I am surprised at the articles written about the 21st Century Cures Act (the “Cures Act”), which overwhelmingly passed the House of Representative last week. The main bullet points in most blogs center on the amount of money to fund NIH research and the speeding up of the FDA process for approving new drugs — some highlight the focus on the interoperability of health information technology for precision medicine.

Sure those things are big, but why is no one mentioning the potential expansion of the ability (but not the requirement) for covered entities and their business associates to share information for research purposes by defining health data research as part of healthcare operations?

This article, by Clearwater CFO Mary Chaput, was originally featured on GovernmentHealthIT.com

PHI sharing is a good thing

Here’s the rub: the Health and Human Services Secretary would be directed to “allow the use and disclosure of protected health information by a covered entity for research purposes,” according to the bill.

While regulations already define research as “a systematic investigation, including development, testing and evaluation designed to develop or contribute to generalizable knowledge,” in practice definitions may vary and that means generalizable knowledge is knowledge that could be applied to populations outside of the population served by the covered entity.

This is fantastic! Under current regulations, covered entities need to get individual authorization or an IRB waiver to use health data for research, and to publish the findings of their studies outside the walls of the institution or organization. By including “data research” in the definition of healthcare operations, covered entities (or their business associates providing those health care operations) would be able to use, and if they choose, to share health data with other hospitals or other health plans without those individual authorizations or IRB waiver.

“Because obtaining authorizations from huge numbers of people or obtaining an IRB waiver ranges from impracticable to impossible, important research has gone undone and important findings unshared,” as long-time policy wonk in the conduct and regulatory oversight of clinical research Doug Peddicord put it.

Oh yes, there are limitations to that proposed sharing of health information.

The disclosure may be made by the covered entity to only: another covered entity for health care operations; a business associate that has entered into a Business Associate contract with a disclosing covered entity to perform health care operations; or a business associate that has entered into a contract for the purpose of data aggregation, the Cures Act states.

Additionally, the Cures Act would allow covered entities to disclose PHI for research as they currently do for public health purposes by including research activities related to the quality, safety or effectiveness of a product or activity regulated by the FDA in the definition of public health activities and by removing the limitation of remuneration of the sale of PHI above the “reasonable cost-based fee to cover the cost to prepare and transmit the PHI for research purposes.”

Huge benefits to science and sufferers alike

In addition to the benefits of this availability of data for those with serious diseases, this section will provide real incentives for those covered entities and business associates involved in big data activities to participate in research activities.

The Cures Act would also allow PHI is to be accessed remotely from the covered entity by the researcher as long as appropriate security and privacy safeguards are maintained and that the PHI is not copied or otherwise retained by the researcher bringing the methodology for record review “preparatory to research” into the 21st Century.

Protective measures

Finally, the Cures Act would allow for a single authorization (vs. study specific) from an individual for future research purposes as long as the authorization makes clear that the PHI could be used or disclosed for such purposes and expiration or revocation of that authorization is clearly defined.

Well, the House bill has moved onto the Senate where it may be “matched” by the Innovation for Healthier Americans Act, a Lamar Alexander endeavor. And it is important to note that none of these changes of the 21st Century Cures bill will take effect unless and until the Senate passes its own legislation, and includes the HIPAA provisions. But an important precedent has been established: an openness to revising HIPAA standards in order to facilitate greater use of health information for research purposes.

As Dr. Peddicord gushes “What the House has proposed represents great news for patients awaiting cures for diseases.”

This article was originally featured on GovernmentHealthIT.com

Mary Chaput

CFO & Chief Compliance Officer at Clearwater Compliance
Mary has 35 years of international and domestic business experience spanning the healthcare, information services, manufacturing and venture capital consulting industries.She is Clearwater’s CFO and Compliance Officer. As an experienced corporate CFO and risk manager, Mary works actively with customers and prospects to identify and prioritize their risks and to develop effective remediation plans within their budgets.