Appendix E: HIPAA's compound authorization requirements elevate form over substance, confuse subjects, and diminish the informed nature of their consent and authorization

Under the Privacy Rule, a research authorization form can only be combined with another "type of written permission for the same research study, including another authorization for the use or disclosure of protected health information for such research or a consent to participate in such research." Assuming the Department accepts SACHRP's recommendation to permit authorization of certain future uses, it should be clarified that such an authorization could be combined with authorization for the primary data or tissue collection study without violating HIPAA's compound authorization Rules. In other words, such authorization of future uses should be regarded as authorization "for the same research study" because the future uses are closely related to the primary database or tissue repository study.

The HIPAA compound authorization requirements also impact an authorization for future uses when the future uses are contemplated as part of a protocol involving treatment, and not simply data or tissue collection. Under OCR and NIH interpretations, an authorization, other than an authorization for a use or disclosure of psychotherapy notes, may be combined with any other similar authorization. However, a research authorization may not be combined with another research authorization where the Covered Entity has conditioned the provision of treatment or payment for treatment on the individual's signing the other authorization. In other words, if an individual is enrolled in a clinical trial in which research-related treatment is conditioned on the individual's signing the research authorization for the clinical trial, that research authorization may not be combined with any other research authorization. In the event data and/or biologic materials will be collected during the clinical trial and the Covered Entity would like to store those items in research databases or repositories, the Covered Entity is required to seek a separate authorization from the individual in the clinical trial to the banking of his or her data and materials.

Thus, because of HIPAA's compound authorization requirements - or at least the Department's current interpretation of those requirements - a research banking authorization is not permitted to be combined with the general research authorization for a clinical trial. The result is that in a clinical trial that also contains a data or tissue banking component, each subject must be asked to sign: (i) a research informed consent for the clinical trial (which presumably can include consent to collect and store data and materials for future research purposes); (ii) a research authorization for the clinical trial (which may be combined with the research informed consent); and (iii) a research authorization permitting the banking of data and materials collected during the clinical trial. Unless the researchers intent to obtain IRB or privacy board waiver at a later time, the subject also may be asked to sign (iv) a consent to any specific future research on his or her data/materials and (v) an authorization to any specific future research (which may be combined with the specific informed consent form).

While SACHRP recognizes the distinct importance of the informed consent and HIPAA authorization documents and appreciates the Department's clarifications regarding combining research informed consents with HIPAA research authorization forms, the more integrated the information provided to subjects, whether required by the Common Rule or the Privacy Rule, the better chance that the resulting consent and authorization will be meaningful to subjects. SACHRP is concerned that the complex requirements of HIPAA's compound authorization requirements, as currently interpreted, elevate form over substance and have the unintended result of confusing subjects and diminishing the informed nature of their consent and authorization.