Then she says, de-identification renders resulting data useless and is a burden to covered entities, and I think we've already come up with a recommendation dealing with de-identified information. So unless there is objection, I'll move to the next one.

She says, let the IRB determine when a dataset is sufficiently de-identified by taking into account the relevant circumstances of each project, and this is really a combination of the IRB recommendation and the de-identification recommendation, both of which we've already considered.

So without objection, I'll move on to her last one, which is to rely on written assurances from investigators for denying inappropriate secondary use. Does anyone recall from her testimony the specifics of this recommendation?

Or how she would envision these written assurances to actually work in practice?

HORLICK (ph): You know, I have her testimony in front of me and I'm not just seeing that, but - not something I've highlighted.

ROTHSTEIN: I think basically what she is going to, is to give - I mean, this goes back to the authority of the IRB to rule on the appropriateness of the investigator's conduct, and for the IRB, basically, to require written assurances in lieu of or instead of the procedures set forth in the privacy room. Is someone - is there anyone else who reads that differently than my interpretation?

So if I'm correct, then this is a recommendation to rely more extensively on IRBs for regulation, as opposed to the rule, which we already decided not to pursue. Does anyone want to bring anything forward with regards to this last one?

Hearing no recommendations, I move onto Robert Klepensky (ph) from Netronic (ph). All of these recommendations relate to the FDA, and it's relationship to HIPPA.

He said that, "FDA research rules require examining actual patient charts to make sure that adverse drug effects are reported on the case reports. That the FDA may ask for the location of every implantable device, for example, and therefore they would need patient identification information. The authorization for past, present, and future records such as for post-market surveillance is needed and it's of unlimited duration."

"PMA supplements require this data. Early research requires patients be identified, that is, assume that this is a research cohort, with various syndromes that they need to identify, so that they can recruit body of subjects." He goes on, "The post-market issues must be researched" I'm not sure what techniques means - "and send the related problem in education of the hospitals" - is that lack of education among hospital staff is a problem. "And finally, that we need more specificity of what data are required for FDA regulations for PM issues. The privacy will increase the awareness of covered entity rights to not release PHI."

So we have a whole body of recommendations, all that are related to the FDA and as I read this testimony as I recall it, his concern was that there was a conflict between what the FDA requires in terms of very detailed information and what the privacy rule may prevent researchers from obtaining. And in addition, he was concerned that the privacy rule would interfere with research both from the front end, in terms of recruiting potential subjects, to the backend in following up possible adverse drug effects.

So, I think, that's a fair summary of his general points and before I take up the specific recommendations he has, anybody have any comment on his testimony?

SIMON (ph): Well Mark, I - maybe I'll jump in. This is Simon (ph). I actually, am not sure I want you to take up this specific testimony, but I do think he has an issue around post-marketing surveillance. I'm not - I'm not sure that I know exactly how to phrase it and I don't know whether - which of these points are the ones, but I think there is an issue, and I think we need to bring it to the secretary's attention.

ROTHSTEIN: Well, let me ask, Gail (ph), we had earlier flagged an issue related to the FDA that was raised by Bernice Wells (ph). How did - how was our recommendation? Do you have that language that we sort of agreed to tentatively?

HORLICK (ph): Not - I mean, OK, the recommendation was - no. Actually, it says, "we recommend that the existing language of the rule be replaced with language which allows disclosure of protected health information to conduct post-marketing surveillance using procedures and formats for registries and reports that do not identify patients by name or with identifiers such as address, phone number or email address."

And what I had written down is that we sort of recommend that the office of Civil Rights revisit that issue and clarify the provisions and, if appropriate, amend the provisions to facilitate the tracking of adverse drug reaction.

ROTHSTEIN: OK.

HORLICK (ph): So, I mean - you know, I mean I'd have to work on the language.

ROTHSTEIN: Sure. No, the reason I'd ask to raise that was to see whether what we'd already agreed on was broad enough to cover our concerns here or ...

HORLICK (ph): Right.

ROTHSTEIN: ... whether we needed to expand on that. Simon (ph), did you have any thoughts?

SIMON (ph): Well, it sounds like we just need a minor expansion to -

HORLICK (ph): Right. That's what I -

SIMON (ph): - what we put, I mean this is not adverse drug events.

HORLICK (ph): Right it's just ...

SIMON: Marketing surveillance. But other than that it sounds like it's the same sort of thing, and we just need to add that as a additional parenthetical.

