/ Homepage / Members Only / Medical-Legal Affairs / Coded Genetic Research
Coded Genetic Research
Compliance Guidelines for Health Care Provider
The guidelines were developed by Gwen Dayton, Oregon Association of Hospitals and Health Systems General Counsel and with her permission we have adopted it in whole but have added references to OMA and its members where appropriate. We are grateful to OAHHS and Gwen for their assistance and cooperation.
DHS Fact Sheet for Health Care Providers
DHS Fact Sheet for Patients
Example Notification and Opt-Out Statement and Form
(to present to patients)
Senate Bill 1025
Definitions of SB 1025 Final Rules
Coded Genetic Research Opt-Out Q & A
Genetic Coding Opt-Out Notice
Q. Who must provide the notice?
A. All health care providers who:
• Collect biological specimens or clinical individually identifiable information from patient;
• Are HIPAA covered entities; and
• Have a direct treatment relationship with an individual. OAR 333-025-0165
Q. What must I notify the patient of?
A. The law provides that health care providers must notify an individual or their personal representative that their biological specimen or clinical individually identifiable health information may be used for anonymous or coded genetic research and give the individual or the personal representative an opportunity to opt out of such use. (See attached form)
Q. Must I document that the notice is provided?
A. The law does not specifically require such documentation, but does require that the health care provider have “a process” to comply with the law. OAR 333-025-0165(10). For this reason and general good practice, health care providers should document in the patient’s record or chart notes that the notice was provided. Consider documenting this notice in the same way as you document provision of the HIPAA Notice of Privacy Practices.
Q. The new "Opt Out" requirement for physicians regarding patients labs being used for genetic testing will be very cumbersome. Do you think we would be covered if I were to get letters from all labs indicating that they destroy all lab and tissue specimen from patients once our tests are completed?
A. Oregon Department of Human Services' administrative rules are clear that covered providers must provide patients with notice of opt-out regardless of whether labs agree to destroy tissue samples.
Q. What is “clinical individually identifiable information” and do I collect it?
A. The administrative rules provide that “clinical” means relating to or obtained through the actual observation, diagnosis, or treatment of patients and not through research. “Identifiable” or “individually identifiable” means capable of being linked to the individual or a blood relative of the individual from whom the biological sample or health information was obtained, including
demographic information that identifies the individual, or for which there is a reasonable basis to believe the information can be used to identify an individual. OAR 333-025-0100.
Essentially, clinical individually identifiable information means health information about a patient. Virtually all health care providers collect clinical individually identifiable information.
Q. What if I do not do any genetic research?
A. The law still applies to you. The intent behind the law is to advise an individual up front that their biological specimen or clinical individually identifiable health information may down the line be used for anonymous or coded genetic research so the individual can opt out from that use. Often research is done by someone other than the provider who originally obtained the specimen or health information used for the research.
Q. Which health care providers do not have to provide the notice?
A. A provider who is not a HIPAA covered entity. These providers may comply with the notice requirement but are not required to. An example of a person who is a health care provider but not necessarily a HIPAA covered entity is a publicly employed Emergency Medicine Technician (EMT) who never bills for services or the increasingly rare physician who runs an entirely paper practice.
An indirect health care provider.
Q. What is an “indirect health care provider”?
A. The administrative rules define an indirect provider to be a health care provider having a relationship with an individual in which:
a. The health care provider delivers health care to the individual based on the orders of another health care provider; and
b. The health care provider typically provides services or products, or reports the diagnosis or results associated with the health care, directly to another health care provider, who provides the services or products or reports to the individual. OAR 333-025-0100(26).
Relatively clear examples of indirect treatment providers are:
A radiologist at an outside imaging facility who delivers care pursuant to the orders of another physician and who reports diagnosis or results directly back to the physician. A radiologist who provides independent advice to the patient would be considered a direct care provider.
A pathologist at an outside laboratory who evaluates a patient’s information pursuant to a physician’s order and reports results directly back to the physician.
