Legal Issues in Human Subject Research

1. Legal Issues in Human Subject Research By Cinead Kubiak 2010 Annual IRB Board Member Training

2. Disease Reporting Reporting AIDS and HIV Testing Mandatory Disease Reporting Mandatory Reporting of Cancer

3. Reporting AIDS and HIV Testing Health Care Providers must report AIDS or HIV infection to the Utah Dept. of Health. Guidelines provide details of reporting and details of IRB authority to grant exemption from reporting requirement. • Investigators complete the HIV Testing Checklist and disclose mandatory reporting in the consent document. • Board Members verify that disclosure of mandatory reporting is made in the consent document. In rare cases, Board Members may grant exemption from reporting requirements. Language from IRB’s consent template: ‘If HIV testing is performed as a result of study participation, state that additional consent will be required for the University of Utah Hospitals and Clinics or PCMC (as applicable) which describes how results will be given to the participant and the methods or opportunities participants will be given for appropriate counseling and medical care.’

4. Mandatory Disease Reporting Health care providers are required to report communicable diseases within 24 hours of concluding that a report is required (refer to http://health.utah.gov/epi/report.html for a current list of Utah’s reportable diseases). • If testing is performed for any communicable or infectious diseases reportable by Utah State law as a result of study participation, Investigators disclose mandatory reporting in the consent document. • Board Members verify disclosure of mandatory reporting that is made in the consent document. Language from IRB’s consent template: If testing is performed as a result of study participation for any communicable or infectious diseases reportable by Utah State law, the following must be addressed in this section (refer to http://health.utah.gov/epi/report.html for a current list of Utah’s reportable diseases): • Tell the participant about the state reporting. • Describe how results will be given to the participant to comply with state reporting requirements. • Describe the methods or opportunities participants will be given for appropriate counseling and medical care.

5. Mandatory Reporting of Cancer All hospitals, radiation therapy centers, and other facilities and health care providers are required to report to the Department of Health new cases of cancer within six months of diagnosis. • If an Investigator is a health care provider who diagnoses cancer in a patient, he/she is responsible for the mandatory reporting of cancer as described. • No verification necessary by Board Members.

6. Criminal Reporting Mandatory Reporting of Injury as a Result of Criminal Conduct Mandatory Reporting of Child Abuse Mandatory Reporting of Abuse of Vulnerable Adult

7. Mandatory Reporting of Injury as a Result of Criminal Conduct Any health care provider who cares for any person who suffers from an injury resulting from criminal conduct (including as gunshot wounds, stabbings, explosive devices), shall immediately report to a law enforcement agency the facts regarding the injury. • It is not possible to predict when a health care provider will care for a person who suffers from an injury resulting from criminal conduct. If an Investigator is a health care provider, he/she is subject to mandatory reporting of injury as a result of criminal conduct as described. • No verification necessary by Board Members.

8. Mandatory Reporting of Child Abuse Any person that has reason to believe that a child has been subjected abuse, or neglect, or who observes a child being subjected to conditions or circumstances which would reasonably result in sexual abuse, physical abuse, or neglect, shall immediately notify the nearest law enforcement agency, or office of the Division of Child and Family Services. • If an Investigator has reason to believe a child has been abused, neglected or observes a child being subjected to conditions which would reasonably result in abuse or neglect, he/she must report such observations as described. Since it is not possible to predict the observation of abuse or neglect, if a study involves the possibility of the disclosure of abusive situations, Investigators should include language regarding the reporting of abuse in the consent document. • Board Members verify language regarding the reporting of abuse is in the consent document, if applicable. Language from IRB’s consent template: In some cases this section must include a statement about mandatory reporting of confidential information such as when the researcher is legally obligated to reveal instances of child abuse, elder abuse, or abuse of the disabled. If your study involves the possibility of disclosure of abusive situations, the following mandatory language from the Department of Health and Human Services must be inserted: ‘However, if you disclose actual or suspected abuse, neglect, or exploitation of a child, or disabled or elderly adult, the researcher or any member of the study staff must, and will, report this to Child Protective Services (CPS), Adult Protective Services (APS) or the nearest law enforcement agency.’

