State Laws

| Home | | Pharmacovigilance |

Chapter: Pharmacovigilance: Ethical Oversight, Consent and Confidentiality

The requirements of the HIPAA regulation expressly do not preempt state laws unless it is ‘impossible to comply’ with both the state and federal requirements.


The requirements of the HIPAA regulation expressly do not preempt state laws unless it is ‘impossible to comply’ with both the state and federal requirements. If it is impossible to comply with both, then the federal law preempts the state law only if the state law is less stringent than the federal law. More-over, the informed consent provisions of the Common Rule state that ‘The informed consent requirements in this policy are not intended to preempt any applicable federal, state, or local laws which require additional information to be disclosed in order for informed consent to be legally effective’.34 Some states, such as Minnesota, have laws that directly regulate research.35 These state laws are not preempted by the Common Rule, and so long as the federal and state requirements are not inconsistent with one another, the rule is that one should comply with all applicable laws.

Virtually, all states have some form of law or law specifying what constitutes consent, and the above provision of the Common Rule indicates that IRBs and researchers are obliged to comply with them. In practice, complying with the informed consent requirements of medical privacy laws has not been an insurmountable impediment to epidemiologic research because states typically do not have provi-sions regarding the waiver of consent; thus the affir-mative federal policy has been assumed to govern. In recent years, however, many states have considered legislation that is more restrictive than the Common Rule with respect to waiver of consent.36 As these laws are implemented, IRBs may find that fewer epidemiologic protocols meet the criteria for waiver of consent.

An even more troubling set of problems for research stems from the increasingly prevalent state laws regu-lating informed consent and information disclosure when genetic testing or genetic information is involved. As health care interventions increasingly use genetic analyses for diagnostic purposes and for selection of appropriate pharmaceutical interventions, it will be increasingly unlikely that any medical record can be presumed not to include genetic information. State genetic laws typically define ‘genetic information’ very broadly, so that carrier status, single gene diseases, multiple gene diseases and genes that merely indicate a susceptibility for a disease are all encompassed by the definition. As a result, records containing such infor-mation generally become subject to state law require-ments regarding disclosure of such information. Unless federal regulators and institutions sponsoring IRBs are attentive to the implications for epidemiologic research, the social sensitivity of genetic information (popularly thought of in more narrowly predictive terms than the states’ broad definitions) may very well be construed as making any records that include information regard-ing the results of genetic tests ineligible for expedited review. That is, as discussed below, under the 1998 notice from the FDA and the National Institute of Health (NIH),37 research using data that might be used to disadvantage the data subject is not to be deemed ‘minimal risk’ research for purposes of an IRB’s expe-dited review policy. Thus, the breadth of state laws protecting genetic information raises the possibility that routine data-only research will have to be approved and considered by the full IRB, with the potential for frac-tious ‘research vs. privacy’ debates that may result in the approval of only a fraction of important protocols.

The net result of the three bodies of US law is that there are many sources of legal requirements that impact researchers’ access to data for purposes of epidemiologic research. And because responsibil-ity for complying with these requirements generally focuses on the data source, any one of multiple laws can become a roadblock to the conduct of research. In effect, there is no legal or organizational frame-work that holds the plethora of laws together in a way that offers straightforward principles for protecting the public interest in the conduct of epidemiologic and outcomes research while protecting the data subjects’ privacy interests.

Contact Us, Privacy Policy, Terms and Compliant, DMCA Policy and Compliant

TH 2019 - 2025; Developed by Therithal info.