ROTHSTEIN: Yes, so maybe what we need to do is tack on to what we already agreed was an issue that in the context of research we need to consider the relationship between FDA requirements and HIPPA requirements as well as, I mean - I mean, throughout the process from initially identifying the cohorts for research through the post-marketing surveillance for adverse drug reactions.

HORLICK (ph): Is John Fanning (ph) on the call?

ROTHSTEIN: He was.

JOHN FANNING (ph): John Fanning is here.

HORLICK (ph): OK. John, I remember having some hallway discussion with you, and I don't know if it was on this topic but - I mean, I guess what would be important is to know how FDA is - what their reaction is to these, you know, to the final rule and whether they themselves see problems.

FANNING (ph): Yes. You know I don't think the committee can say anything definitive involving a precise reading of the regulation and so on. But, you know, it might be helpful just to say, this appears to have raised an issue, and we think it's important to - that these programs not be impaired or whatever. Does that - does that seem appropriate?

ROTHSTEIN: Yes, it does to me, John (ph).

FANNING (ph): That was sort of Simon's (ph) point I think.

ROTHSTEIN: Yes.

FANNING (ph): But I don't think there's any point to an independent legal reading by the committee as to the exact scope of allowable disclosure under the public health provision.

ROTHSTEIN: Right, I mean, to come up with any informed recommendation on this, we certainly would need to consult with the FDA and probably with a variety of other sources. I know there is some frustration on the part of OCR that many of our recommendations are in the form of - well that they need to do further research or clarification or whatever.

But I think it would be probably inappropriate and maybe even foolhardy for us to pre-judge how these issues are going to come out and we do, I think, a service by merely raising them.

RICHARD (ph): Well, that's the way I look at it.

HORLICK (ph): Well, just so I'm clear, what we recommended earlier is that they, you know, revisit and clarify and if appropriate amend provisions to facilitate the tracking of adverse drug reactions. Now that could be even given as an example, so maybe what we're talking about is to facilitate. I'm looking for the first part before you would say and ...

ROTHSTEIN: Well, I think what we want to do is to harmonize the requirements of FDA with HIPPA, so that we protect privacy at the same time that we support research and we support ongoing surveillance of adverse drug effects, et cetera. So I - what I think I heard Simon (ph) suggesting, and correct me if I'm wrong, is that the whole area of FDA and the privacy rule needs to be taken up.

And we want to make sure that there are no unintended consequences and impeding of the FDA doing its job, or researchers complying with the letter and spirit of the FDA.

FANNING (ph): Not just researchers.

ROTHSTEIN: Right. That's right.

FANNING (ph): It's sort of - a kind of research commanded or encouraged in order to track down the behavior of a product.

ROTHSTEIN: Yes.

FANNING (ph): Yes.

ROTHSTEIN: So is it - is - would - and of course what we're agreeing to if we do on this is just a concept, I mean we've got - we will have ample time to take a look at the - at the language in the future. But is everyone comfortable on at least sort of the principle here?

OK, I think that takes care of Klepensky (ph). And now we're ready to move on to Julianne Pollock's (ph) comments and you would recall she's - she was from Johns Hopkins. And she had several issues to, for us to consider.

She said that we should weigh the privacy protection against the burden on the research institution, which is - and in particular, she was concerned about the right to an accounting of disclosures of PHI for six years prior to the request and the effect that that would have on an institution. She's concerned about the issue of recruitment of subjects in reviews preparatory to research. She said that the section on reviews preparatory to research does not clearly permit recruitment because PHI must be taken off the covered entities premises.

And she raised the issue of, how can a researcher contact subjects to obtain their approval for research. She raised the issue of public health purposes, although not in the - in the governmental public health sense. But she said that disease registries cannot operate without individual authorization. And from my recollection she was talking about the kinds of registries put together by disease organizations like the Diabetes Foundation and so forth.

And she said we should arrange to have the IRB give a waiver to the registry authorities, but where is the research project for appropriate disclosure of the public health - of the private health information to the registry and get written assurance for the appropriate use of public health - I'm sorry, private health information from the registry.

She also had a comment on fund raising, which we're going to take up, so I'll ask you to defer that. We're going to take up fund raising in the context of marketing. She went on to talk about the permissible use of PHI, recommending to amend the regulation to permit the release of name of the place or the person which treated the patient.

I guess, this is under fundraising, I'm sorry. And then she said, "When researchers give information on cancer registry they consider data that should be de-identified. But probably not according to the 18 criteria that we talked about earlier, and going through an IRB of many hospitals would be burdensome, for example, the American Heart Association to get data on the effect of diet on heart disease.

