Healthcare Information Security

Patient Privacy News

Common Rule Interim Version Released, Exempts HIPAA Research

An interim version of the Common Rule was released, impacting availability of data for secondary research such as research conducted by HIPAA covered entities.

hipaa research interim common rule

Source: Thinkstock

By Elizabeth Snell

- More secondary research of EHR data will be enabled through the recently announced interim version of the Federal Policy for the Protection of Human Subjects, or the Common Rule. Certain low-risk studies, such as observational studies meant to find patterns in patient records to improve how joint replacements are performed, that are conducted by HIPAA covered entities will be exempted.

Sixteen federal agencies and departments, including the Department of Health and Human Services (HHS), will be affected by the interim rule.

The effective date and the general compliance date of the 2018 Common Rule requirements will be delayed until July 19, 2018 under the interim rule. Prior to that date, regulated entities must comply with the pre-2018 requirement.

The American Medical Informatics Association had previously stated it wanted to delay the final version of the Common Rule.

The delay with the interim rule “will allow federal officials and the clinical research community to develop a coordinated implementation strategy and much-needed guidance,” AMIA President and CEO Douglas B. Fridsma, MD, PhD, FACP, FACMI said in a statement.

READ MORE: Data Security Considerations in Healthcare Interoperability

“It will be important that Common Rule provisions meant to improve the availability of data for secondary research, while strengthening protections for research participants proceed in a timely fashion,” Fridsma added.

The interim Rule also acknowledged the need for extra time, as it would allow entities a better opportunity to ensure proper implementation and compliance.

“Without a delay, and without guidance, institutions that have expected a delay who hastily attempt to implement the revised rule without adequate preparation are bound to make mistakes, the consequences of which may jeopardize the proper conduct of research and the safety and wellbeing of human subjects,” the Rule states. “At this point, it is impracticable to gather comments on an implementation delay prior to January 19, 2018, the scheduled effective date of the 2018 Requirements.”

Updating the Common Rule will strengthen protections for individuals who volunteer to participate in research. At the same time, administrative burdens will not be added, particularly with regard to low-risk research.

Fridsma pointed out in his most recent statement that the 2018 requirements have several key changes that will benefit research subjects and regulated entities.

READ MORE: Benefits, Challenges of Secure Healthcare Data Sharing

For example, researchers can seek broad consent for secondary research. This will “improve the availability of biospecimens and patient-reported data (including real-time data from mobile applications and devices),” he said.

Certain low-risk studies conducted by HIPAA covered entities will also be exempt, which will allow more secondary research of EHR data.

The spread of disease could also be more easily monitored, AMIA noted. Certain public health surveillance activities are outside the scope of the Common Rule, according to the 2018 requirements.

Changes were also made to the consent requirement, stating that study information must be described so a “reasonable person” could understand it.

HHS explained in a January 2018 statement on the interim rule that “it is permissible to incorporate these new elements of consent now because the pre-2018 rule does not prohibit including these elements in informed consent.”

READ MORE: Understanding HIPAA Data Sharing Policies for Better Patient Care

“An example of a revised provision that conflicts with the pre-2018 rule, and thus could not be implemented prior to July 19, 2018, is the provision eliminating the requirement for continuing review in certain circumstances,” HHS said. “Because the pre-2018 regulations require continuing review at least annually for all ongoing non-exempt human subjects research, halting continuing review for such research before that date would be considered non-compliance.”

HHS added that the compliance date for the cooperative research provision of the revised Common Rule will still be January 20, 2020.

Several organizations had requested a delay in the finalized Common Rule. The Associated of American Medical Colleges (AAMC), the Association of American Universities, the Association of Public and Land Grant Universities, and the Council on Government Relations wrote a letter to the HHS Director of the Office for Human Research Protections Jerry Menikoff, MD, JD in June 2017.

The groups stressed that there was too much uncertainty surrounding the final rule, and that institutions needed adequate time to ensure compliance.

“We believe that such a delay in the compliance date of the Common Rule will be beneficial for all affected institutions and relevant agencies,” the letter said. “Importantly, this time could be used to advance harmonization efforts to align the FDA’s human subject protection regulations with the Common Rule as required by the 21st Century Cures Act.”

AMIA also submitted a letter to HHS’ Menikoff in June 2017, maintaining that the final changes “reflect the kind of transparent, deliberate, and constructive process we all seek in government regulation.”

“This process, which began more than five years ago and is meant to advance clinical research in the United States for years to come, must be carried through to completion,” AMIA wrote. 


SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
Data Breaches

Our privacy policy

no, thanks

Continue to site...