When the HIPAA Omnibus Rule went into effect in 2013, it brought some interesting changes involving liability where covered entities and their business associates were concerned. The Omnibus Rule also brought some changes to the requirements for using PHI in medical research. Here is an overview of HIPAA Omnibus and what it means for researchers.
The American Health Information Management Association (AHIMA) provides more detail on authorizations concerning the use of PHI here.
The above changes brought about by Omnibus simplify the process of using PHI for research. Compound authorization and the ability to include future studies with the initial authorization results in fewer forms for patients and companies to deal with. Easier access to the PHI of deceased individuals provides further data for studies. Ultimately, the new process is more efficient, allowing researchers to focus on finding new cures and treatments for the diseases the world is facing. For more information about how HIPAA and research are related, Johns Hopkins University has a helpful FAQ page.
These changes to HIPAA regarding research may just be the beginning. A bill moving through Congress includes some elements that would require further revisions to HIPAA. The 21st Century Cures Act passed in the House of Representatives but the Senate decided not to take up the bill. However, according to a recent Bloomberg Government article, the "Senate Health, Education, Labor and Pensions Committee recently approved 19 bills as part of a package that will be assembled into a companion to the 21st Century Cures Act passed by the House last year." For more on the act, Marianne Kolbasuk McGee of InfoRisk Today summarizes some of the research implications of the act here, while David Richardson of Managed Health gives a broader summary of it here.
The HHS guidelines for research remind companies that only PHI that has not been De-identified in compliance with HIPAA standards is subject to the rules. HIPAA is quite expansive in its coverage of the healthcare industry, and it is good that Omnibus provided some changes for multiple areas, including research. Hopefully, any new regulations will continue to balance patient privacy with the medical community's efforts to combat and cure all illness.