[Federal Register Volume 68, Number 216 (Friday, November 7, 2003)]
[Notices]
[Pages 63110-63111]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 03-28044]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
[Docket No. 2003D-0204]
Guidance for Industry: Institutional Review Board Review of
Stand-Alone Health Insurance Portability and Accountability Act
Authorizations; Availability
AGENCY: Food and Drug Administration, HHS.
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA) is announcing the
availability of a document entitled ``Guidance for Industry: IRB Review
of Stand-Alone HIPAA Authorizations Under FDA Regulations,'' dated
October 21, 2003. The guidance document provides clarification for
institutional review boards (IRBs) of their responsibilities for
reviewing and approving stand-alone authorizations under the Health
Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy
Rule. A stand-alone HIPAA authorization is a document used to obtain
permission from an individual for a covered entity to use and/or
disclose the individual's identifiable health information for a
research study and that is not combined with an informed consent
document to participate in the research itself. This guidance is
intended to encourage IRBs to permit enrollment of subjects in clinical
investigations without the IRB's prior review and/or approval of stand-
alone HIPAA authorizations, even under circumstances in which the IRB's
written procedures require such review and/or approval. Because FDA has
determined that prior public participation is not feasible or
appropriate, this guidance document will be implemented upon posting on
FDA's Web site.
DATES: Submit written or electronic comments on agency guidances at any
time.
ADDRESSES: Submit written comments on the guidance document to the
Division of Dockets Management (HFA-305), Food and Drug Administration,
5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
Submit electronic comments to http://www.fda.gov/dockets/ecomments.
See the SUPPLEMENTARY INFORMATION section for electronic access to the
guidance document.
Submit requests for the guidance document to the Division of
Dockets Management at the address provided. Your request should include
the docket number in the heading of this document.
FOR FURTHER INFORMATION CONTACT: Catherine Lorraine, Office of the
Commissioner (HF-11), Food and Drug Administration, 5600 Fishers Lane,
Rockville, MD 20857, 301-827-3360.
SUPPLEMENTARY INFORMATION:
I. Background
FDA is announcing the availability of a document entitled
``Guidance for Industry: IRB Review of Stand-Alone HIPAA Authorizations
Under FDA Regulations,'' dated October 21, 2003. This guidance is
similar to a guidance published by the Office of Civil Rights,
Department of Health and Human Services (HHS), entitled ``Privacy
Guidance about Authorizations for Research and Institutional Review
Boards,'' which is available on the HHS Web site at http://www.hhs.gov/ocr/hipaa. (FDA has verified the Web site address, but is not
responsible for subsequent changes to the Web site after this document
publishes in the Federal Register.) The Privacy Rule is a Federal
regulation implementing certain provisions of the HIPAA (Public Law
104-191), that protects the privacy of certain health information (see
45 CFR parts 160 and 164). The Privacy Rule is a comprehensive set of
minimum requirements intended to safeguard individually identifiable
health information while permitting important research and health care
activities to continue. The Privacy Rule went into effect on April 14,
2003.
The Privacy Rule establishes the right of individuals, including
research subjects, to authorize the use and disclosure of their
protected health information by signing an authorization form for uses
and disclosures not otherwise permitted by the Privacy Rule (see 45 CFR
164.508). For example, in the context of a clinical investigation, a
valid and properly executed HIPAA authorization explains the ways in
which a subject's protected health information will be used and
disclosed by the clinical investigator and permits the clinical
investigator to use and disclose that information as specifically
described in the authorization. An HIPAA authorization is different
than a subject's informed consent in that an HIPAA authorization
focuses on uses and disclosures of information that may
[[Page 63111]]
be made. Informed consent, on the other hand, apprises potential
research subjects of the possible risks and benefits associated with
participating in the clinical investigation and, when executed,
indicates their willingness to participate in the clinical
investigation and their understanding of those risks and benefits. The
Privacy Rule permits but does not require clinical investigators to
combine an HIPAA authorization with informed consent documents, known
as a compound authorization (see 45 CFR 164.508(b)(3)).
