Skip Page Banner  
Skip Navigation

Breach of Privacy Risks for Clinical Research Sponsors, Contributed by Jill E. Anderson, Moses & Singer LLP

Tuesday, October 25, 2011

Although sponsors generally are not considered “covered entities” under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), they are increasingly exposed to privacy liability risks through their use of clinical research data or tissue samples obtained from clinical research subjects as part of the trial.1 These risks result primarily from the sponsor’s review and approval of the content of the informed consent form (ICF) and from the sponsor’s representations and warranties in the clinical research agreement with an institution.2 However, there are several steps a sponsor should take to minimize its liability when receiving tissue samples or associated study subject data resulting from clinical research. In addition to increasing our understanding about the effectiveness of new interventions, clinical research provides researchers with the opportunity to perform additional research. These additional research studies may use data from a databank or samples from a tissue bank for future clinical research uses.3 For example, the molecular characteristics of tissue samples might be analyzed after the clinical trial is completed to determine if there is a relationship between the amount of a specific protein in the study subjects’ tissue and how that study’s subjects responded to the study drug they received. Information obtained from these correlative studies could lead to more accurate predictions about how individual patients will respond to certain treatments, improved ways of detecting the disease earlier, new methods of identifying people who have an increased risk of the disease, and new approaches to prevent the disease.4

Privacy Rule v. Common Rule

The U.S. Department of Health and Human Services (HHS) has interpreted5 the Privacy Rule under HIPAA to prohibit blanket or broad research Authorizations6 for "nonspecific research" or "future, unspecified projects" and requires that Authorizations be study-specific for purposes of complying with the Privacy Rule’s requirement that an authorization must include a description of each purpose of the requested use or disclosure.7 This means that the description cannot be so broad as to encompass future unspecified clinical research. HHS has stated that this interpretation addresses its concern that study subjects lack necessary information about the future research to make an informed decision about whether to participate in such future research. In other words, under HIPAA, researchers and institutions cannot ask study subjects to agree to include their information or tissue samples in databanks or tissue banks that would be used to support future, unspecified research. The Privacy Rule allows study subject data to be disclosed for future research purposes if the researcher obtains a separate Authorization, an IRB-approved Waiver of Authorization, or uses a limited data set.8 In addition, institutions and researchers may de-identify PHI according to standards set forth in the Privacy Rule.9 The federal Common Rule, however, does permit informed consent for future research activities, so long as the future uses are described in sufficient detail to allow an informed consent. 10 As a result of HHS’s current interpretation, institutions that agree with HHS’s interpretation of the Privacy Rule often limit a sponsor’s right to use and disclose study subject data so that it is consistent with the institution’s obligations under both the Common Rule and the Privacy Rule. In general, the effect is that institutions often contractually limit a sponsor’s use of study subject data to purposes related to the clinical research and compliance with applicable law, thereby prohibiting the sponsor from using tissue samples or associated study subject data for future, unspecified research. HHS issued a much anticipated Notice of Proposed Rulemaking (NPRM) in July, 2010 soliciting comments on modifications to the Privacy Rule, including whether to modify its existing interpretations of the Privacy Rule that require an Authorization for the use or disclosure of protected health information (PHI) for clinical research to be study-specific.11 HHS stated that part of its rationale for considering revising its interpretation of this requirement is the fact that, in accordance with the Common Rule, many institutional review boards (IRBs) approve informed consents that allow future research on study subjects’ PHI or tissue samples. In addition, HHS noted that the Institute of Medicine and the Secretary’s Advisory Committee on Human Research Protections have “have urged the department to allow the HIPAA authorization to permit future research use and disclosure of protected health information or, at a minimum, for the department to modify its interpretation to allow the authorization to encompass certain future use and disclosure of protected health information for research, provided certain parameters are met.” As a result, there is conflict if the Authorization does not allow future research. Revising the Privacy Rule to allow an Authorization for future use and disclosure of study subjects’ PHI would obviously create consistency between the Privacy Rule and Common Rule. Since the NPRM comment period closed on September 13, 2010, HHS will review the comments received and publish a final rule. There is no formal time frame for the publication of the final rule. The NPRM includes the stated assumption that the final rule will be effective 30 days after its publication, with compliance generally expected 180 days after the rule’s finalization.12

