Developing Language to Communicate Privacy and Confidentiality Protections to Potential Clinical Trial Subjects: Meshing Requirements under Six Applicable Regulations, Laws, Guidelines and Funding Policies

By SRAI JRA posted 04-04-2019 18:12

  

Volume L, Number 1

Developing Language to Communicate Privacy and Confidentiality Protections to Potential Clinical Trial Subjects: Meshing Requirements under Six Applicable Regulations, Laws, Guidelines and Funding Policies

Authors

Fanny K. Ennever
Compliance Department, Boston Medical Center
Sean Nabi
Compliance Department, Boston Medical Center
Patricia A. Bass
Office of General Counsel, Boston Medical Center
Lilly O. Huang
Office of General Counsel, Boston Medical Center
Emily C. Fogler
Partner, Verrill Dana, LLP

Introduction

An effective process for satisfying the ethical obligation to obtain informed consent for participation in clinical research requires that potential subjects be informed about the consequences of agreeing to be part of the research (Lentz, Kennett, Perlmutter, & Forrest, 2016). Consent processes and forms must include a description of privacy and confidentiality protections and need to disclose the possibility that private information collected for the research will become known outside the research context. The confidentiality section of consent forms generally must adhere to requirements from at least six different sources: from the Federal Policy for the Protection of Human Subjects (“Common Rule” [HHS, 2005; 2017]; including changes with a general compliance date of January 21, 2019), from the Food and Drug Administration (“FDA”) regulations for the Protection of Human Subjects (FDA, 1981), from the International Council for Harmonisation (“ICH” [ICH, 1996, 2016]), from regulations under the Health Insurance Portability and Accountability Act (“HIPAA” [HHS 2000a, 2000b]), from regulations concerning Confidentiality of Substance Use Disorder Patient Records (“Part 2” [HHS, 2018a]), and from the 21st Century Cures Act (“Cures Act” [Cures Act, 2016]) and associated National Institutes of Health (“NIH”) funding policy on Certificates of Confidentiality (NIH, 2017a). In addition, many states have laws and regulations concerning the privacy or confidentiality of specific types of health information (Mello, Adler-Milstein, Ding, & Savage, 2018).

The precipitating event for addressing the harmonization of the confidentiality requirements was NIH’s implementation of the Cures Act requirement to provide Certificates of Confidentiality for all NIH funded research (NIH, 2017b). The language suggested by NIH for consent forms (2017c) has a Flesch-Kincaid Grade Level score of 19 (post-graduate level; Wolf & Beskow, 2018), and is presented in isolation, without guidance or a model for integration with other privacy or confidentiality requirements.

At Boston Medical Center (“BMC”) and Boston University (“BU”) Medical Campus, which share a Human Research Protection Program (“HRPP”), our previous consent forms addressed each requirement in a separate section. In considering how to incorporate the Cures Act language much more frequently, some examples were found of templates that combine the Common Rule and Cures Act language (NIH, 2018) or the Common Rule and HIPAA language (Boston Children’s Hospital IRB, 2018), or that simplify the Cures Act language (Wolf & Beskow, 2018). However, none that we found integrated the presentation of confidentiality and privacy requirements in a manner that reduced redundancy and addressed inconsistencies among the requirements.

An overall requirement for consent forms is that they are “in language understandable to the subject or legally authorized representative” (HHS, 2005, §46.116; HHS, 2018b, §46.116[a][3]), “written in plain language” (HHS, 2000b, §164.508[c][3]), “and organized and presented in a way that does not merely provide lists of isolated facts, but rather facilitates the prospective subject’s or legally authorized representative’s understanding of the reasons why one might or might not want to participate” (HHS, 2018b, §46.116[a][5][ii]). We felt that simply adding Certificate of Confidentiality language to our existing template would not be consistent with these requirements. This article describes the revision of our consent template to mesh the applicable requirements into an integrated explanation of how subjects’ identifiable information will be handled.

