explain that state confidentiality laws can and will be suspended if the client expresses thoughts about harming him- or herself or others, and in some states, if he or she damages property. Additionally, if a client is mandated to services, he or she should be told that those officials who mandated the treatment may have access to treatment records and reports. Finally, tell clients that insurance carriers and their representatives also may have the right to access that information. Clients should be made aware that there are a number of protections in place to protect them, but also told frankly that some of the protections have limits. 

The US Constitution, federal statutes and regulations, and state law combine to govern the collection, use, and disclosure of information. The Constitution provides certain privacy protections, but does not explicitly protect information privacy. Generally, federal law addresses privacy issues and personal information by topic (e.g., education, telecommunications, privacy, health information, motor vehicle, communications and communications records, financial and credit information, children s online (Internet) privacy) The individual s interests are usually balanced with the government s need, with authorization for personal information normally being sought through warrants, subpoenas, and court orders [120]. 

Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity s workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. 

Business Associate Contract. When a covered entity uses a contractor or other non workforce member to perform business associate services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates. Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule [DHHS, 2003b],... 

One positive aspect is that the HIPAA Privacy Rule only applies to covered entities. Covered entities include health plans, health care clearinghouses (i.e., those companies that deal with the administrative and financial aspects of health care), and health care providers whose electronic transactions contain health information. Additionally, the Privacy Rule is somewhat less strict for public health authorities (PHAs). If the intended recipient of the PHI is a PHA and if that PHA is authorized by law to collect PHI in order to prevent disease, injury, or disability, then a disclosure can be made, provided the disclosure contains the minimum necessary information that the PHA requires to carry out its job effectively. Disclosures can also be made if the PHI recipient is a health care provider and the information is needed to perform adequate treatment. If the disclosure is to be used for anything besides treatment, research, for example, the disclosure cannot be made unless the patient gives the covered entity a signed authorization. ... 

Ibid. 164.514. Other requirements relating to nses and disclosures of protected health information. 

The MSEHPA also addresses limitations on disclosure. Generally, disclosure of health information could not be made without the consent of the individual. Five exceptions are... 

In the United States, federal legislation called the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to make patient information more strictly protected than before. Although most pharmaceutical companies have limited access to patient names and other health information, any patient information must be carefully guarded to avoid violation of HIPAA statutes, which address the use and disclosure of individuals medical information by covered entities , and set standards for individuals rights to control the use of their medical information. Violations can result in fines and/ or, in some instances, imprisonment. 

In 1996, the DHHS passed the Health Insurance Portability and Accountability Act (HIPAA) to facilitate the sharing of information while protecting patient confidentiality (medical records) subsequently, associated privacy regulations were issued in 2000 (Privacy Rule). Amendments to the Privacy Rule were proposed on March 27, 2002, to address research-related situations, and become effective on April 14, 2003. In essence, the Privacy Rule is the governing law for the use and disclosure of individually identifiable protected health information (PHI) by covered entities, defined as health care providers, health plans, or health clearing houses. HIPAA-compliant consents that include elements specified in federal regulations (45 CFR 164.508) will have to be provided by covered entities that carry out the activities of health care payment, treatment, or operations (PTO). Clinical research-related uses and/or disclosures of PHI beyond PTO will require that a specifically defined authorization be obtained from a research subject. HIPAA-compliant authorizations will have to include the following core elements ... 

HIPAA is the acronym for the Health Insurance Portability and Accountability Act of 1996. HIPAA evolved as a result of the rapid evolution of health information systems technology as well as the challenges for maintaining the confidentiality of health information. HIPAA was introduced initially as the Kennedy-Kassebaum bill, an outgrowth of the Clinton administration s attempt to revamp the health care system. The result in HIPAA was an effort to streamline and standardize the health care system and to establish the privacy of subject information. The result of this effort was the issuance of the final HIPAA rules in August, 2002, which establish the requirements that prevent the disclosure of individually identifiable health information (Privacy Rule) (1) without authorization from the subject. An accidental posting of individuals health records and fraudulent use of medical records precipitated the passage of HIPAA. 

HIPAA applies to the use or disclosure of health information. The following are among the items considered to be part of the privacy rule ... 