A phlebotomist at an outside laboratory who takes blood and reports results back to the physician associated with tests run on the blood.
But what about:
A physical therapist providing follow up treatment for a patient initially treated in the community? This provider would be considered a direct provider because they are delivering health care directly to the patient, even if that care is pursuant to an order from a physician. Remember that a health care provider providing care in a facility that has already given the notice need not provide another one.
A durable medical equipment (DME) provider? It depends. The central questions in answering this question are whether the DME provider is a health care provider covered by HIPAA and whether the provider delivers care based on an order from another health care provider, and provides the service directly to another health care provider rather than to the patient.
• A DME provider who provides equipment directly to a physician in response to the physician’s order likely is an indirect provider.
• A DME provider who provides equipment based on an order from another health care provider but provides the equipment directly to the individual rather than to the ordering health care provider likely is a direct provider.
• Some DME providers may not be HIPAA covered entities, and thus not required to give the notice, because they do not engage in electronic transactions.
Remember that an in-house DME provider may rely on the notice given by the in-house health care provider who ordered the DME and need not give a separate notice.
A retail pharmacist? A retail pharmacist likely would be considered a direct provider. While a retail pharmacist typically is responding to a prescription written by another health care provider, the pharmacist provides services directly to the individual, not to the ordering health care provider.
External registries? External registries, such as cancer registries or trauma registries, generally do not qualify as an indirect provider that must be notified of an opt out. They are not acting as a health care provider.
Q. What information or language must be in the notice?
A. Administrative rules implementing the law provide that the notification must include:
a. A place where the individual may mark to indicate the individual’s opt out statement;
b. A general explanation of the meaning of anonymous and coded research;
c. A statement describing that the biological specimen or clinical individually identifiable health information may be used at some undetermined point in the future without further notice to the individual;
d. A statement that a refusal to allow use of biological specimens or clinical individually identifiable health information will not affect access to or provision of health care by the provider originally providing notice;
e. A statement specifying that the individual retains the right to make or revoke an opt-out statement by submitting in writing such a request to the health care provider originally providing notice;
f. A statement indicating that an opt-out statement will be valid from the date received by the health care provider;
g. A prominent heading indicating the purpose of the notice; and
h. The name, or title, and telephone number or other contact information of a person or office to contact for further information. OAR 333-025-0165(7)
In addition to including the above information, also remember:
• Make sure you print the notice in the languages you have determined are relevant in your area.
• Make sure your notice is written in plain language and is in sufficiently large font that individuals can read and understand the notice.
To assist providers with the notice requirement, the Department of Human Services (DHS) has developed a model notice for providers to use if they wish. You may access this document on the OMA’s website in the Members Only, Medical-Legal Affairs Section, under “Genetic Coded Research Opt-Out,” www.theoma.org/page.asp?navid=379.
Q. In what form should the notice be provided?
A. The law does not require providers to give the notice in any particular form.
Options include:
• A stand alone notice. The general consensus is this option is the most workable.
• Including the notice in the HIPAA Notice of Privacy Practices. This solution does not work particularly well as it would require reprinting of the existing HIPAA notice as well as reprinting and framing of the many-framed HIPAA notices posted by the health care provider.
Q. When must the notice be given?
A. The law provides that the notice must be provided no later than the time required for federal privacy notices by the Federal Privacy Rule for services rendered on or after July 1, 2006. OAR 333-025-0165(3). This means notice must be given to an established patient the next time services are provided to such patient on or after July 1, 2006. For new patients, the notice must be given at the time initial services are provided to the patient.
Q. Who should give the notice?
A. The law assigns responsibility to provide the notice to the health care provider. The best option is to give the notice at the time the individual is initially seen. In the case of established patients, the health care provider should give the notice to patient the next time services are provided to the patient on or after July 1, 2006. (See attached form).