The Havasupai Case

Several court cases demonstrate the potential liabilities researchers and institutions may face for conducting future research on tissue samples where the Authorization failed to specifically state such research purposes. While these cases did not involve sponsors’ use of tissue samples or data, liability could be imputed to sponsors in similar situations where the sponsor is responsible for developing and approving the content of the ICF. In one well-publicized case, members of the Havasupai tribe donated blood samples to researchers at Arizona State University (ASU) for research related to the tribe’s diabetes epidemic.13 The researchers then used the blood samples and associated data for additional research. In addition to research on schizophrenia and inbreeding, the researchers used the samples and data to demonstrate that the tribe’s ancestors crossed the frozen Bering Straits into North America, a concept contradictory to the Havasupai belief that the retreat of waters from a global flood carved the Grand Canyon, and that the Grand Canyon is the birthplace of the human race. The Havasupai donors contend they would not have consented to the use of their samples for the additional research. The parties entered into a settlement agreement, which included a requirement that ASU pay $700,000 to members of the Havasupai tribe, return all blood samples in its possession, and return documents such as lab books and genealogy materials containing research derived from the blood samples. The Havasupai case brings to light the importance of respecting personal, religious, and culturally held beliefs and traditions in conducting research involving tissue samples. Sponsors should consider the religious, cultural and personal beliefs and traditions of the study subjects and the study subjects’ community when planning future research that will include collection of tissue samples. In addition, the ICF should state whether research participation could benefit or potentially negatively impact study subjects’ families and communities. For example, the ICF should indicate if there is a risk of stigmatization and discrimination based on research results.

Recommendations for Sponsors

There are several steps sponsors can take to keep study subjects appropriately informed, including making sure the ICF describes what types of data will be collected and how the data will be used and stored. Where applicable, the ICF should state whether identifiable or coded information will be maintained in the tissue bank or databank and if research results will be linked to other data about the human research participant, such as clinical data obtained from anatomic pathology and clinical pathology laboratory information systems and cancer registries. If longitudinal data will be collected by accessing the participant’s medical records, the ICF should clearly state so.14 The ICF also should describe whether the tissue samples and/or the data associated with or derived from tissue samples will be shared with other researchers and, if so, the oversight mechanisms for such sharing.15 The ICF may include an option that allows study subjects to select whether they would be willing to be re-contacted about the use of their tissue samples and/or data for future research studies. If possible, the ICF should specify how the study subjects’ contributed tissue samples will be used and provide study subjects with greater specificity about secondary research.16 If the purpose of the tissue bank is to provide tissue samples for a broad range of research, generalizing the type of research that will be conducted may be burdensome and uninformative to the research subjects. Examples of language related to specific future research in an Authorization include:17 • My tissue may be kept for use in research to learn about, prevent, or treat cancer. • My tissue may be kept for use in secondary research to learn about, prevent, or treat other health problems; e.g., diabetes, Alzheimer’s disease, or heart disease. • My tissue may be associated with my medical record and history. • I am willing to be contacted about future research studies. Sponsors should work together with institutions and researchers to develop the ICF to ensure all parties have the same understanding about how tissue samples and associated data will be used. The individuals responsible for negotiating the clinical research agreement and consent on behalf of the sponsor should freely communicate with researchers at both the sponsor and institution to ensure all parties are on the same page regarding use of the data. Contractually, the sponsor and institution should agree on how the data may be used and include in the clinical research agreement specific terms regarding such use. Sponsors should be particularly cautious about agreeing to language that limits use of tissue samples and associated data or specifies that the sponsor will comply with HIPAA. Sponsors are well advised to work with their legal counsel to develop alternative language. Study subjects deciding whether to contribute tissue samples for research should understand how their tissue may be used in the future, including any potential anonymous use. The ICF should disclose whether tissue samples may, at some point, be anonymized and subsequently used for secondary research purposes beyond those described in the original ICF. The benefit of stored tissue samples and associated data for future testing is invaluable. As new research questions arise, it cannot be predicted which tests will need to be conducted on the stored data or tissue samples in the future. However, sponsors, researchers, and institutions will need to work closely together to determine all possible future research that may be conducted on tissue samples or associated data. An ICF should specify the types of testing that may be performed, such as testing for infectious diseases, testing for biomarkers of disease, and performing genetic studies, in order to provide a guide to study subjects of the types of research issues that their tissue samples and associated data may help to address. Jill E. Anderson is Counsel to Moses & Singer LLP’s Healthcare practice, where she counsels a variety of entities in the healthcare industry, including sponsors, on issues relevant to clinical research. For more information on this topic, please contact Jill at or 212-554-7836. To learn more about Moses & Singer, please visit
DisclaimerThis document and any discussions set forth herein are for informational purposes only, and should not be construed as legal advice, which has to be addressed to particular facts and circumstances involved in any given situation. Review or use of the document and any discussions does not create an attorney-client relationship with the author or publisher. To the extent that this document may contain suggested provisions, they will require modification to suit a particular transaction, jurisdiction or situation. Please consult with an attorney with the appropriate level of experience if you have any questions. Any tax information contained in the document or discussions is not intended to be used, and cannot be used, for purposes of avoiding penalties imposed under the United States Internal Revenue Code. Any opinions expressed are those of the author. The Bureau of National Affairs, Inc. and its affiliated entities do not take responsibility for the content in this document or discussions and do not make any representation or warranty as to their completeness or accuracy.©2014 The Bureau of National Affairs, Inc. All rights reserved. Bloomberg Law Reports ® is a registered trademark and service mark of The Bureau of National Affairs, Inc.

To view additional stories from Bloomberg Law® request a demo now