On January 25, 2013, the Federal Register published the Department of Health and Human Services omnibus amendments to the Health Insurance Portability and Accountability Act Privacy, Security, Enforcement, and Breach Notification Rules. These modifications also include the final versions of the HIPAA regulation amendments mandated by the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act. Although the amended rules were effective on March 26, 2013, covered entities and their business associates have a compliance (...) date of September 23, 2013.It has been 10 years since the April 14, 2003 compliance date for the original HIPAA Privacy Rule. Despite HHS’ clarification of some issues by posting answers to frequently asked questions, there have been no significant amendments to the Privacy Rule since 2003. (shrink)

On January 25, 2013, theFederal Registerpublished the Department of Health and Human Services omnibus amendments to the Health Insurance Portability and Accountability Act Privacy, Security, Enforcement, and Breach Notification Rules. These modifications also include the final versions of the HIPAA regulation amendments mandated by the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act. Although the amended rules were effective on March 26, 2013, covered entities and their business associates have a compliance date of (...) September 23, 2013.It has been 10 years since the April 14, 2003 compliance date for the original HIPAA Privacy Rule. Despite HHS’ clarification of some issues by posting answers to frequently asked questions, there have been no significant amendments to the Privacy Rule since 2003. (shrink)

Privacy is protected in biobank-based research in the US primarily by the Health Insurance Portability and Accountability Act Privacy Rule and the Federal Policy for Protection of Human Subjects. Neither rule, however, was created to function in the unique context of biobank research, and therefore neither applies to all biobank-based research. Not only is it challenging to determine when the HIPAA Privacy Rule or the Common Rule apply, but these laws apply different standards to protect privacy. In addition, many other (...) federal and state laws may be applicable to a particular biobank, researcher, or project. US law also does not directly address international sharing of data or specimens outside of the EU–US Safe Harbor Agreement, which only applies to receipt of data by certain US entities from EU countries, and is in the process of revision. Although new rules would help clarify privacy protections in biobanking, any implemented changes should be studied to determine the sufficiency of the protections as well as its ability to facilitate or hinder international collaborations. (shrink)

The predominant view is that a study using health data is observational research and should require individual consent unless it can be shown that gaining consent is impractical. But recent arguments have been made that citizens have an ethical obligation to share their health information for research purposes. In our view, this obligation is sufficient ground to expand the circumstances where secondary use research with identifiable health information is permitted without explicit subject consent. As such, for some studies the Institutional (...) Review Board/Research Ethics Committee review process should not assess the practicality of gaining consent for data use. Instead the review process should focus on assessing the public good of the research, public engagement and transparency. (shrink)