45 CFR 164 - SECURITY AND PRIVACY

The Office of the Secretary of the Department of Health and Human Services (HHS) in coordination with the Office of Science and Technology Policy (OSTP) is extending the comment period for an advance notice of proposed rulemaking (ANPRM) requesting comment on how current regulations for protecting human subjects who participate in research might be modernized and revised to be more effective. That ANPRM was published in the Federal Register on July 26, 2011.

The Office of the Secretary of the Department of Health and Human Services (HHS) in coordination with the Office of Science and Technology Policy (OSTP) is issuing this advance notice of proposed rulemaking (ANPRM) to request comment on how current regulations for protecting human subjects who participate in research might be modernized and revised to be more effective. This ANPRM seeks comment on how to better protect human subjects who are involved in research, while facilitating valuable research and reducing burden, delay, and ambiguity for investigators. The current regulations governing human subjects research were developed years ago when research was predominantly conducted at universities, colleges, and medical institutions, and each study generally took place at only a single site. Although the regulations have been amended over the years, they have not kept pace with the evolving human research enterprise, the proliferation of multi-site clinical trials and observational studies, the expansion of health services research, research in the social and behavioral sciences, and research involving databases, the Internet, and biological specimen repositories, and the use of advanced technologies, such as genomics. Revisions to the current human subjects regulations are being considered because OSTP and HHS believe these changes would strengthen protections for research subjects.

The Department of Health and Human Services (HHS or “the Department”) is issuing this notice of proposed rulemaking to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule's standard for accounting of disclosures of protected health information. The purpose of these modifications is, in part, to implement the statutory requirement under the Health Information Technology for Economic and Clinical Health Act (“the HITECH Act” or “the Act”) to require covered entities and business associates to account for disclosures of protected health information to carry out treatment, payment, and health care operations if such disclosures are through an electronic health record. Pursuant to both the HITECH Act and its more general authority under HIPAA, the Department proposes to expand the accounting provision to provide individuals with the right to receive an access report indicating who has accessed electronic protected health information in a designated record set. Under its more general authority under HIPAA, the Department also proposes changes to the existing accounting requirements to improve their workability and effectiveness.