Q. My staff does not know anything about genetics. What resources are available to help them answer patient questions?
A. The Department of Human Services (DHS) has developed a Consumer Fact Sheet for use in assisting patients with questions, and a Provider Fact Sheet for use in assisting providers with complying with the notice requirements. You may access these documents on the OMA’s website in the Members Only, Medical-Legal Affairs Section, under “Genetic Coded Research Opt-Out,” www.theoma.org/page.asp?navid=379.
Q. What if the patient is incapacitated and unable to receive the notice?
A. The law provides that you may give the notice to the individual or the individual’s personal representative. OAR 333-025-0165(1) If no personal representative is present, provide the notice using the same procedures as established for providing the HIPAA Notice of Privacy Practices to a patient who is not immediately able to receive it.
Q. What if the individual is deceased when the health care provider obtains the individual’s biological specimen or clinical individually identifiable health information?
A. The law provides that a researcher may use an individual’s DNA sample or genetic information that is derived from a biological specimen or clinical individually identifiable health information for anonymous or coded research if the individual was deceased when the individual’s biological specimen or clinical individually identifiable health information was obtained. ORS 192.540. While ORS 192.540 does not reference whether the health care provider must provide notice and opportunity to opt out, it is reasonable to assume that if the researcher does not require consent to use the individual’s DNA or genetic information for research the health care provider need not provide notice and opt out to the individual’s personal representative before disclosing the individual’s biological specimen or clinical individually identifiable health information. If a personal representative is available, however, the cautious approach would be to provide the notice and opportunity to opt out.
Q. How often must the notice be provided?
A. Just once, even if you see the patient multiple times. OAR 333-025-0165 (4). Document that the notice has been given so you do not provide it multiple times.
Q. How and where is the fact that the notice is given, and the response, documented?
A. Health care providers may establish procedures that work best within their existing documentation procedures. Generally speaking, documentation that the notice is given should be maintained in the same manner as documentation of other notices required to be given to patients such as the HIPAA Notice of Privacy Practices.
If a patient opts out from the use of specimens or clinical information, that opt out should be maintained in such a manner that future users of the specimen or information are notified of the opt out. (See later material in these guidelines about notification of indirect providers and downstream users of an opt out).
Q. Must health care providers delivering care in a Hospital provide a separate notice and an opportunity to opt out to patients they see in the Hospital?
A. No, but they must do so when the patient visits the provider in the provider’s community office. OAR 333-025-0165(5). Note that this administrative rule says “if a health care facility provides the notice pursuant to Section (1) of this rule, a health care provider providing care to patients in the health care facility is not required to provide an additional notice with respect to services provided in the facility.” It is advisable for physicians treating patients in a hospital to provide an opt out notice for the patient, unless that patient has already signed the form in a previous visit.
Opt Out
Q. How does the health care provider allow the individual to opt out?
A. The law provides that an individual must have the opportunity to actually mark that the individual wishes his or her biological specimen or clinical individually identifiable health information to be withheld from use in anonymous or coded genetic research. This “mark” may take a variety of forms. Consider:
• A check box next to language in the notice describing the opt out.
• A signature at the bottom of the notice designating an opt out.
• A signature on a separate opt out form.
A health care provider may allow the patient to return the opt out form by mail rather than fill it out at the time notice is provided to the patient.
Q. When must the patient decide and can they change their mind?
A. In a perfect world the patient would make the opt out decision at the time the notice is provided. We do not live in that world. Because of the complexity of the issue and the multitude of other forms the patient is given at the patient’s initial visit, many patients may want to take the information home and consider the issue. Health care providers should understand this reality and incorporate it into their procedures. For example, health care providers should consider allowing a patient to mail back an opt out statement rather than require it on the spot. If a patient is allowed to take the opt out form with them the provider should have a procedure for documenting and tracking the date that the notice was given to the patient and the patient choose to take the opt out form with him or her. At a minimum this information should be noted in the patient’s chart.
Q. What if the patient takes the opt out form with him or her and has not returned it?
A. In the event the patient does not return the opt out form within 14 days after the notice is given to the patient the health care provider may assume the patient does not intend to opt out. OAR 333-025-0165(9).
