[Federal Register Volume 68, Number 216 (Friday, November 7, 2003)]
[Notices]
[Pages 63110-63111]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 03-28044]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

[Docket No. 2003D-0204]


Guidance for Industry: Institutional Review Board Review of 
Stand-Alone Health Insurance Portability and Accountability Act 
Authorizations; Availability

AGENCY: Food and Drug Administration, HHS.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA) is announcing the 
availability of a document entitled ``Guidance for Industry: IRB Review 
of Stand-Alone HIPAA Authorizations Under FDA Regulations,'' dated 
October 21, 2003. The guidance document provides clarification for 
institutional review boards (IRBs) of their responsibilities for 
reviewing and approving stand-alone authorizations under the Health 
Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy 
Rule. A stand-alone HIPAA authorization is a document used to obtain 
permission from an individual for a covered entity to use and/or 
disclose the individual's identifiable health information for a 
research study and that is not combined with an informed consent 
document to participate in the research itself. This guidance is 
intended to encourage IRBs to permit enrollment of subjects in clinical 
investigations without the IRB's prior review and/or approval of stand-
alone HIPAA authorizations, even under circumstances in which the IRB's 
written procedures require such review and/or approval. Because FDA has 
determined that prior public participation is not feasible or 
appropriate, this guidance document will be implemented upon posting on 
FDA's Web site.

DATES: Submit written or electronic comments on agency guidances at any 
time.

ADDRESSES: Submit written comments on the guidance document to the 
Division of Dockets Management (HFA-305), Food and Drug Administration, 
5630 Fishers Lane, rm. 1061, Rockville, MD 20852.
    Submit electronic comments to http://www.fda.gov/dockets/ecomments. 
See the SUPPLEMENTARY INFORMATION section for electronic access to the 
guidance document.
    Submit requests for the guidance document to the Division of 
Dockets Management at the address provided. Your request should include 
the docket number in the heading of this document.

FOR FURTHER INFORMATION CONTACT: Catherine Lorraine, Office of the 
Commissioner (HF-11), Food and Drug Administration, 5600 Fishers Lane, 
Rockville, MD 20857, 301-827-3360.

SUPPLEMENTARY INFORMATION:

I. Background

    FDA is announcing the availability of a document entitled 
``Guidance for Industry: IRB Review of Stand-Alone HIPAA Authorizations 
Under FDA Regulations,'' dated October 21, 2003. This guidance is 
similar to a guidance published by the Office of Civil Rights, 
Department of Health and Human Services (HHS), entitled ``Privacy 
Guidance about Authorizations for Research and Institutional Review 
Boards,'' which is available on the HHS Web site at http://www.hhs.gov/ocr/hipaa. (FDA has verified the Web site address, but is not 
responsible for subsequent changes to the Web site after this document 
publishes in the Federal Register.) The Privacy Rule is a Federal 
regulation implementing certain provisions of the HIPAA (Public Law 
104-191), that protects the privacy of certain health information (see 
45 CFR parts 160 and 164). The Privacy Rule is a comprehensive set of 
minimum requirements intended to safeguard individually identifiable 
health information while permitting important research and health care 
activities to continue. The Privacy Rule went into effect on April 14, 
2003.
    The Privacy Rule establishes the right of individuals, including 
research subjects, to authorize the use and disclosure of their 
protected health information by signing an authorization form for uses 
and disclosures not otherwise permitted by the Privacy Rule (see 45 CFR 
164.508). For example, in the context of a clinical investigation, a 
valid and properly executed HIPAA authorization explains the ways in 
which a subject's protected health information will be used and 
disclosed by the clinical investigator and permits the clinical 
investigator to use and disclose that information as specifically 
described in the authorization. An HIPAA authorization is different 
than a subject's informed consent in that an HIPAA authorization 
focuses on uses and disclosures of information that may