9. Mandatory Reporting of Abuse of Vulnerable Adult Any person who has reason to believe that any vulnerable adult has been the subject of abuse, neglect, or exploitation shall immediately notify Adult Protective Services intake or the nearest law enforcement agency. • If an Investigator has reason to believe a vulnerable adult has been abused, neglected or exploited, he/she must report such observations as described. Since it is not possible to predict the observation of abuse or neglect, if a study involves the possibility of the disclosure of abusive situations, Investigators should include language regarding the reporting of abuse in the consent document. • Board Members verify language regarding the reporting of abuse is in the consent document, if applicable. Language from IRB’s consent template: In some cases this section must include a statement about mandatory reporting of confidential information such as when the researcher is legally obligated to reveal instances of child abuse, elder abuse, or abuse of the disabled. If your study involves the possibility of disclosure of abusive situations, the following mandatory language from the Department of Health and Human Services must be inserted: ‘However, if you disclose actual or suspected abuse, neglect, or exploitation of a child, or disabled or elderly adult, the researcher or any member of the study staff must, and will, report this to Child Protective Services (CPS), Adult Protective Services (APS) or the nearest law enforcement agency.’

10. Privacy Genetic Testing Privacy Act

11. Genetic Testing Privacy Act According to Utah law, special protection applies with regard to genetic information. The law places restrictions on the use/disclosure of private genetic information to employers and to health insurers. Issues regarding privacy and confidentiality constitute a large portion of the potential risks in genetic research. Such risks include • Discovery of non-paternity • Negative impact on the participants’ insurability or employability • Social discrimination

12. Genetic Testing Privacy Act (cont.) The investigator must provide a plan to protect privacy and confidentiality in the new study application and the consent document, addressing the following considerations: • Investigators must establish a method to secure information related to genetic testing in a highly secure and confidential manner, and communicate this method in a manner satisfactory to the IRB and the participant. The investigator must specify who will have access to genetic results, limiting access only to those who will need the results to appropriately conduct the research. • For studies that may discover non-paternity, a plan must be described for protecting the rights and privacy of the participants and their family members. The investigator may choose to withhold all knowledge of non-paternity from the participant. This should be adequately conveyed in the consent document. • Genetic results obtained through the study may be required by the IRB to be excluded from the participants’ medical records, in order to prevent inadvertent disclosure to insurance companies or employers. If genetic results will be included in the medical record, participants must be informed of this in the consent document. • Genetic studies which involve the long-term storage of specimens, genetic material, or data in tissue banks must follow the Tissue Banking Guidelines to ensure confidentiality. • Investigators may want to consider acquiring a Certificate of Confidentiality, if appropriate (see IRB guidance on Certificates of Confidentiality). • Results must be sufficiently anonymized to ensure privacy to participants (and family members) when the time comes for the investigator to publish the results of the study.

13. Genetic Testing Privacy Act (cont.) Disclosing Results to Participants: • Information developed in the course of genetic studies may vary considerably with respect to its impact and value to subjects. Investigators should not disclose genetic results to participants or their physicians if the results are not clinically relevant (i.e., the claimed association between marker or gene and disease is generally accepted by the medical genetics community). The purpose of the study should be conveyed to the participants appropriately in the consent document and genetic results must not be indicated as medically important if the value and reliability of the results has not been established. • If the investigator intends to disclose results to participants, the method should be described in the protocol summary and consent document. Written information in conjunction with other methods of disclosure is preferred by the IRB when disclosing results. Keep in mind that when participants are informed about the results of their genetic testing, complete anonymity is virtually impossible to accomplish, and additional protections for privacy and confidentiality may be needed. See: http://www.research.utah.edu/irb/guidelines/pdf/Genetic_Research_A1509.pdf • Investigators should consider the protections provided by law regarding the disclosure of genetic information when writing the risks and confidentiality sections of the informed consent document. • Board Members review the consent document to ensure the genetic guidelines are met.

14. Consent for Medical Treatment HIPAA Consent to Health Care Advanced Health Care Directive Act Emancipation Consent of Minors

15. HIPAA To protect patient privacy, “covered entities” (all health plans, health care “clearinghouses,” and health care providers) must obtain specific, written authorization from a patient to use or disclose PHI. Patients must also be notified about their right to restrict the use and disclosure of such information. Covered entities must make reasonable efforts to limit the health information disclosed to the minimum necessary to accomplish the intended purposes.Options for Conducting HIPAA-Compliant Research: • Obtain HIPAA authorization from individuals to use their protected health information (PHI) • Use a de-identified Data Set that contains no PHI • Use a Limited Data Set with an effective Data Use Agreement in place as applicable • Obtain an IRB Waiver of (HIPAA) Authorization

