Returning Research Test Results: Know Your Ethical and Legal Obligations © Association of Clinical Research Professionals ǀ acrpnet.org Returning Research Test Results: Know Your Ethical and Legal Obligations MICHELLE GRIENAUER, JD, MPH, CIP SENIOR REGULATORY ATTORNEY AT KINETIQ (A DIVISION OF QUORUM) © Association of Clinical Research Professionals ǀ acrpnet.org TITLE OF SECTION Disclosure The presenter(s) for today’s session: I have a relevant financial relationship with respect to this educational activity with the following organization: Employee of Kinetiq (a division of Quorum Review) © Association of Clinical Research Professionals ǀ acrpnet.org TITLE OF SECTION Learning Objectives Upon completion of this presentation, participants should be able to: • Describe the regulatory requirements and ethical implications related to returning research test results. • Recognize how the CLIA and HIPAA regulations may conflict regarding when an individual may receive research test reports and will be able to discuss potential solutions to resolve the conflict. • Develop approaches for IRBs handling requests to return test results that were generated in a non-CLIA- certified laboratory. © Association of Clinical Research Professionals ǀ acrpnet.org WHAT DO RESEARCH PARTICIPANTS WANT? SURVEY SAYS… 90% OF RESEARCH PARTICIPANTS WANT THEIR STUDY RESULTS!* Citation: *E.g., Matthew P. Kirschen,Agnieszka Jaworska, and Judy Illes, Subjects’Expectations in Neuroimaging Research, 23 Magnetic Resonance Imaging 205 (January 2006). OVERVIEW • Background • 2016 HIPAA • Ethical Issues Guidance • CLIA • FDA • HIPAA • Best Practices • 2014 Amendments to CLIA and HIPAA RETURNING STUDY RESULTS – A SPECTRUM • Return of Incidental Findings • Return of Individual Research Results • Return of Aggregate Study Results • Public Release of Study Data* Citation: *SACHRP Letter to the HHS Secretary, Attachment C: Return of Individual Results and Special Consideration of Issues Arising from Amendments of HIPAA and CLIA (July 22, 2015), http://www.hhs.gov/ohrp/sachrp/commsec/attachmentc:letter9/28/15.html . The Legal Question: The Ethical Question: Do the CLIA laboratory According to generally accepted requirements and the HIPAA ethical principles of research, Privacy Rule, allow or require should investigators provide research participants with investigators to provide their individual research test research participants with results? their individual research test results? ETHICAL ISSUES Research vs. Clinical Care • Therapeutic Misconception • Translational Research* Citation: *Susan M. Wolf, et al., Mapping the Ethics of Translational Genomics: Situating Return of Results and Navigating the Research-Clinical Divide, 43 J.L. Med. & Ethics 486 (October 2015); Presidential Commission for the Study of Bioethical Issues, Anticipate and Communicate: Ethical Management of Incidental and Secondary Findings in the Clinical, Research, and Direct-to-Consumer Contexts (December 2013), http://bioethics.gov/node/316. ETHICAL ISSUES Researcher Duty to Participants • Respect for persons • Beneficence • Justice FACTORS TO CONSIDER When Deciding Whether to Return Research Test Results • Analytic and clinical validity • Clinical actionability • Clinical or reproductive significance • Magnitude of potential harm • Informed consent process • Applicable law* Citation: *Presidential Commission for the Study of Bioethical Issues, Anticipate and Communicate: Ethical Management of Inci- dental and Secondary Findings in the Clinical, Research, and Direct-to-Consumer Contexts (December 2013), http://bioethics.gov/node/316; Susan M. Wolf et al., Managing Incidental Findings and Research Results in Genomic Research Involving Biobanks & Archived Datasets, 14 Genetics in Med. 361 (April 2012); Richard R. Fabsitz et al., Ethical and Practical Guidelines for Reporting Genetic Research Results to Study Participants: Updated Guidelines from a National Heart, Lung and Blood Institute Working Group, 3 Circulation: Cardiovascular Genetics 574 (December 2010). APPLICABLE LAWS There is currently no federal law or regulation in the US that directly addresses the return of research results or incidental findings. HUMAN SUBJECT PROTECTION REGULATIONS The federal human subject protection regulations do not currently address the return of individual results to research subjects. Indirect implications: General requirements for informed consent. BUT the revised Common Rule includes new elements of informed consent. Depending on the type of research, a participant must be informed whetheror not they will receive clinically relevant research