about regulatory affairs

1. HIPAA- New requirements
for clinical study process
Presented by-
Amartya Nandi
M.Pharm (Pharmaceutics)
Reg No – 2023001515

2. Introduction
HIPAA was in 1996 with two objectives.
The first part "Health Insurance Portability part of the Act"
To ensure that individuals would be able to maintain their health insurance between
jobs.
The second part of the Act is the "Accountability" portion. To ensure the security and
confidentiality of patient information/data and mandates uniform standards for
electronic data transmission of administrative and financial data relating to patient
health information.
The privacy of health information becomes an important concern for all intuitions
delivering healthcare.
The shift toward interoperable electronic health record leads patients to worried about
their information privacy and losing of control over their data.
The healthcare providers need to ensure effective level of privacy and security policies
that safeguard the patient's rights.

3. The health records need to be under strict control.
There is need to implement a global standard of handling patient data and such standards for
electronic transfer of the medical information. Also need some guidelines to control the patient
records both written and oral.
The first and most considerable Federal legislation on health privacy and security is the Health
Insurance Portability and Accountability Act known as the HIPAA

5. Goal of HIPAA
• To make law easier for people to keep health insurance
• Protect the confidentiality and security of health care information.
• Help healthcare industry to control Administrative cost.
HIPAA consist of
 Standardized Electronic Data Interchange transactions and codes for all covered
entities. Standards for security of data systems.
 Privacy protections for individual health information.
 Standard national identifiers for health care.

6. HIPAA Patient Rights
HIPAA guarantees several rights to patients:
• Right to privacy
• Right to confidential use of their health information for their treatment, billing process, and other
health care operations (such as quality improvement)
• Right to access and amend their health information upon request
• Right to provide specific authorization for use of their health information other than for treatment,
billing and other health care operations.
• Right to have their name withheld from our patient directories
• To request that individuals are not told of their presence in our facilities

7. Requirements
informed consent
the HIPAA authorisation can be included with informed consent document or can be separated form
the informed consent .see PHI authorisation page. Must contain a specific description of the
information to be disclosed including
• Name of the person or class of person that will receive the disclosed information e.g principal
investigator
• Statement that information received by the users may be used for future. Expiration date or
expiration event when authorities may disclose the information.
• Statement containing a subject's right to revoke their authorization for discloser.
• Statement containing a subject's right to revoke their authorization for discloser.
• Statement documenting the ability to condition enrollment on informed consent.
• Statement documenting the possibility that the information may be re disclosed by recipient (eg. To
the FDA).

8. Institutional Review Boards
• Where HIPAA requirements are combined with the informed consent requirements, the entire
document needs to be reviewed by the Institutional Review Board (IRB). The Office of Civil
Rights as well as the FDA's General Counsel, had confirmed that IRB approval of subject
authorization for use or disclosure of protected health information required by the HIPPA privacy
rule is only required if the authorization language is to be part of the IRB-approved informed
consent document for human subjects review.
Privacy Boards
• In cases where IRBs are not responsible for reviewing, the HIPAA Authorization Privacy Board
may be formed to undertake this task. Members of privacy boards should have varying
backgrounds and appropriate professional Competence. At least one member must not be affiliated
with the covered entity or research sponsor. As with the IRB, there must be no conflicts of interest
on a case-by-case basis. A quorum consists of a majority of members.

9. Study Recruitment
The covered entity's workforce can use protected health information to identify and contact prospective research
subjects. The covered entity's health care provider can discuss the enrollment in a clinical trial with a potential
subject before authorization is completed or there has been an Institutional Review Board or Privacy Board
waiver of authorization. A clinician may use or disclose the PHI if such information is being used to treat the
subject or using an experimental treatment that may benefit a subject.
Privacy Waivers of Authorization
Three criteria must be met for the IRB or Privacy Board to waive authorization for research:
• The use or disclosure of protected health information involves no more than a minimal risk to the privacy of
the individual.
• The research could not practicably be done without the waiver. The research could not practicably be
conducted without access to and use of the protected health information (PHI).
• The research will not adversely affect privacy rights or welfare.
The privacy risks are reasonable in relation to anticipated benefits and the importance of the knowledge of the
clinical results.