16. HIPAA (cont.) PHI Identifiers: 1. Names 2. Geographic subdivisions smaller than a state if it contains less than 20,000 people (the initial three digits of the zip code are allowed). This includes street address, city, county, precinct, and zip code (or equivalent geocodes). The initial three digits of a zip code may be included if, according to the currently publicly available data from the Bureau of Census the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people, and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to “000” 3. Dates - All elements of dates (except year) for dates directly related to an individual (including birth date, admission date, discharge date, date of death), and all ages over 89 (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older 4. Telephone numbers 5. Fax numbers 6. E-mail addresses 7. Social security numbers 8. Medical record numbers 9. Health plan beneficiary numbers 10. Account numbers 11. Certificate or license numbers 12. Vehicle identifiers, serial numbers, and license plate numbers 13. Device identifiers and serial numbers 14. Internet Universal Resource Locators (URLs) 15. Computer Internet Protocol (IP) addresses 16. Biometric identifiers 17. Full-face photographs and comparable images 18. Any other unique identifying number, characteristic, or code, except as permitted for re-identification of the de-identified data

17. HIPAA (cont.) Language from IRB’s consent template: AUTHORIZATION FOR USE OF YOUR PROTECTED HEALTH INFORMATION Include the Authorization section as outlined: Signing this document means you allow us, the researchers in this study, and others working with us to use information about your health for this research study. You can choose whether or not you will participate in this research study. However, in order to participate you have to sign this consent and authorization form. This is the information we will use: Modify the following list as appropriate – delete or add items as necessary. <<Name>> <<Address>> <<Telephone number>> <<Family medical history>> <<Allergies>> <<Current and past medications or therapies>> <<Information from a physical examination, such as blood pressure reading, heart rate, breathing rate, and temperature>> <<All other tests and procedures that will be performed in the study>> <<Any other personal health information that will be obtained from other sources to be used in the research record, including prior medical history, tests or records from other sites>> Others who will have access to your information for this research project are the University’s Institutional Review Board (the committee that oversees research studying people) and authorized members of the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center, Primary Children’s Medical Center, Shriners Hospital >> who need the information to perform their duties (for example: to provide treatment, to ensure integrity of the research, and for accounting or billing matters).

18. HIPAA (cont.) Use one of the following 2 disclosure options, as applicable: Disclosure Option 1: If you might disclose PHI to anyone outside the University, Primary Children’s Medical Center and/or Shriners use the following language: In conducting this study, we may share your information with groups outside the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center, Primary Children’s Medical Center, Shriners Hospital >>. The information we share may include information that directly identifies you. These are the groups: Modify this list as appropriate - delete or add items as necessary. For EACH LISTING, include a brief description of WHY they will receive the information. The examples below are suggestions and may be used as applicable. • Other local hospital(s) that we are working with: <<list VA Salt Lake City Health Care System or any other local hospitals where information could be shared>> who are working with the investigators in studying the impact of this treatment; • Other academic research centers we are working with: <<list all other academic centers including those at the University that may not be within UUHSC, and explain their roles in project>>who are working with the investigators in studying the economic impact of this treatment; • <<Name of group or company>>, a research data coordinating office that is responsible for collecting results and findings from all the researchers; • <<Name of group or company>>, a pharmaceutical company that will use the results for submissions to the Food and Drug Administration; • <<Name of agency>>, a federal agency that needs to confirm the accuracy of the results submitted to the government. • <<Name of group or company>>, a contract research organization, whose job is to review and correct any mistakes before the results are given to the sponsor or government; • <<name any other groups and why they will receive the results>> Information disclosed to groups outside the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center, Primary Children’s Medical Center, Shriners Hospital >>may no longer be covered by the federal privacy protections. Disclosure Option 2: If you not going to disclose PHI to anyone outside the University of Utah Health Sciences Center, Primary Children’s Medical Center and/or Shriners Hospital, describe how you will protect and share de-identified information. The next 2 paragraphs are sample statements. Include one of the following or a similar statement, as applicable. Example: If we share your information with anyone outside the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center, Primary Children’s Medical Center, Shriners Hospital >> you will not be identified by name, social security number, address, telephone number, or any other information that would directly identify you, unless required by law. Example: In records and information disclosed outside of the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center, Primary Children’s Medical Center, Shriners Hospital >> your information will be assigned a unique code number. We will keep the key to the code <<state how code is kept e.g. “in a locked file”, “in a password protected computer,” etc.>>. We will destroy the key to the code at the end of the research study.