Methods

The process of revising the existing consent form privacy and confidentiality language to incorporate all requirements started with the realization that merely adding NIH’s suggested Certificate of Confidentiality language (NIH, 2017c), or using a simplified version (we considered using the same simplified language as University of Nevada, Reno; Wolf & Beskow, 2018, p. 355), would not meet our goal of being understandable to subjects. Three of the authors of this article (FKE, PAB, LOH) were the main individuals involved in the development of the template, with consultation during the process by ECF and review of the completed template by SN. The development process also involved review by our HRPP Advisory Committee, and the final version was approved by our Institutional Review Board (“IRB”) Executive Board.

In developing the integrated template, we identified all pertinent requirements, including both the definitions of what made information identifiable, and the elements, information, and statements that should be included in the consent form. Table 1 lists the definitions of what makes information identifiable from the six different sources, ranging from what is arguably the narrowest definition, in the Common Rule, to the broadest definition, in the Cures Act. Table 2 lists the relevant requirements for the content of consent forms from these six sources.

Revisions to the existing consent template required numerous drafts, trying out different simplifications and rearrangements, with particular attention to removing redundancies and reconciling potential contradictions among the requirements (the Discussion section addresses the four major issues we confronted). Each draft was checked for reading level (using the Flesch-Kincaid grade level scoring tool that is embedded in Microsoft Word) and for compliance with the requirements in Tables 1 and 2, and assessed for overall readability and understandability in the judgement of the authors and additional reviewers. Our consent form template is structured to be useable in a variety of circumstances depending on the details of a particular study (whether biospecimens are obtained, whether information will be placed in the subject’s medical record, whether information subject to mandated reporting is gathered, etc.). Extending this structure to incorporate the variables needed for the discussion of privacy and confidentiality was an additional challenge of this project, which was addressed by grouping variable sections and making extensive use of parenthetical directions to users of the template.

Table 1. Definitions of Identifiability

Table 2. Consent Form Requirements

Table 2b: Consent Form Requirements

Table 2C: Consent Form Requirements

Table 2d: Consent Form Requirements

Results

The consent form confidentiality and HIPAA sections that we developed are presented in Tables 3-5. The example used is for an NIH-funded clinical trial that obtains identifiable information and biospecimens, that will place study information in the subjects’ medical records, that follows ICH-GCP guidelines, that plans to share information with other researchers, that gathers information that must be reported to external public health or public safety authorities, that may obtain consent from a legally authorized representative, and that will use and disclose PHI, including substance use disorder records from a federally-assisted program. Underlined, italicized words indicate study-specific details to be completed by the investigator. Bracketed sentences indicate directions to the person preparing the consent form about the inclusion of specific items. The full templates are available from the BMC and BU Medical Campus IRB (2018) website: http://www.bumc.bu.edu/irb/inspir-ii/irb-templates/.

Table 3. Consent Form Template Confidentiality Section

Table 3a: Consent Form Template Confidentiality Section

Table 3b: Consent Form Template Confidentiality SectionTable 3c: Consent Form Template Confidentiality SectionTable 3d: Consent Form Template Confidentiality SectionTable 3e: Consent Form Template Confidentiality Section

Table 4. Consent Form Template Use and Disclosure of Your Health Information (HIPAA) Section
Table 4A: Consent Form Template Use and Disclosure of Your health Information (HIPAA) SectionTable 4b: Consent Form Template Use and Disclosure of Your health Information (HIPAA) SectionTable 4c: Consent Form Template Use and Disclosure of Your health Information (HIPAA) SectionTable 4d: Consent Form Template Use and Disclosure of Your health Information (HIPAA) SectionTable 4e: Consent Form Template Use and Disclosure of Your health Information (HIPAA) SectionTable 4f: Consent Form Template Use and Disclosure of Your health Information (HIPAA) SectionTable 4g: Consent Form Template Use and Disclosure of Your health Information (HIPAA) Section

Table 5. Consent Form Template Signature Section
Table 5: Consent Form Template Signature Section

Discussion

This process of producing the template was considered complete when the IRB Executive Board approved the template. The input of the community member was particularly valuable in assessing the understandability of the language. The other Executive Board members, including highly experienced Chairs and the IRB Director, agreed that the template was in compliance with applicable requirements for describing privacy and confidentiality in consent forms, and that the integrated discussion was an improvement over the previous template’s approach of having a separate section for each requirement.