10. HIPAA Overview
The Privacy Rule governs who has access to protected health information (PHI).
The Security Rule specifies a series of administrative, technical and physical security
procedures to assure the confidentiality, integrity and availability of ePHI.
The American Recovery and Reinvestment Act (ARRA) goal is to establish secure
electronic health records for all Americans by 2014
The Health Information Technology for Economic and Clinical Health Act (HITECH)

11. Protected Health Information (PHI)
• HIPAA protects all patient information whether it is verbal, written or
electronic.
• It includes all individually identifiable health information that is transmitted
or maintained in any form or medium.
• It includes demographic information that ties the identity of the individual
to his or her health record.
E.g. names, addresses, geographic codes smaller than state, all dates (except
year) elements related to the person, telephone numbers, fax numbers, license
numbers, social security numbers, etc.

12. HIPAA has two parts
•Privacy Rule
*Apply to Protected Health Information in all forms oral,
written, and electronic.
•*PHI Disclose standards
•*Penalties for improper disclosure and misuse
Security Rule
*Monitor access to PHI
*lays out specific requirements concerning contracts between
CE and their business associates
*Policies and procedures to ensure the health organization's
compliance with HIPAA

13. HIPAA Privacy Rule
• Make sure that the policies are applied in a manner that ensures proper
protection of data and not leaving room for mistakes.
• HIPAA set the rules of medical care in how to govern and use the PHI for
handling patient issues.
• The health care institutions are charged with the role of informing the
patients and getting permission for disclosing their personal data. Written
permission is vital, and it accords them the right to access their medical data.
• Staff and students are free to communicate as required for quick, effective,
and high-quality health care.
• The Privacy Rule also recognizes that overheard communications may be
unavoidable and allows for these incidental disclosures.

14. HIPAA Security Rule
• Defines general standards and implementation requirements to protect electronic
personal health information (ePHI), which is preserved by covered entity.
• Provides appropriate controls such as administrative, physical, technical and
Policies, procedures and documentation requirements in order to guarantee the
confidentiality, integrity, and availability of ePHI.

15. Administrative Requirements
Business Associates Overview
• A Business Associate is a person or entity to whom an agency discloses PHI so that the person or
entity may carry out, assist with, or perform a function on behalf of the agency (e.g., billing).
• The agency is required to have "satisfactory assurance" that any business associate will
"appropriately safeguard" PHI received or created by the business associate in the course of
performing services for the agency.
• The agency must document the satisfactory assurances through a written contract.
• The business associate provision does not apply to providers who receive information for treatment
purposes.

16. Physical safeguards
These are physical measures, policies, and procedures to protect a covered entity's
electronic information systems and related buildings and equipment, from natural
and environmental hazards, and unauthorized intrusion.
Technical Safeguards
The technology and related policies and procedures that protect ePHI and control
access to it. The Technical Safeguards standards apply to all ePHI.
The Rule requires a covered entity to comply with the Technical Safeguards
standards and provides the flexibility to covered entities to determine which
technical security measures will be implemented.

17. HITECH and ARRA Rules
HITECH - is designed to encourage health care providers to adopt health information technology in
a standardized manner and to protect private health information.
ARRA - is the direct result of modifications in the HIPAA Privacy, Security and Enforcement Rules
and strengthens health information privacy and security protections. ARRA specifically addresses:
Breaches Electronic Health Records (EHR) Personal Health Records (PHR)

18. Challenges of HIPAA
Understanding and Interpretation: It might be difficult to comprehend and interpret the intricate
requirements of the HIPAA standards. It is essential to trained and knowledgeable of the laws and
regulations.
Technological Difficulties: Securing electronic protected health information (ePHI) presents
difficulties dependent on technology. implementing and preserving encryption techniques, safe
information systems, and data integrity.
Employee Education and Awareness: A major contributing element to data breaches is human
mistake. It is essential to make sure that every employee has received the necessary training on
HIPAA standards and understands the significance of protecting patient information.
Vendor management: Third-party vendors, sometimes known as business partners, are frequently
employed by healthcare organisations and may have access to patient data