RECRUITING STUDY SUBJECTS: How Do you Navigate HIPAA and Human Subjects Regulations?

HIPAA (the "Privacy Rule") contains a provision for "preparatory to research" activities, but HHS Protection of Human Subjects Regulations at 45 CFR part 46 (the "Common Rule") do not include any provisions for “preparatory to research” activities.

The Common Rule defines “Research” as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.” (Emphasis added.)
The Common Rule defines “Human Subject” as

When a “preparatory to research” activity (i) involves human subjects research, as defined above; (ii) is conducted or supported by HHS or conducted under an applicable OHRP-approved assurance; and (iii) does not meet the criteria for exemption under the Common Rule, the research must be reviewed and approved by an IRB. In addition, informed consent of the subjects must be sought and documented in accordance with, the Common Rule. However, under the Common Rule, an IRB may approve a consent procedure for such a “preparatory to research” activity that does not include, or that alters, some or all of the elements of informed consent, or may waive the requirements to obtain informed consent for such a “preparatory to research” activity if certain criteria are satisfied.

Activities in which an investigator obtains and records individually identifiable health information for purposes of identifying potential human subjects to aid in study recruitment, among other things, would involve human subjects research under the Common Rule and would not satisfy the criteria for any exemption under the Common Rule. As a result, if such activities are conducted or supported by HHS or conducted under an applicable OHRP-approved assurance, the research activities must be reviewed and approved by an IRB. In addition, informed consent of the subjects, about whom identifiable private information (e.g., health information) is being obtained, must be sought and documented in accordance with the Common Rule.

For example, if an investigator who is covered by an applicable OHRP-approved assurance obtains and records identifiable private information from medical records for the purpose of contacting these individuals to determine if they would be interested in participating in a research study, this activity constitutes human subjects research and thus would require either (1) that subjects’ informed consent be sought as required by the Common Rule or (2) that the IRB approve an informed consent procedure that does not include or that alters some or all of the elements of informed consent, or waive the requirement to obtain informed consent in accordance with the provisions of the Common Rule. Informed consent also must be documented in accordance with, and to the extent required by, the Common Rule.

Similarly, if such an investigator obtains and records identifiable private information to develop a database of potential research subjects for future research studies, this activity is also human subjects research as defined in the Common Rule and thus would need to meet the requirements of the HHS regulations as discussed above.

HIPAA does not override any requirements of the Common Rule, and vice versa. In situations where both the Common Rule and the Privacy Rule are applicable, institutions must adhere to both sets of regulations.

[This item paraphrased from Question #3 in Clinical Research and the HIPAA Privacy Rule <http://privacyruleandresearch.nih.gov/clin_research.asp>, an NIH HIPAA guidance document]