Four issues were particularly challenging to address, three because of tension between the requirements, and the fourth because of the unfamiliar concept of Certificates of Confidentiality.

The first issue was the requirement under the Common Rule for a statement about future uses of deidentified data (HHS, 2018b, §46.116[b][9][i]) versus the Cures Act’s very expansive definition of what makes data identifiable (Cures Act, 2016; Wolf & Beskow, 2018). The final template addressed this issue by the following language in the Confidentiality section: “We will share research data where we have removed anything that we think would show your identity. There still may be a small chance that someone could figure out that the information is about you.” The first sentence contains the required Common Rule statement, and the second sentence has the effect of obtaining consent for sharing information that could be considered identifiable under the Cures Act.

The second issue was that the subject’s consent for research information to be shared for medical treatment is required under the Cures Act but not under HIPAA. The final template addressed the requirement for consent by placing the following language in the Confidentiality section for studies with a Certificate of Confidentiality: “We will record information from this study in your medical record, such as information related to your medical care.” In the HIPAA section, although authorization/consent is not required to use or disclose information for treatment, to maintain consistency with the Confidentiality section, the final template included the following bullet in the list of people who may use or disclose PHI: “Other people within Boston Medical Center and Boston University who may need to access your health information to do their jobs such as for treatment, research administration, payment, billing, or health care operations.”

The third issue was the requirement under HIPAA to state that HIPAA protections do not necessarily apply after information has been disclosed (HHS, 2000b, §164.508[c][2][iii]) versus the Cures Act requirement that the Certificate of Confidentiality protections apply to all copies of the research data disclosed for research purposes (but not for medical treatment; HHS, 1944, §241[d][1][F]). The protections for information that has been shared for research purposes were addressed by the following statement in the Confidentiality section in the final template (for all studies, whether or not they have a Certificate of Confidentiality): “If you agree to be in the study and sign this form, we will share information and biological samples that may show your identity with the following groups of people: …People who will get information and biological samples from us: name(s) and affiliation(s). These people are expected to protect your information and biological samples in the same way we protect it.” The non-protected status of information disclosed for treatment purposes was addressed by the following statement in the Confidentiality section (for studies with Certificates of Confidentiality): “You should know that once information has been put into your medical records, it is not covered by the CoC. However, information in your medical records is protected in other ways.” The requirement to state that HIPAA may not apply when information is disclosed from the Covered Entity was addressed by the following statement in the HIPAA section: “We ask anyone who gets your health information from us to protect the privacy of your information. However, we cannot control how they may use or share your health information. We cannot promise that they will keep it completely private.” This statement in the HIPAA section brings forward the concept from the Confidentiality section that the recipients of the research data are expected to protect the data, before adding the caveat that confidentiality is not guaranteed.

The fourth issue was describing the protections afforded by a Certificate of Confidentiality in a way that avoided conveying the idea that a subpoena of research records was likely. In our and other’s experiences (Wolf & Beskow, 2018; Check, Wolf, Dame, & Beskow, 2014), potential subjects can be confused about why their research information might be incriminating enough to be subpoenaed when discussing a consent form that contains the standard NIH Certificate of Confidentiality consent language (NIH, 2017c). If the study does not collect data that a subject would consider sensitive, and has a Certificate of Confidentiality only because it is funded by NIH, as in the example discussed in this paper, the final template states: “All studies funded by the National Institutes of Health that involve identifiable information or biological samples are covered by a CoC. … Even if someone tries to get your information or biological samples in connection with a legal proceeding, we cannot give it to them.” In order to minimize the discussion of legal proceedings, the exception that subjects can give permission for release in legal proceedings is not called out explicitly, but is conveyed by two other statements: “The CoC does not prevent you from sharing your own research information,” and “If you agree to be in the study and sign this form, we will share information and biological samples that may show your identity with the following groups of people: … Any people who you give us separate permission to share your information.” One helpful change in the Cures Act (2016) is that we no longer have to consider mandatory reporting under state laws as “voluntary,” because “required by law” state reporting is an exclusion from the disclosure prohibitions of a Certificate of Confidentiality (Wolf & Beskow, 2018; HHS, 1944, §241[d][1][C][i]). In our experience, describing mandatory reporting as “voluntary” was confusing to our investigators, many of who are mandatory reporters under various state abuse and disease reporting laws (Commonwealth of Mass., n.d.).