Where HIPAA requirements are combined with the informed consent requirements, the entire document needs to be reviewed by the Institutional Review Board (IRB). The Office of Civil Rights as well as the FDA s General Counsel, as of April 7, 2003, had confirmed that IRB approval of subject authorization for use or disclosure of protected health information required by the HIPAA privacy rule is only required if the authorization language is to be part of the IRB approved informed consent document for human subjects review. 

IRBs are also permitted to waive authorization requirements for a drug sponsor using expedited review procedures permitted by the Common Rule. Expedited review is permitted for each on-going research protocol when the only addition is that of the subject authorization for the use or disclosure of protected health information. This waiver may be permitted to a researcher when the research is not possible without the waiver. The IRB must assure that an adequate plan is available to protect identifiers and to be sure that the identifiers are destroyed at the earliest possible date. 

The use or disclosure of protected health information involves no more than a minimal risk to the privacy of the individual. 

Protected health information is information used to identify a patient. This information relates to a patient s health status, a patient s health care, or payment for the patient s health care. The use or disclosure of protected health information is limited by HIPAA. The HIPAA privacy rules apply to pharmacies because they provide treatment and/or they submit claims for payment for health care services. 

Inform the patient of the right to request restrictions on the use and disclosure of protected health information. 

Consents must be signed and dated by the patient and be kept on file for at least 6 years from the date signed. These may be stored electronically and may be a condition of treatment. Health care providers may condition treatment upon the patient s consent to the use and/or disclosure of protected health information. Health plans may condition enrollment in the plan upon patient s consent to the use and/or disclosure of protected health information. The use of a patient s health information is essential to the appropriate treatment and care of the patient. It is also necessary for the payment for the care and treatment of the patient. There is a limit on the use of psychotherapy notes. The notes can be used only for treatment of the patient by the note taker, in legal action, or for the health and safety of the patient. The consent cannot be combined with the notice of privacy practice but... 

The latter view prevailed but generated yet another set of issues as to whether disclosure rules should be evaluated from the perspective of professionals or patients. Some courts took the narrower view of duty by ruling that professional standards should be used to determine what should be disclosed to patients. Although this theory of "lack of informed consent" was distinct from whether the health care provider had violated the standard of care, most courts, and many legislatures, confined the doctrine s operation to a very narrow set of circumstances consistent with the negligence standard underlying the standard of care in medical cases. Other courts took what is called the broader view and leaned toward the patient s perspective while requiring juries to impose the reasonable patient s view of risk rather than the particular patient s view of risks. 

Although there are several ethical concerns with biobanks and other large-scale research repositories (Rothstein, 2002), the most important issue is informed consent. Participants in research involving human subjects must be advised of the intended research to be performed with their specimens. With biobanks, however, the future research uses of the samples are unknown at the time of collection. It would be infeasible to contact each of the donors to obtain consent every time a new research use is contemplated, yet IRBs are reluctant to approve the use of blanket consent for unspecified uses. One way to avoid this problem is for prospective sample donors to be given a menu of possible uses of their samples. Such a list might include research in mental health, HIV/AIDS, cancer, cardiovascular disease, or other areas. The donors would then have the opportunity to approve the use of their specimens for all or some of the listed uses. Other disclosures necessary to obtain informed consent include the financial interests of the biobank and researchers, whether individuals may elect to be notified of research findings, and whether it is possible for an individual to withdraw his or her sample from the bank (Rothstein, 2002). 

All information generated during the course of the study with regard to the subject s state of health is confidential, and the subject s agreement must be obtained before disclosure of such information to a third party. 

In another example, in 2004 a judge ordered the USDA to identify the Hawaiian locations of four companies operating open air test sites for bio-pharmaceutical crops. The order had been earlier denied as it was considered to contain confidential business information protected from disclosure under federal law. Public disclosure could result in the destruction of the fields by anti-GM extremists. Vandalism such as this does little to protect the health of the public or the environment. Rather, it causes the dispersal of transgenic crops into the environment, thus creating the very harm feared by these adversaries (Jaffe, 2004a). 

D. Disclosure in the advertisement that pharmacists, physicians (or other health care providers), or veterinarians (in the case of animal drugs) may provide additional product information to consumers. This statement should communicate clearly that the referenced professional is a source of additional product information. 

---