FDA and the HHS Secretary received requests for clarification of
IRBs' responsibilities to review and approve stand-alone HIPAA
authorizations under the Privacy Rule, Federal regulations governing
human subject protection and IRBs (see 45 CFR part 46 and parts 50 and
56 (21 CFR parts 50 and 56)), and international guidelines (see, for
example, International Conference on Harmonisation (ICH) Good Clinical
Practice guidelines (E6)). The requests expressed concern that when the
Privacy Rule went into effect, clinical investigations might be impeded
because IRBs would be backlogged with requests to review thousands of
stand-alone HIPAA authorizations. The requests further stated that some
IRBs would halt enrollment in clinical investigations pending their
review of these stand-alone HIPAA authorizations.
In response, the Office of Civil Rights, HHS, issued a letter,
dated April 15, 2003, clarifying that IRBs are not required to review
and approve stand-alone HIPAA authorizations under the Privacy Rule,
HHS Protection of Human Subjects Regulations at 45 CFR part 46, ICH
guidelines, or FDA regulations, so long as an IRB's written procedures,
adopted under Sec. 56.108(a), do not require such review and approval.
The letter also announced FDA's intent to publish guidance on this
subject, in accordance with its good guidance practice regulations.
FDA is issuing this guidance to address those cases in which IRBs
have adopted written procedures that would require them to review and
approve stand-alone HIPAA authorizations. Under Sec. 56.108(a), IRBs
must follow their written procedures. The guidance announces FDA's
intention to exercise ongoing enforcement discretion with respect to
the requirements of Sec. 56.108(a) to the extent that an IRB's written
procedures require the review and/or approval of stand-alone HIPAA
authorizations. FDA is exercising this discretion in order to encourage
IRBs to permit the continued enrollment of subjects in clinical
investigations without IRBs' prior review and approval of stand-alone
HIPAA authorizations. FDA believes that enrollment in well-designed and
well-conducted clinical investigations should not be interrupted for
the purpose of IRB review and approval of stand-alone HIPAA
authorizations. Accordingly, FDA does not intend to take enforcement
actions against IRBs that decide not to review stand-alone HIPAA
authorizations even though the IRB's written procedures would otherwise
require this review and/or approval. FDA's exercise of enforcement
discretion in these limited circumstances is intended to allow
important studies to proceed in the best interests of the public
health.
This guidance is being issued consistent with FDA's good guidance
practices regulation Sec. 10.115 (21 CFR 10.115). This guidance
document represents the agency's current thinking on IRBs'
responsibilities under FDA regulations for reviewing and approving
stand-alone HIPAA authorizations. It does not create or confer any
rights for or on any person and does not operate to bind FDA or the
public. An alternative approach may be used if it satisfies the
requirements of the applicable statutes and regulations.
II. Comments
FDA is issuing this document as a final guidance that will be
implemented upon posting on FDA's Web site. In accordance with Sec.
10.115(g)(2) and (g)(3), FDA is implementing this guidance prior to
seeking public comment because the agency has determined that this
guidance is needed in conjunction with the HHS Office of Civil Rights
guidance to help ensure that ongoing clinical trials are not halted
while IRBs review HIPAA stand-alone authorizations, and therefore,
prior public participation is not feasible or appropriate. However, FDA
will review comments received after issuance of the guidance and revise
the document when appropriate.
Interested persons may, at any time, submit written or electronic
comments to the Division of Dockets Management (see ADDRESSES)
regarding this guidance document. Two paper copies of mailed comments
are to be submitted, except individuals may submit one copy. Comments
should be identified with the docket number found in the brackets in
the heading of this document. A copy of the document and received
comments are available for public examination in the Division of
Dockets Management between 9 a.m. and 4 p.m., Monday through Friday.
III. Electronic Access
Persons with access to the Internet may obtain the document at
either http://www.fda.gov/oc/gcp/guidance.html or http://www.fda.gov/ohrms/dockets/default.htm.
Dated: October 31, 2003.
Jeffrey Shuren,
Assistant Commissioner for Policy.
[FR Doc. 03-28044 Filed 11-6-03; 8:45 am]
BILLING CODE 4160-01-S