Due to the inconsistent requirements and complex concepts required to be conveyed, writing these sections of the consent form in simple language was also challenging. The attempt to reduce the reading level of the template, a well-known concern for confidentiality language (Wolf, Dame, & Beskow, 2018; Check, 2014), was only partially successful: the paragraphs ranged from the 8th to the 10th grade Flesch-Kincaid reading level, compared to the 19th grade reading level of the suggested language on the NIH Certificate of Confidentiality website (Wolf & Beskow, 2018). In addition, some redundancy remained, especially in statements about who will see identifiable information and the exceptions to confidentiality if research information will be subject to mandatory reporting requirements.

Conclusions

Although we could have been compliant with the various requirements by simply adding the Certificate of Confidentiality language as another section of our consent form templates, we set a goal of providing an understandable discussion of the privacy and confidentiality provisions to our research subjects, which still met all regulatory requirements for a valid consent and authorization. We did not have the resources to undertake a study to assess research subjects’ understanding of confidentiality protections after consent processes using this and other language. However, the individuals involved in the development and review of the language had extensive experience in human subjects protection, and the final approval was from the IRB Executive Board that included a community member.

Our process and the resulting language (available on our website: http://www.bumc.bu.edu/irb/inspir-ii/irb-templates/ is only one way to integrate the varying requirements, and other solutions are certainly possible. We hope that this example may encourage other IRBs to explore the possibility of improving the understandability of the privacy and consent sections of consent forms.

Acknowledgements

The consent form template language was developed with valuable input from members of the HRPP Advisory Committee and IRB Executive Board, particularly Joyce Samet and Lincoln Larmond. John Ennever and the peer reviewers provided helpful comments on the manuscript.

Funding

This project did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors.

Fanny K. Ennever
Compliance Department, Boston Medical Center
720 Harrison Avenue, 6th floor
Boston, MA 02118
Email: Fanny.Ennever@bmc.org

Sean Nabi
Compliance Department, Boston Medical Center
720 Harrison Avenue, 6th floor
Boston, MA 02118
Email: Sean.Nabi@bmc.org

Patricia A. Bass
Office of General Counsel, Boston University
125 Bay State Road
Boston, MA 02115
Email: Patricia.Bass@bmc.org

Lilly O. Huang
Office of General Counsel, Boston University
125 Bay State Road
Boston, MA 02115
Email: lohuang@bu.edu

Emily C. Fogler
Partner, Verrill Dana, LLP
One Boston Place
Boston, MA 02108
Email: efogler@verrilldana.com

Correspondence concerning this article should be addressed to Fanny K. Ennever, Compliance Department, Boston Medical Center, 720 Harrison Avenue, 6th floor, Boston, MA 02118, Fanny.Ennever@bmc.org.

References: 

Boston Children’s Hospital, Institutional Review Board (IRB). (2018). Informed consent. Retrieved October 17, 2018, from http://www.childrenshospital.org/research/institutional-review-board/information-for-researchers/informed-consent.

Boston Medical Center and Boston University Medical Campus Institutional Review Board. (2018). IRB templates. Retrieved October 17, 2018, from http://www.bumc.bu.edu/irb/inspir-ii/irb-templates/

Check, D. K., Wolf, L. E., Dame, L. A., & Beskow, L. M. (2014). Certificates of Confidentiality and informed consent: Perspectives of IRB chairs and institutional legal counsel. IRB: Ethics & Human Research, 36(1), 1-8. Retrieved from https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4076050/pdf/nihms582610.pdf

Commonwealth of Massachusetts. Disclosure by Psychologists (M.G.L. c. 112 § 129A), Disclosure by Psychotherapists (M.G.L. c. 233 § 20B), Disclosure by Social Workers (M.G.L. c. 112 §§ 135, 135A, 135B), Licensed marriage, family, rehabilitation, and mental health counselors and educational psychologists (M.G. L. c. 112 § 172), Domestic Violence Victims Communications (M.G.L. c. 233 § 20K), Disclosure of Rape Victim Counseling (M.G.L. c. 233 § 20J), Venereal Disease (M.G.L. c. 111 § 119), and Genetic Testing (M.G.L. c. 111 § 70G[d]).