19. HIPAA (cont.) Include the following verbatim: You may revoke this authorization. This must be done in writing. You must either give your revocation in person to the Principal Investigator or the Principal Investigator’s staff, or mail it to <<insert name and mailing address of PI>>. If you revoke this authorization, we will not be able to collect new information about you, and you will be withdrawn from the research study. However, we can continue to use information we have already started to use in our research, as needed to maintain the integrity of the research. Include the following paragraph if participants will not have access to their information during the study: You have a right to information used to make decisions about your health care. However, your information from this study will not be available during the study; it will be available after the study is finished. Include one of the following 2 sentences: This authorization does not have an expiration date. This authorization lasts until this study is finished.

20. Consent to Health Care Lists the persons who are authorized and empowered to consent for any health care not prohibited by law. • If Investigators must obtain consent from a legally authorized representative (including permission of a parent/guardian), the investigator must establish that the consenting individual has the legal authority to do so. • Board Members review the consent document to ensure the LAR signature block is present. Language from IRB’s consent template: This signature block for Legally Authorized Representatives (LAR) is only used for populations unable to provide informed consent. Only use the LAR signature block if it has been explained in the new study application (subject to approval by the IRB). Delete this if you do not plan to enroll participants using an LAR. If the participant is unable to give consent and authorization, consent and authorization is given by the authorized personal representative of the individual:  LEGALLY AUTHORIZED REPRESENTATIVE CONSENT STATEMENT: I confirm that I have read this consent and authorization document. I have had the opportunity to ask questions and those questions have been answered to my satisfaction. I am willing and authorized to serve as a surrogate decision maker for ______________________________________ Participant’s Name  I have been informed of my role and my obligation to protect the rights and welfare of the participant. I understand that my obligation as a surrogate decision maker is to try to determine what the participant would decide if the participant were able to make such decisions or, if the participant’s wishes cannot be determined, what is in the participant’s best interests. I will be given a signed copy of the consent and authorization form to keep. ______________________________________ Name of Authorized Personal Representative ______________________________________ _____________ Signature of Authorized Personal Representative Date Indicate the legal representative’s authority to act for the individual: □ Spouse □ Adult (18 years of age or over) for his or her parent □ Individual with power of attorney □ Guardian appointed to make medical decisions for individuals who are incapacitated

21. Advance Health Care Directive Act Utah recognizes special power of attorney documents and medical directives in which individuals can provide advance directives of medical care in the event the individual is not able to make his or her wishes known. Through power of attorney documents, an individual can also name another individual who can consent on his or her behalf. • If Investigators must obtain consent from a legally authorized representative, the investigator must establish that the consenting individual has the legal authority to do so. • Board Members should verify that the LAR signature block is present in the consent form. Language from IRB’s consent template: See LAR section in Consent Template (previous slides)

22. Emancipation A person 16-years of age or older may petition the court to obtain the legal status of emancipation. The common law doctrine of emancipation is accepted unless it conflicts with the statutes or constitutions of the United States or of Utah. The common law doctrine of emancipation is accepted unless it conflicts with the statutes or constitutions of the United States or of Utah. • If an individual under the age of 18 is emancipated, he or she is not considered a child as defined by federal regulations, in which case Subpart D does not apply. Investigators should contact general counsel for guidance regarding emancipated youth.

23. Consent of a Minor to Treatment for Sexually Transmitted Disease A minor, regardless of his or her age, is authorized under Utah law to consent to medical care for diagnosis or treatment for a sexually transmitted disease. This holds true even if the results of the test are ultimately negative. A person under the age of 18 is no longer considered a child as defined by federal regulations and Subpart D does not apply if he/she is seeking treatment for a sexually transmitted disease (provided that the research is directly related to the condition).

24. Consent of Minor to Treatment for Pregnancy and Childbirth Any female, regardless of age, has authority to consent to health care when given for treatment of her pregnancy or childbirth. This does not extend to health care decisions regarding abortion. A person under the age of 18 is no longer considered a child as defined by federal regulations and Subpart D does not apply if he/she is seeking treatment for a pregnancy or childbirth (provided that the research is directly related to the condition). This does not extend to health care decisions regarding abortion.