Complete Healthcare Compliance Manual

PURPOSE

To protect human subjects in research conducted at Facility by describing the policies and procedures Facility will follow regarding the use and disclosure of Protected Health Information (PHI) for research and the informed consent for participation in research conducted at Facility. These policies and procedures are also intended to enable Facility to comply with the Health Insurance Portability and Accountability Act (HIPAA), as amended by the American Recovery and Reinvestment Act, Division A, Title XIII, Sections 13100-13424 (known as the "HITECH Act"), and all other federal, state, and local laws, rules, and regulations regarding the privacy and confidentiality of health information, as well as the Federal Drug Administration (FDA) and Department of Health & Human Services (DHHS) regulations regarding research and human subjects.

DEFINITIONS

1. Authorization: Individual's written permission for the use or disclosure of the individual's protected health information for any purpose other than to carry out treatment, payment, or health care operations.

2. Data Use Agreement: The agreement between Facility and the recipient of a limited data set that establishes the uses, disclosures, and responsibilities of the parties regarding the limited data set. (See requirements of agreement below.)

3. Disclosure: The release, transfer, provision of access to, or divulging in any other manner of information outside Facility.

4. Human Subjects: An individual who meets one of the following definitions:

   1. DHHS: A living individual about whom an investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information; OR

   2. FDA: (Applies if a medical device is part of the research.) An individual who is or becomes a participant in research, either as a recipient of the test article or as a control. A study that falls under FDA regulations can be a healthy human or a patient.

5. Individual: The person who is the subject of PHI or is a human subject or participant in research.

6. Institutional Review Board (IRB): An appropriately constituted group as defined by the federal Common Rule (Title 45, CFR, Part 46) that has been formally designated to review and monitor research involving human subjects.

7. Limited Data Set: Protected health information that excludes a set of specific direct identifiers of an individual, or of relatives, employers, or household members of the individual.

8. Protected Health Information (PHI): Any health information, including demographic information collected from an individual, that:

   1. Is created, received, transmitted, or maintained by Facility or by a business associate on behalf of Facility;

   2. Identifies or can be used to identify an individual; and

   3. Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

   4. PHI can be oral or recorded in any form or medium.

   5. Excluded from the definition of PHI are:

      1. Education records covered by the Family Education Rights and Privacy Act ( 20 U.S.C. § 1232g );

      2. Some medical records on a student eighteen years of age or older that are described at 20 U.S.C. § 1232g(a)(4)(B)(iv) ;

      3. Employment records held by Facility in its role as an employer; and

      4. Regarding a person who has been deceased for more than 50 years.

9. Record: Any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or on behalf of Facility.

10. Research: A systematic investigation, including research development, research database development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Research includes the use of a drug other than the use of an approved drug in the course of medical practice or a medical device other than the use of an approved (means approved by FDA for marketing) medical device in the course of medical practice. Program evaluation and quality improvement activities which will be disseminated externally are included in the Facility definition of research.

11. Test Article: Any drug (including a biological product for human use), medical device for human use, human food additive, color additive, electronic product, or any other article subject to FDA regulations.

12. Use: Means, with respect to PHI, the sharing, employment, application, utilization, examination, or analysis of that information obtained from Facility, the business associates of Facility, or other parties associated with Facility.

13. Workforce: Employees, volunteers, trainees, and other persons whose conduct, in the performance of work for Facility, is under the direct control of Facility, whether or not they are paid by Facility.

POLICY

Facility is guided by the ethical principles regarding all research involving humans as subjects, as set forth in the report of the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research entitled, Ethical Principles and Guidelines for the Protection of Human Research (the "Belmont Report"). In addition, the requirements set forth in Title 45, Part 46 of the Code of Federal Regulations ( 45 C.F.R. § 46 ) will be met for all applicable DHHS-supported research.

This policy is applicable to all research involving human subjects and all other activities which, even in part, involve such research conducted outside Facility using residents or resident information.

PROCEDURE

1. Permitted Uses and Disclosures of PHI for Research

   1. The Director or their designee will only use or disclose PHI for research, regardless of the source of funding of the research, after it has received one of the following:

      1. A valid authorization for the use or disclosure of the PHI requested for each individual participant in the research project; or

      2. Approval of a waiver of authorization from the IRB, contingent upon the determination of the Director or their designee that accepting the waiver is appropriate for Facility. The Director's decision will be made on a case by case basis.