Cures Act (21st Century Cures Act), Pub. L. 114-255, §§ 2012-2013, codified as 42 U.S.C 241(d), (f), 114th Cong., H.R. 34 (2016).

FDA Protection of Human Subjects Regulations, 21 C.F.R. § 50 (1981).

HHS Confidentiality of Substance Use Disorder, Patient Records, 42 C.F.R. Part 2 (2018a).

HHS Federal Policy for the Protection of Human Subjects (Common Rule – pre-2018 version), 45 C.F.R. § 46, Subpart A (2005).

HHS Federal Policy for the Protection of Human Subjects (Common Rule – 2018 version), 82 Fed. Reg. 7149-7274 (January 19, 2017); 83 Fed. Reg. 28497-28520 (to be codified at 45 C.F.R. § 46).

HHS Federal Policy for the Protection of Human Subjects, 45 C.F.R. (2018b).

HHS General Administrative Requirements, 45 C.F.R. § 160 (2000a).

HHS Public Health Services Act, 42 U.S.C. § 241 (1944).

HHS Security and Privacy 45 C.F.R. § 160, 164 (2000b).

International Council for Harmonisation (ICH). (1996, June 10). Guideline for good clinical practice E6(R1). Retrieved from https://www.ich.org/fileadmin/Public_Web_Site/ICH_Products/Guidelines/Efficacy/E6/E6_R1_Guideline.pdf

International Council for Harmonisation (ICH). (2016, November 9). Integrated addendum to ICH E6(R1): Guideline for Good Clinical Practice: E6(R2). Retrieved from http://www.ich.org/fileadmin/Public_Web_Site/ICH_Products/Guidelines/Efficacy/E6/E6_R2__Step_4_2016_1109.pdf

Lentz, J., Kennett, M., Perlmutter, J., & Forrest, A. (2016). Paving the way to a more effective informed consent process: Recommendations from the Clinical Trials Transformation Initiative. Contemporary Clinical Trials, 49, 65-69. https://doi.org/10.1016/j.cct.2016.06.005

Mello, M. M., Adler-Milstein, J., Ding, K. L., & Savage, L. (2018). Legal barriers to the growth of health information exchange – Boulders or pebbles? The Milbank Quarterly, 96(1), 110-143. https://doi.org/10.1111/1468-0009.12313

National Institutes of Health (NIH), Certificates of Confidentiality Policy, Notice Number: NOT-OD-17-109 (September 7, 2017a).

National Institutes of Health (NIH). (2017b, October 2). Certificates of Confidentiality (CoC): Background information. Retrieved October 17, 2018, from https://humansubjects.nih.gov/coc/background

National Institutes of Health (NIH). (2017c, December 11). Suggested consent language describing the CoC protections. Retrieved October 17, 2018, from https://humansubjects.nih.gov/coc/suggested-consent-language

National Institutes of Health (NIH), National Cancer Institute. (2018). Informed consent. Retrieved October 17, 2018, from https://ctep.cancer.gov/protocolDevelopment/informed_consent.htm

Wolf, L. E., & Beskow, L. M. (2018). New and improved? 21st Century Cures Act revisions to Certificates of Confidentiality. American Journal of Law & Medicine, 44(2-3), 343-358. https://doi.org/10.1177/0098858818789431

Keywords: 

Informed Consent, Confidentiality, Privacy, Common Rule, Certificate of Confidentiality, HIPAA


#JournalofResearchAdministration
#VolumeLNumber1
0 comments
24 views

Permalink