The 21st Century Cures Act, which aims to streamline development and evaluation of new drugs and devices, also contains some language that raises privacy concerns, Kirk Nahra, partner at law firm Wiley Rein, tells HealthcareInfoSecurity.
In particular, he mentions four provisions, two of which he says probably would be positive but raise few privacy questions. One of those would make it easier for researchers to gain access to information to develop study protocols, making that process available electronically on par with the paper process.
The second would allow patients to authorize use of their data to be used for future research, rather than for just a specific study.
Two other provisions, he tells HealthcareInfoSecurity, are more complicated and "raise a lot of questions about whether they're good ideas and whether they're addressing problems that need to be dealt with in terms of privacy rules."
One of those addresses an issue in HIPAA that Doug Fridsma, M.D., president and chief executive officer of the American Medical Informatics Association, spoke about previously: that if a hospital, for instance, determines that a surgical checklist reduces post-operative infections in its patients, that finding cannot be published as a research paper without the consent of every patient studied.
The 21st Century Cures language, however, allows a hospital to share all research conducted as part of a hospital's operations with any other covered entity, such as another hospital, pharmaceutical company or insurer, according to Nahra. He calls that a very broad fix to a small problem.
Another provision allows disclosures of health information for research purposes to pharmaceutical companies and medical device makers and seems to allow them to pay an unlimited amount of money for that data, something that currently is not allowed.
"I don't think selling off all your PHI to the highest bidder who wants to do research is going to end up being a smart way to do things," he says.
Nahra is not the only person to point out that the legislation raises privacy concerns. Privacy attorney David Holtzman and Deborah Peel, founder of Patient Privacy Rights, also previously talked about their issues with the Cures Act.
Still others have criticized the bill for encouraging the Food and Drug Administration to use nontraditional study designs and shorter or smaller clinical trials for drugs and medical devices. And several groups are unhappy about what the bill left out, including a unique patient identifier.
To learn more:
- listen to the interview