2. Reviews Preparatory to Research

   1. Prior to a use or disclosure of PHI preparatory to a research activity, the Research Committee Chair or their designee must obtain, from the researcher, written representations that:

      1. The use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes preparatory to research;

      2. No PHI will be removed from Facility or the business associates of Facility by the researcher in the course of the review (unless authorization for disclosure is in place pursuant to this policy); and

      3. The PHI for which use or access is sought is necessary for research purposes.

   2. Prior to initiating any research activity, the Research Committee Chair or their designee review and approve a Request to Conduct Research at Facility.

   3. Prior to initiating any research activity, the Principal Investigator must submit a Request to Conduct Research for approval by the Research Committee.

3. Research Medical Staff Credentialing

   All research personnel conducting research at Facility are required to obtain approval (in addition to medical credentialing as appropriate). Personnel are only required to obtain research approval one time (vs. for each research study). Additionally, personnel must complete the annual approval process (submit annual TST and flu shot) in order to maintain research approval status.

4. Data Sets for Research Purposes

   The Director or their designee may also authorize use or disclosure of a limited data set of health information for research purposes (after the individual requesting the data set has received approval to conduct research from the Research Committee). A valid Data Use Agreement must be executed prior to any disclosure of a limited data set for research.

5. Finance and Research Procedures

   Facility will not bear any research costs. All research conducted at Facility shall be evaluated by Finance or their designee to verify that there are no unreimbursed use of personnel and services. The review by Finance shall include obtaining a billing grid (when appropriate), a research account request form (when appropriate), and review of the EHR study record (when appropriate) to ensure compliance with billing policies.

6. Review of Proposed Research Activities

   1. It is the responsibility of individuals proposing investigations, research, or clinical trials to provide the Research Committee with a completed Request to Conduct Research at Facility.

   2. Investigators shall not institute study protocols, investigations, or clinical trials until proof of IRB approval (from an accredited organization), approval from the Research Committee, and Finance (for studies involving billing) have provided final approval.

   3. The investigators must complete and sign all documentation required by Facility, including those relating to the maintenance of the confidentiality of resident information and obtaining resident consent. Further, investigators must respond to all inquiries from Facility in a timely fashion. Failure to respond to requests from Facility will result in suspension of the study and notification to the appropriate research and/or governmental entities.

7. Obtaining PHI for Research Purposes

   1. The researcher must provide the Facility Representative, Business Associate, or their designee a valid authorization from each of the participants or their personal representative, OR valid documentation of a Facility approved alteration or waiver of the authorization, BEFORE any use or disclosure of that individual's PHI is made for the research activity;

   2. The authorized individual making the disclosure must verify the identity and authority of the person or entity receiving the PHI;

   3. The authorized individual making the disclosure will disclose only the minimum necessary PHI to satisfy the approved use or disclosure. Whenever possible, minimum necessary will be a limited data set.

   4. Facility or their designee, will retain all documentation of an alteration or waiver of authorization for at least 7 years from the date of creation of the alteration or waiver or the date the alteration or waiver was last in effect, or Accounting of Disclosure Log, whichever is later.

8. Research Projects Involving Less Than 50 Participants

   1. The researcher performing the research activity must identify to the Facility, or its agent making the use or disclosure, each individual whose PHI will be used or disclosed during the research activity, or once recruiting ends; and

   2. The individual releasing the PHI to the researcher will be responsible for recording the disclosure in their Facility's Accounting of Disclosures Log and forwarding that log to the Research Committee Chair as required.

9. For Research Activities Involving More Than 50 Individuals

   1. For research activities using PHI from Facility that involve more than 50 participants, the department of Facility or its agent making the disclosure must document the following information;

      1. The name of the protocol or other research activity;

      2. A description, in plain language, of the research protocol or other research activity, including the purpose of the research and the criteria for selecting particular records;

      3. A brief description of the type of PHI that was disclosed;

      4. The date or period of time during which such disclosures occurred, or may have occurred, including the last date of the last disclosure; and

      5. The name, address, and telephone number of the entity that sponsored the research and of the researcher to whom information was disclosed.

   2. The Facility or its agent making the disclosure must forward this information to the Research Committee on a periodic basis.

10. Exception to the Requirements for an Authorization of Waiver of Authorization for Research

    Uses or disclosures of PHI for the following reasons do not require an authorization or IRB Waiver:

    1. Uses or disclosures of a limited data set.

    2. Reviews conducted in preparation for research.

11. Accounting of Disclosures Log

    1. Uses or disclosures of PHI for reviews conducted in preparation for research still need to be logged by the individual releasing the PHI to the researcher in the Accounting of Disclosures Log and forwarded to the Research Committee as required.

    2. Uses or disclosures of a limited data set do not require an authorization or IRB waiver, and do not have to be logged in the Accounting of Disclosures Log.