results, including individual research results. Citation: *45 C.F.R. §§ 46.116(a)(2), (a)(3), (b)(5) (2016); 21 C.F.R. §§ 50.25(a)(2), (a)(3), (b)(5) (2016); 82 Fed. Reg 7,149, 7,266 (Jan. 19, 2017). CLIA AND HIPAA The Clinical Laboratory Improvement Amendments of 1988 (CLIA) and Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule affect when a research participant may/must be provided with research test results. CLIA The Clinical Laboratory Improvement Amendments of 1988 (CLIA) Established to strengthen federal oversight of clinical laboratories and to ensure the accuracy and reliability of patient test results. “CLIA Certification” Facilities that meet the CLIA definition of a “laboratory” must obtain certification prior to conducting patient testing.* Citation: *CLIA Laboratory Requirements, 42 C.F.R. § 493 (2015). CLIA (CONT.) • CLIA-Exempt Laboratories* CLIA-certification is not required for laboratories in states with requirements equal to or more stringent than CLIA. • CLIAExceptions** CLIA does not apply to research laboratories that do not report patient specific results “for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of individual patients.” Citation: *42 C.F.R. § 493.3(b)(2016); **42 C.F.R. § 493.2(2016.) CLIA (CONT.) • Exemption vs. Exception • Research laboratories “excepted” from CLIA, not “exempt” from CLIA. Same difference?* Citation: *Mark Barnes et al., The CLIA/HIPAA Conundrum of Returning Test Results to Research Participants, 14 Bloomberg BNA Med. Res. L. & Pol. Rep. 491 (July 2015) PENALTIES FOR CLIA VIOLATIONS • Criminal Sanctions • Suspension of Medicare payments • For intentional violations - imprisonment(up to 1 year) or fine (up to $100,000) • Directed plan of correction • Civil Suit • State onsite monitoring* • CMA can bring suit to enjoin the operations of a noncompliant laboratory. • Civil Money Penalty • $50-$10,000 per day of noncompliance • Suspension, limitation, or revocation of a CLIA certificate Citation: *42 C.F.R. §§ 493.1800- 1850 (2016). HIPAA • The Health Insurance Portability andAccountability Act (HIPAA) Privacy Rule • Establishes standards for protecting the privacy of individually identifiable health information. • Confers rights on individuals, including the rights to access to all of the protected health information maintained in the individual’s “designated record set.” Citation: 45 C.F.R. § 160 (2016); 45 C.F.R. § 164, Subparts A and E (2016). DESIGNATED RECORD SET (DRS) • “Designated record set” – A group of records maintained by or for a covered entity thatis: • (i) The medical records and billing records about individuals maintained by or for a covered health care provider; • (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or • (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. • “Record” means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a coveredentity.* Citation: *45 C.F.R. § 164.501 (2016). PENALTIES FOR HIPAA VIOLATIONS • Criminal sanctions • Fine of $50,000-$250,000 and imprisonment for 1-10 years* • Civil money penalty • Range: $100 per violation, with an annual maximum of $25,000 for repeat violations, to $50,000 per violation, with an annual maximum of $1.5 million. • Exclusion from Medicare participation.** Citation: *42 U.S.C. § 1320d-6 (2016); **45 C.F.R. § 160, Subparts C, D, and E (2016); CLIA PROGRAM AND HIPAA PRIVACY RULE; PATIENTS’ ACCESS TO TEST REPORTS. • On Feb. 6, 2014, HHS promulgated a joint OCR/CMS rule.* • Amended both the CLIA Laboratory Requirements andthe HIPAA Privacy Rule. • HHS Intent: • Remove barriers to an individual’s direct access to his or her own test reports from laboratories. • Empower individuals to better manage their health and take action to prevent and control disease.* Citation: *CLIA Program and HIPAA Privacy Rule; Patients’ Access to Test Reports, 79 Fed. Reg. 7,290 (Feb. 6, 2014) (amending 42 C.F.R. § 493.1291; 45 C.F.R. § 164.524). CLIA Before After • CLIA-certified laboratories only • CLIA-certified laboratories may allowed to disclose laboratory give completed test results results to certain individuals (e.g. directly to a patient.* provider ordering test). • Depending on state law, a patient might not be authorized to order or receive a test result. Citation: *42 C.F.R. §§ 493.1291(f), (l) (2016). HIPAA Before After • Access provisions did not apply • Removed the exception. to CLIA-certified and CLIA- • Laboratories must allow an exempt laboratories. individual access to test results • Exceptions were originally that are part of the designated created to avoid conflict with record set.* CLIA, which restricted patient access to test reports.