The requirements of the HIPAA regulation expressly do not preempt state laws unless it is ‘impossible to comply’ with both the state and federal requirements.
STATE LAWS
The
requirements of the HIPAA regulation expressly do not preempt state laws unless
it is ‘impossible to comply’ with both the state and federal requirements. If it is impossible to comply with both, then the federal law preempts the
state law only if the state law is less stringent than the federal law. More-over, the informed consent provisions of the Common Rule state that ‘The
informed consent requirements in this policy are not intended to preempt any
applicable federal, state, or local laws which require additional information
to be disclosed in order for informed consent to be legally effective’.34
Some states, such as Minnesota, have laws that directly regulate research.35
These state laws are not preempted by the Common Rule, and so long as the
federal and state requirements are not inconsistent with one another, the rule
is that one should comply with all applicable laws.
Virtually,
all states have some form of law or law specifying what constitutes consent,
and the above provision of the Common Rule indicates that IRBs and researchers
are obliged to comply with them. In practice, complying with the informed
consent requirements of medical privacy laws has not been an insurmountable
impediment to epidemiologic research because states typically do not have
provi-sions regarding the waiver of consent; thus the affir-mative federal
policy has been assumed to govern. In recent years, however, many states have
considered legislation that is more restrictive than the Common Rule with
respect to waiver of consent.36 As these laws are implemented, IRBs
may find that fewer epidemiologic protocols meet the criteria for waiver of
consent.
An
even more troubling set of problems for research stems from the increasingly
prevalent state laws regu-lating informed consent and information disclosure
when genetic testing or genetic information is involved. As health care
interventions increasingly use genetic analyses for diagnostic purposes and for
selection of appropriate pharmaceutical interventions, it will be increasingly
unlikely that any medical record can be presumed not to include genetic
information. State genetic laws typically define ‘genetic information’ very
broadly, so that carrier status, single gene diseases, multiple gene diseases
and genes that merely indicate a susceptibility for a disease are all
encompassed by the definition. As a result, records containing such
infor-mation generally become subject to state law require-ments regarding
disclosure of such information. Unless federal regulators and institutions
sponsoring IRBs are attentive to the implications for epidemiologic research,
the social sensitivity of genetic information (popularly thought of in more
narrowly predictive terms than the states’ broad definitions) may very well be
construed as making any records that include information regard-ing the results
of genetic tests ineligible for expedited review. That is, as discussed below,
under the 1998 notice from the FDA and the National Institute of Health (NIH),37
research using data that might be used to disadvantage the data subject is not
to be deemed ‘minimal risk’ research for purposes of an IRB’s expe-dited review
policy. Thus, the breadth of state laws protecting genetic information raises
the possibility that routine data-only research will have to be approved and
considered by the full IRB, with the potential for frac-tious ‘research vs.
privacy’ debates that may result in the approval of only a fraction of
important protocols.
The
net result of the three bodies of US law is that there are many sources of
legal requirements that impact researchers’ access to data for purposes of epidemiologic
research. And because responsibil-ity for complying with these requirements
generally focuses on the data source, any one of multiple laws can become a
roadblock to the conduct of research. In effect, there is no legal or
organizational frame-work that holds the plethora of laws together in a way
that offers straightforward principles for protecting the public interest in
the conduct of epidemiologic and outcomes research while protecting the data
subjects’ privacy interests.
Related Topics
TH 2019 - 2024 pharmacy180.com; Developed by Therithal info.