When Your Records Become Research Without Your Signature

Answer first: a document replaces the signature

One standard in the privacy rule covers research. It permits a covered entity to use or disclose protected health information for research, and it says this regardless of the source of funding.

It does not permit that on the entity's own say-so. Three routes sit underneath it, and each one requires something in writing before anything moves.

The first is documented approval of a waiver or alteration of the authorization the rules would otherwise require. The second is a review preparatory to research. The third covers research on the information of people who have died.

Nothing in the standard involves you. There is no notice to the individual, no chance to object, and no signature.

Research is a defined term, and the definition is the boundary

The subpart defines research as a systematic investigation, including research development, testing, and evaluation.

It adds four words that do the real work: designed to develop or contribute to generalizable knowledge.

Generalizable is the hinge. Studying your own patients to improve your own service is a different activity from studying them to publish something about patients in general.

That matters when a company says its data shows something. The route the analysis traveled decides which rules applied to it, and the two routes have different paperwork.

Two bodies may sign a waiver, and they are not equivalent

The waiver route requires documentation that an alteration or waiver of the individual authorization has been approved. Approval may come from either of two bodies.

One is an institutional review board established in accordance with a list of agency regulations, sixteen of them, printed in the paragraph.

The other is a privacy board, and the rule defines it in three clauses. It must have members with varying backgrounds and appropriate professional competency to review the effect of the protocol on privacy rights and related interests.

It must include at least one member who is unaffiliated with the covered entity, unaffiliated with any entity conducting or sponsoring the research, and unrelated to any person affiliated with those entities.

And no member with a conflict of interest may take part in reviewing a project.

Following the cross-reference to the review board rule

The privacy paragraph names the human-subjects regulation rather than restating it, so the two standards can only be compared by reading both.

The review board rule requires at least five members with varying backgrounds. It asks for qualification through experience, expertise and diversity, including race, gender and cultural background.

It requires at least one member whose primary concerns are scientific and at least one whose primary concerns are not. It requires at least one member not otherwise affiliated with the institution, and not in the immediate family of anyone affiliated.

No member may take part in reviewing a project in which the member has a conflicting interest, except to supply information the board asks for. Outside experts may be invited, and they may not vote.

Set beside that, the privacy board paragraph states no minimum number of members, no scientific and nonscientific balance, and no rule about voting. One unaffiliated member is the whole of its independence requirement.

What the waiver document has to contain

The rule lists five contents, and a waiver that lacks one is not documented approval.

A statement identifying the board and the date the waiver was approved. A statement that the board determined the waiver satisfies stated criteria. A brief description of the information the board found necessary. A statement about which review procedure was used. And a signature by the chair, or by another member the chair designates.

The criteria themselves are three. That the use or disclosure involves no more than minimal risk to privacy. That the research could not practicably be conducted without the waiver. And that it could not practicably be conducted without access to and use of the information.

Minimal risk is not left to judgment either. The paragraph says the determination rests on at least three elements, and prints them.

An adequate plan to protect the identifiers from improper use and disclosure. An adequate plan to destroy them at the earliest opportunity, unless there is a health or research justification for keeping them or the law requires it. And adequate written assurances that the information will not be reused or disclosed to anyone else, outside stated exceptions.

The route with no board at all

A second route needs no waiver document. It covers a review preparatory to research, and it runs on representations the researcher gives the covered entity.

Three of them. That access is sought solely to review information as necessary to prepare a research protocol or for similar preparatory purposes. That no protected health information will be removed from the covered entity by the researcher during the review. And that the information sought is necessary for the research purposes.

The middle representation is the one a reader can hold onto. Under this route the researcher looks and does not carry anything away.

The third route covers research on the information of decedents. It runs on a representation that the work is solely on decedents' information, documentation of death at the entity's request, and a representation that the information is necessary.

What a reader can actually look at

Whether a privacy notice mentions research as a purpose, since a notice has to describe uses that do not need your authorization.

Whether a company publishing outcomes says what reviewed the study, and whether the reviewer was a review board or a privacy board.

Whether a published result describes itself as generalizable knowledge or as an internal look at the company's own service.

Whether an authorization appeared anywhere in the signup flow, since a signed authorization is a different route with different rules.

Whether anything says who is unaffiliated on the body that approved the work, which is the one independence requirement the privacy board rule states.

What this does not decide

It does not say what any company does with anyone's records, and no arrangement described here is attributed to anyone.

It does not say a waiver is improper. A privacy board is the rule's own creation, and using one is the rule working as written.

It does not cover authorization, which is the ordinary route and lives in a different section of the same subpart.

And it is not legal advice. It reports what one standard and two supporting provisions say.