[[Page 63111]]

be made. Informed consent, on the other hand, apprises potential 
research subjects of the possible risks and benefits associated with 
participating in the clinical investigation and, when executed, 
indicates their willingness to participate in the clinical 
investigation and their understanding of those risks and benefits. The 
Privacy Rule permits but does not require clinical investigators to 
combine an HIPAA authorization with informed consent documents, known 
as a compound authorization (see 45 CFR 164.508(b)(3)).
    FDA and the HHS Secretary received requests for clarification of 
IRBs' responsibilities to review and approve stand-alone HIPAA 
authorizations under the Privacy Rule, Federal regulations governing 
human subject protection and IRBs (see 45 CFR part 46 and parts 50 and 
56 (21 CFR parts 50 and 56)), and international guidelines (see, for 
example, International Conference on Harmonisation (ICH) Good Clinical 
Practice guidelines (E6)). The requests expressed concern that when the 
Privacy Rule went into effect, clinical investigations might be impeded 
because IRBs would be backlogged with requests to review thousands of 
stand-alone HIPAA authorizations. The requests further stated that some 
IRBs would halt enrollment in clinical investigations pending their 
review of these stand-alone HIPAA authorizations.
    In response, the Office of Civil Rights, HHS, issued a letter, 
dated April 15, 2003, clarifying that IRBs are not required to review 
and approve stand-alone HIPAA authorizations under the Privacy Rule, 
HHS Protection of Human Subjects Regulations at 45 CFR part 46, ICH 
guidelines, or FDA regulations, so long as an IRB's written procedures, 
adopted under Sec.  56.108(a), do not require such review and approval. 
The letter also announced FDA's intent to publish guidance on this 
subject, in accordance with its good guidance practice regulations.
    FDA is issuing this guidance to address those cases in which IRBs 
have adopted written procedures that would require them to review and 
approve stand-alone HIPAA authorizations. Under Sec.  56.108(a), IRBs 
must follow their written procedures. The guidance announces FDA's 
intention to exercise ongoing enforcement discretion with respect to 
the requirements of Sec.  56.108(a) to the extent that an IRB's written 
procedures require the review and/or approval of stand-alone HIPAA 
authorizations. FDA is exercising this discretion in order to encourage 
IRBs to permit the continued enrollment of subjects in clinical 
investigations without IRBs' prior review and approval of stand-alone 
HIPAA authorizations. FDA believes that enrollment in well-designed and 
well-conducted clinical investigations should not be interrupted for 
the purpose of IRB review and approval of stand-alone HIPAA 
authorizations. Accordingly, FDA does not intend to take enforcement 
actions against IRBs that decide not to review stand-alone HIPAA 
authorizations even though the IRB's written procedures would otherwise 
require this review and/or approval. FDA's exercise of enforcement 
discretion in these limited circumstances is intended to allow 
important studies to proceed in the best interests of the public 
health.
    This guidance is being issued consistent with FDA's good guidance 
practices regulation Sec.  10.115 (21 CFR 10.115). This guidance 
document represents the agency's current thinking on IRBs' 
responsibilities under FDA regulations for reviewing and approving 
stand-alone HIPAA authorizations. It does not create or confer any 
rights for or on any person and does not operate to bind FDA or the 
public. An alternative approach may be used if it satisfies the 
requirements of the applicable statutes and regulations.

II. Comments

    FDA is issuing this document as a final guidance that will be 
implemented upon posting on FDA's Web site. In accordance with Sec.  
10.115(g)(2) and (g)(3), FDA is implementing this guidance prior to 
seeking public comment because the agency has determined that this 
guidance is needed in conjunction with the HHS Office of Civil Rights 
guidance to help ensure that ongoing clinical trials are not halted 
while IRBs review HIPAA stand-alone authorizations, and therefore, 
prior public participation is not feasible or appropriate. However, FDA 
will review comments received after issuance of the guidance and revise 
the document when appropriate.
    Interested persons may, at any time, submit written or electronic 
comments to the Division of Dockets Management (see ADDRESSES) 
regarding this guidance document. Two paper copies of mailed comments 
are to be submitted, except individuals may submit one copy. Comments 
should be identified with the docket number found in the brackets in 
the heading of this document. A copy of the document and received 
comments are available for public examination in the Division of 
Dockets Management between 9 a.m. and 4 p.m., Monday through Friday.

III. Electronic Access

    Persons with access to the Internet may obtain the document at 
either http://www.fda.gov/oc/gcp/guidance.html or http://www.fda.gov/ohrms/dockets/default.htm.

    Dated: October 31, 2003.
Jeffrey Shuren,
Assistant Commissioner for Policy.
[FR Doc. 03-28044 Filed 11-6-03; 8:45 am]
BILLING CODE 4160-01-S