On July 10, the U.S. House of Representatives approved the 21st Century Cures Act (the Act), a bill intended to support advancements in medical innovation. The Act includes measures aimed at spurring medical research, reducing the regulatory burden on medical device development, improving health information interoperability, and expanding telehealth coverage.
In order to facilitate collaborative research, the Act proposes revisions to HIPAA regarding the ways in which protected health information (PHI) may be used or disclosed for research purposes. The Act directs HHS to “revise or clarify” HIPAA’s Privacy Rule to:
- allow the use or disclosure of PHI by a covered entity for research purposes, including the pursuit of generalizable knowledge, to constitute a use or disclosure of PHI for health care operations purposes;
- remove a current limitation on payment for disclosures of PHI for research purposes;
- add the sharing of PHI with entities subject to FDA oversight for research activities as a permitted disclosure of PHI for which a patient authorization is not required;
- permit researchers to remotely access PHI; and
- enable researchers to obtain one-time authorizations for uses and disclosures of PHI for future research purposes.
The Act’s HIPAA provisions have generated controversy among health privacy experts. Although some commenters have praised the relaxed requirements for sharing PHI for research purposes, others have expressed concerns that the Act goes too far to reduce individuals’ abilities to consent to the use or disclosure of their PHI, and that the Act seeks to eliminate a perceived barrier to medical research posed by HIPAA that does not actually exist. It remains to be seen how the U.S. Senate will address these concerns as it reviews and drafts its own version of the Act, which is not expected to pass until early 2016.