So let's go back now to some of her specifics and the first specific that I see in her recommendations is - deals with the alleged burden of the accounting of disclosures of PHR for six years prior to the request, which of course is in the rule. Any comments from the subcommittee members or staff?

FANNING (ph): This is John Fanning (ph). You know, a right to know who has seen your record is a pretty basic feature, a fair information practice. I just make that observation and it's - the Federal Privacy Act, for example, requires it.

ROTHSTEIN: Right. And I suppose this recommendation really goes to the heart of one of the key principles of the rule. Right of access, right to know whose seen your information.

So is there anyone who wants to bring this recommendation forward? Hearing no champions we'll go to the next one.

Dealing with the recruitment of the subjects, she says that the review - sectional reviews preparatory to research does not clearly permit recruitment and interferes with recruitment. Comments?

MARJORIE: Is this as an issue or isn't it?

ROTHSTEIN: Well, let me go - go to the actual reg. itself. It deals with the waiver of authorization requirement and I'm - it would be in section 164.5-12 (ph).

Let's see, reviews preparatory to research - the covered - the covered - let's see. A covered entity may use or disclose protected health information for research regardless of the source of funding of the research provided that an institutional board or a privacy board does the following: the covered entity obtains from the researcher representations that use or disclosure (INAUDIBLE) to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research.

And then it goes on, no protected health information is to be removed from the covered entity by the researcher and the protected health information for which us or access aside (ph) is necessary for the research purposes. And I think she's concerned about the - she said the reg. does not clearly permit recruitment because the protected health information cannot be taken off the covered entity's premises.

MARJORIE: Yes, but I don't understand the - but, I mean, I'm wondering if this requires clarification or something because, I mean, it obviously wouldn't be a good thing if you couldn't recruit subjects.

ROTHSTEIN: I think we certainly could recommend clarification on the issue of both recruitment of subjects and the compilation of disease registries, which is the next point that she raises, and so we might want to recommend that the OCR clarify this and we might also want to add some language, as Marjorie (ph) suggests, that we - that OCR's clarification will reflect our concern that research, recruitment of subjects not be impeded, while at the same time protecting the confidentiality of PHI.

MARJORIE: Yes, may I make an observation?

ROTHSTEIN: Please.

MARJORIE: She seemed to be concerned that you couldn't go out and recruit subjects, in other words, a situation where you wanted to enroll people in a clinical trial or to find out what the present state of health, let's say, is. However, isn't that exactly the kind of thing that ought to be reviewed by an IRB?

That actually is the beginning of the conduct of the research, and I'm not sure it would be a good to thing to let that get out from under the standard review.

HORLICK (ph): Mark, this is Gail (ph). In her testimony at the end, trying to listen and read it at the same time, but she said the proposal is, Hopkins believes that the better option is to clarify 164512 and so forth. Reviews preparatory to research to include the use of protected health information to identify research subjects and disclosure of protected health information to that subject to contact them regarding possible participation in that research. If the protocol is approved by the IRB of - or privacy board.

We believe this is a workable solution and involves contact of the subject only after the research is found to be worthy of approval under all applicable criteria.

FANNING (ph): So - this is John Fanning (ph). So what's the issue? Yes.

HORLICK (ph): I mean, that's why I was trying to listen to the discussion and then read what she was specifically proposing so that then we would - could discuss that or not.

ROTHSTEIN: Is it her assumption, am I right that she is assuming that even if the IRB approves this, that it still would not - that is contacting individuals to invite them to participate, that that would not be permitted under the - under the current rule?

HORLICK (ph): The first paragraph of her issue is the regulations do not allow providers without an authorization or prior permission to use protected health information, such as the patient's diagnosis, or the department where the patient was seen, to contact a prior patient for possible recruitment for participation in clinical trial. The only exception would be if the clinical trial related to the treatment of the individual. And then she's got sort of, two more paragraphs, you know, explaining it all.

I'm not really that familiar with the new ones.

ROTHSTEIN: Well I think at the very least, we ought to recommend clarification on the issue of recruitment of participants in clinical research and ...

HORLICK (ph): What - I want to make sure I understand - I guess I can read this, but what the issue is, that we are requesting clarification on.

ROTHSTEIN: Well, the issue is the extent to which even IRB approved research and researchers pursuant to an IRB approved protocol could get access to PHI for the purposes of recruiting possible participants?

FYFFE (ph): Yes, this is Kathleen Fyffe (ph). I think you outlined the issue and actually there's a kind of a red flag that, you know, is raised in my mind if I try to put my self in the shoes of the researchers. I think we need to discuss this a little bit more and I'd be eager to hear what other folks from the call think about this topic.

