NCAB Objects to Provisions in HHS’ Proposed Privacy Regs

BETHESDA, Md—The National Cancer Advisory Board (NCAB) has objected in a letter to several proposed provisions in a new rule mandated by Congress and drafted by the Department of Health and Human Services (HSS). The regulation would set privacy standards governing the release of health information that might reveal the identity of individual patients, and it could significantly affect oncologists whose patients enter clinical trials.

A number of medical and health groups have responded to HHS’ request for comments on its proposed rule, which covered 148 pages when published in the Federal Register. The Association of American Medical Colleges, for example, called the proposed regulations “exceedingly burdensome” and asked HHS to exclude researchers from its provisions.

“One of the things that worries me, beyond the language of this lengthy document, is its interpretation,” said NCAB member Frederick P. Li, MD, chief of cancer epidemiology and control, Dana-Farber Cancer Institute, at a meeting of the advisory board. “Even though the language may seem okay, in the future when it’s interpreted, we may be running into issues that we cannot anticipate right now.”

The NCAB letter includes comments developed by more than 120 researchers who met with NCI officials for 2 days in early December.

Patient Authorization Form

One provision of the proposed new rule would require a “patient authorization” form in addition to a consent form when researchers use health data that could identify a patient. The authorization form would include a description of what information would be disclosed and for what purpose, who might receive the information, an expiration date, notification that the patient can refuse to sign the form, and details of any potential financial gains that might accrue from the research.

The NCAB contended in its response that most points in the proposed form are covered in informed consent agreements that researchers are already required to obtain. “Those that are not could be incorporated [into consent forms], such as what information will be disclosed to the participant and information about investigator financial gain,” the advisory board argued.

In long-term studies, the requirement “becomes an unreasonable burden when participants are frequently contacted for new authorizations,” the NCAB added. And in studies using archived tissues, “it is difficult or impossible to get a separate patient authorization for each use.”

Proposed new restrictions on the use of individually identifiable health information without informed consent also drew a negative response from the NCAB. Under the HHS draft rule, the use or disclosure of such information for research without an individual’s authorization would be barred unless four new requirements were met in addition to four already in existence.

The additional HHS criteria would require that (1) the research would be impractical without the protected information, (2) the project is sufficiently important to outweigh the privacy intrusion, (3) an adequate plan exists to protect identifiers from improper use and disclosure, and (4) identifiers must be destroyed at the earliest opportunity consistent with conduct of the research.

“These additional criteria for waiver of informed consent lack a strong rationale and are duplicative of the waiver criteria that already exist,” the advisory board argued.

The NCAB also objected to setting different standards for publicly and privately funded research. “Both groups of researchers should be subjected to equivalent IRB [institutional review board] review and requirements,” the board said. “A double standard of review for private and government-funded research is unacceptable, especially since these regulations are being developed to protect research participants.”

And it warned: “The two-tiered system of review may also become an obstacle to the conduct of federally funded, peer-reviewed research and promote the conduct of less rigorous research.”

Under another proposed regulation, researchers—with very limited exceptions—would have to disclose to patients all research information in their health records, even if this information has no validity or utility.

The NCAB argued that patients “should not be provided unconditionally with unvalidated and premature results except under specific situations that are presented in the informed consent.”

The board noted that research results whose scientific validity, meaning, importance, and medical implications are unknown—such as nonstandard assays or unproven cancer markers—may be misleading and misinterpreted, and there are no provisions for educating participants “about the limitations of such data before disclosure.” It suggested that instead of requiring disclosure of such information, consent forms should state that some nonstandard data will be collected but not disclosed to the patient.

HHS would also require the documentation of any uses or disclosures of health information that are unrelated to treatment, payment, or health care operations. The NCAB objected to this provision, noting that it would allow “any individual with access to the chart to know to whom the health information has been disclosed.” It urged keeping a separate list of people who have seen a medical record. And it called tracking chart access for even one data element “a significant burden, with minimal additional privacy protection.”

Finally, the NCAB took issue with a proposed requirement that all organizations covered by the regulations disseminate or make available their notices of information practices and any changes they might make. The board argued that this provision would not help inform research participants or increase privacy.

“For example, if the posting is in a private physician’s office, and a patient has changed doctors, they will not receive notification unless they happen to come into the office for another reason,” the NCAB said, noting that contacting former patients might be impossible.