Food and Drug Administration, HHS.
The Food and Drug Administration (FDA) is announcing the availability of a document entitled “Guidance for Industry: IRB Review of Stand-Alone HIPAA Authorizations Under FDA Regulations,” dated October 21, 2003. The guidance document provides clarification for institutional review boards (IRBs) of their responsibilities for reviewing and approving stand-alone authorizations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. A stand-alone HIPAA authorization is a document used to obtain permission from an individual for a covered entity to use and/or disclose the individual's identifiable health information for a research study and that is not combined with an informed consent document to participate in the research itself. This guidance is intended to encourage IRBs to permit enrollment of subjects in clinical investigations without the IRB's prior review and/or approval of stand-alone HIPAA authorizations, even under circumstances in which the IRB's written procedures require such review and/or approval. Because FDA has determined that prior public participation is not feasible or appropriate, this guidance document will be implemented upon posting on FDA's Web site.
Submit written or electronic comments on agency guidances at any time.
Submit written comments on the guidance document to the Division of Dockets Management (HFA-305), Food and Drug Administration, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
Submit electronic comments to http://www.fda.gov/dockets/ecomments. See the SUPPLEMENTARY INFORMATION section for electronic access to the guidance document.
Submit requests for the guidance document to the Division of Dockets Management at the address provided. Your request should include the docket number in the heading of this document.Start Further Info
FOR FURTHER INFORMATION CONTACT:
Catherine Lorraine, Office of the Commissioner (HF-11), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857, 301-827-3360.End Further Info End Preamble Start Supplemental Information
FDA is announcing the availability of a document entitled “Guidance for Industry: IRB Review of Stand-Alone HIPAA Authorizations Under FDA Regulations,” dated October 21, 2003. This guidance is similar to a guidance published by the Office of Civil Rights, Department of Health and Human Services (HHS), entitled “Privacy Guidance about Authorizations for Research and Institutional Review Boards,” which is available on the HHS Web site at http://www.hhs.gov/ocr/hipaa. (FDA has verified the Web site address, but is not responsible for subsequent changes to the Web site after this document publishes in the Federal Register.) The Privacy Rule is a Federal regulation implementing certain provisions of the HIPAA (Public Law 104-191), that protects the privacy of certain health information (see 45 CFR parts 160 and 164). The Privacy Rule is a comprehensive set of minimum requirements intended to safeguard individually identifiable health information while permitting important research and health care activities to continue. The Privacy Rule went into effect on April 14, 2003.
The Privacy Rule establishes the right of individuals, including research subjects, to authorize the use and disclosure of their protected health information by signing an authorization form for uses and disclosures not otherwise permitted by the Privacy Rule (see 45 CFR 164.508). For example, in the context of a clinical investigation, a valid and properly executed HIPAA authorization explains the ways in which a subject's protected health information will be used and disclosed by the clinical investigator and permits the clinical investigator to use and disclose that information as specifically described in the authorization. An HIPAA authorization is different than a subject's informed consent in that an HIPAA authorization focuses on uses and disclosures of information that may Start Printed Page 63111be made. Informed consent, on the other hand, apprises potential research subjects of the possible risks and benefits associated with participating in the clinical investigation and, when executed, indicates their willingness to participate in the clinical investigation and their understanding of those risks and benefits. The Privacy Rule permits but does not require clinical investigators to combine an HIPAA authorization with informed consent documents, known as a compound authorization (see 45 CFR 164.508(b)(3)).
FDA and the HHS Secretary received requests for clarification of IRBs' responsibilities to review and approve stand-alone HIPAA authorizations under the Privacy Rule, Federal regulations governing human subject protection and IRBs (see 45 CFR part 46 and parts 50 and 56 (21 CFR parts 50 and 56)), and international guidelines (see, for example, International Conference on Harmonisation (ICH) Good Clinical Practice guidelines (E6)). The requests expressed concern that when the Privacy Rule went into effect, clinical investigations might be impeded because IRBs would be backlogged with requests to review thousands of stand-alone HIPAA authorizations. The requests further stated that some IRBs would halt enrollment in clinical investigations pending their review of these stand-alone HIPAA authorizations.
In response, the Office of Civil Rights, HHS, issued a letter, dated April 15, 2003, clarifying that IRBs are not required to review and approve stand-alone HIPAA authorizations under the Privacy Rule, HHS Protection of Human Subjects Regulations at 45 CFR part 46, ICH guidelines, or FDA regulations, so long as an IRB's written procedures, adopted under § 56.108(a), do not require such review and approval. The letter also announced FDA's intent to publish guidance on this subject, in accordance with its good guidance practice regulations.
FDA is issuing this guidance to address those cases in which IRBs have adopted written procedures that would require them to review and approve stand-alone HIPAA authorizations. Under § 56.108(a), IRBs must follow their written procedures. The guidance announces FDA's intention to exercise ongoing enforcement discretion with respect to the requirements of § 56.108(a) to the extent that an IRB's written procedures require the review and/or approval of stand-alone HIPAA authorizations. FDA is exercising this discretion in order to encourage IRBs to permit the continued enrollment of subjects in clinical investigations without IRBs' prior review and approval of stand-alone HIPAA authorizations. FDA believes that enrollment in well-designed and well-conducted clinical investigations should not be interrupted for the purpose of IRB review and approval of stand-alone HIPAA authorizations. Accordingly, FDA does not intend to take enforcement actions against IRBs that decide not to review stand-alone HIPAA authorizations even though the IRB's written procedures would otherwise require this review and/or approval. FDA's exercise of enforcement discretion in these limited circumstances is intended to allow important studies to proceed in the best interests of the public health.
This guidance is being issued consistent with FDA's good guidance practices regulation § 10.115 (21 CFR 10.115). This guidance document represents the agency's current thinking on IRBs' responsibilities under FDA regulations for reviewing and approving stand-alone HIPAA authorizations. It does not create or confer any rights for or on any person and does not operate to bind FDA or the public. An alternative approach may be used if it satisfies the requirements of the applicable statutes and regulations.
FDA is issuing this document as a final guidance that will be implemented upon posting on FDA's Web site. In accordance with § 10.115(g)(2) and (g)(3), FDA is implementing this guidance prior to seeking public comment because the agency has determined that this guidance is needed in conjunction with the HHS Office of Civil Rights guidance to help ensure that ongoing clinical trials are not halted while IRBs review HIPAA stand-alone authorizations, and therefore, prior public participation is not feasible or appropriate. However, FDA will review comments received after issuance of the guidance and revise the document when appropriate.
Interested persons may, at any time, submit written or electronic comments to the Division of Dockets Management (see ADDRESSES) regarding this guidance document. Two paper copies of mailed comments are to be submitted, except individuals may submit one copy. Comments should be identified with the docket number found in the brackets in the heading of this document. A copy of the document and received comments are available for public examination in the Division of Dockets Management between 9 a.m. and 4 p.m., Monday through Friday.
III. Electronic AccessStart Signature
Dated: October 31, 2003.
Assistant Commissioner for Policy.
[FR Doc. 03-28044 Filed 11-6-03; 8:45 am]
BILLING CODE 4160-01-S