HORLICK (ph): Yes, I just am - there's something, I'm not getting with it. I don't know.

FYFFE (ph): Simon (ph), do you have any thing on this?

HORLICK (ph): Does that mean, when they have - an IRB has approved the protocol, so they can go forward and then it's the contacting the people. I mean is that we're talking about (ph)?

ROTHSTEIN: Yes, she's claiming - Joanne Pollock (ph) that that's not enough.

HORLICK (ph): Well that's what I don't - OK. So, that's what she's saying? That if a researcher proposes some type of study and it goes to an IRB and the IRB approves, you know, says you can do this research, then more have to be done, and then you still need the authorization or permission.

SUE MCANDREW (ph): This is Sue McAndrew (ph). I'm sorry, I just joined the call late - joined the call late.

ROTHSTEIN: Thank you, just in time.

SCHWARTZ (ph): And by the way, speaking of just in time, this is Paul Schwartz (ph). Unfortunately, I have to go teach. So at this very interesting moment, I have to bow out right now.

ROTHSTEIN: OK.

SCHWARTZ (ph): Bye-bye.

MCANDREW (ph): I think that the issue arises because the general assumption, at least with regard to clinical trials, was that they would not be qualifying for an IRB labor because there would be the informed consent process for the trial itself and that presented an opportunity to get the individuals signed authorization for the use of the information.

However, I think, while what was the general operating assumption, that the IRB waiver process may well apply to this recruitment stage of the process where the study has gone to the IRB, they have approved the protocol, part of that protocol would address how participants would be selected and in this state how they may be contacted or approached.

And if the - and if those procedures involve - justify contacting the individual without his permission by the researcher as opposed to the docs., it would seem to me that that would be a legitimate use of the IRB waiver process, but that we really did not expect the actual contact with the individual to occur under the research procedures. The identification may occur under those procedures but the actual contact should await an IRB approval at least, or be done through the docs.

FANNING (ph): Can I make an observation about contacting people? On two occasions we've had to fight off proposals to strongly limit contact or forbid the contact without, for example, the permission of the last person who had a record about the person. One of the very few privacy horror stories in the policy literature is a re-contact horror story. So I think you might want to be wary about anything that would short circuit the IRB process when contacting people.

ROTHSTEIN: So let me see if I have the issue correct, and please step in if I have this wrong. The issue is whether any initial contact is permissible without prior IRB approval, even where the initial contact is only for recruitment purposes. Is that right?

FYFFE (ph): I think that sounds like the issue, this is Kathleen (ph).

FANNING (ph): Yes.

ROTHSTEIN: And I mean that has been the way the world of research works well before the privacy rule.

FANNING (ph): What, you go to the IRB?

ROTHSTEIN: Yes.

MCANDREW (ph): See if you can go to the person.

ROTHSTEIN: Right.

HORLICK (ph): Well that's what I'm not understanding. Isn't that's the way it goes? You go to the IRB first?

ROTHSTEIN: Right, you don't start beating the bushes and then ...

HORLICK (ph): Right, so that's - that's what I guess I was having so much trouble with. I thought I wasn't understanding it right. The way it normally works is you'd have to get the protocol approved before you would do the initial contact, I thought.

ROTHSTEIN: Right.

HORLICK (ph): OK.

ROTHSTEIN: So I suppose and Sue (ph), correct me if I'm wrong, that what they are seeking is basically a regulatory waiver of the need to go through the IRB first in order to use PHI. Is that right?

MCANDREW (ph): In the extreme, although it may just be the need to clarify that the - that you can go to the IRB and make these contacts even in a clinical trial setting without first getting the individual's authorization.

ROTHSTEIN: OK. So, I think - I mean I would support a recommendation - excuse me - to clarify the provisions regarding IRB, and the role IRBs in the recruitment of subjects and its relationship to the privacy rule.

MARJORIE: Yes, without making it any, you know, without making any easier to contact them.

ROTHSTEIN: Right, and we may, if the committee - subcommittee and eventually the committee so decides, where (ph) to add language, but in no event should we - would we support a weakening of the protections currently in place pursuant to the common rule. What do the members of the subcommittee think about this?

FYFFE (ph): I agree with you Mark, Kathleen (ph).

RICHARD (ph): Yes, sounds good.

ROTHSTEIN: OK Gail (ph) are you ...

HORLICK (ph): I think so but ...

MARJORIE: And is John Fanning (ph) so ...

HORLICK (ph): I think I've got the recommendation and I may need some - you know I've to go back and read it when I try to sell it out.