Tracking the Opt Out
Q. Must I notify indirect providers who receive my patient’s biological specimen or clinical information of an opt out?
A. Yes. The law provides that you must, at the time you disclose the biological specimen or clinical individually identifiable health information, inform the indirect provider that is the intended recipient that the individual’s biological specimen or clinical individually identifiable health information is subject to an opt out statement. OAR 333-025-0165(9)
Q. Must I notify indirect providers who reside out of the state of Oregon?
A. Yes. The law requires Oregon health care providers to notify indirect providers who are the intended recipient of an individual’s biological specimen or clinical individually identifiable health information of an opt out. The law does not create an exception for notification of indirect providers who reside out of the state of Oregon.
Q. What if I receive an opt out statement after the patient’s biological specimen or clinical information has already been transferred to indirect providers?
A. If you receive an opt out statement from a patient after biological specimen or clinical information has already been transferred to indirect providers, you must comply with the patient’s opt out in a prospective manner. This means you are not required to go back and give notice of the patient’s opt out to indirect providers whom you previously provided biological specimen or clinical information, but you must comply with giving notice of the opt out to indirect providers to whom you provide biological specimen or clinical information to after your receipt of the opt out. OAR 333-025-0165(9).
In the event you receive a patient’s opt out within 14 days of the date notice was provided to the patient, you are encouraged but not required to make a good faith effort to inform the indirect health care provider to whom you previously provided biological specimen or clinical information of the opt-out statement. OAR 333-025-0165(9).
Q. What is the best way to notify indirect providers of an opt out?
A. The law provides that methods to inform the indirect provider may include, but are not limited to, marking or noting the biological specimen container or clinical individually identifiable health information as subject to an opt out. OAR 333-025-0165(9)
Consider:
• Marking a specimen container with a colored sticker.
• If a patient’s clinical information is held in paper form, mark the file with a colored sticker.
• Mark the face sheet with an opt out and send the face sheet out with all specimens or clinical information.
• If a patient’s clinical information is held and transferred electronically, include a field to mark that the patient opted out.
• Maintain a registry of all patients who have opted out and establish a requirement that indirect providers check this registry.
Q. What about clinical information or biological specimens collected prior to July 1, 2006? Must we go back and provide notice and opportunity to opt out?
A. No. The requirement to provide notice and opportunity to opt out begins July 1, 2006.
Q. Are we required to make sure researchers are actually notified of an opt out?
A. No. You are only required to have a process in place to comply with the rules. OAR 333-025-0165(10)
Q. As a practical matter, how are researchers actually notified of an opt out when information used in anonymous and coded research is not linked to an identified person?
A. A researcher performing anonymous or coded research likely will not receive a subject’s medical record with an opt out sticker or similarly marked biological specimen or electronic medical record because anonymous and coded research does not identify the individual(s) supplying the information used in the research. While health care providers are not required to ensure researchers are actually notified of an opt out, they should consider removing any information subject to opt out from the stream of information made available to researchers. Researchers will then be able to presume that any information they receive is not subject to opt out.
Enforcement
Q. What could happen to me if I don’t get this done right or on time?
A. The genetic privacy statutes contain criminal as well as civil penalties. None of these penalties, however, appear to directly apply to the requirement to notify individuals of their right to opt out of disclosure of their clinical individually identifiable health information or biological specimen and notify indirect providers. See, ORS 192.541, 192.543 and 192.545.
Despite the apparent lack of enforcement authority, OAHHS and the OMA want to impress on all hospitals, physicians, and other health care providers the importance of compliance with this and all other laws.
This document modified with permission from the Oregon Association of Hospitals and Health Systems (OAHHS).
Disclaimer: These Guidelines do not constitute legal advice, nor do they establish an attorney/client relationship with the author. While every effort was made to ensure the accuracy and timeliness of all information contained in these Guidelines, neither the author nor OAHHS nor the Oregon Medical Association make any express or implied representations or warranties about the accuracy or timeliness of this information for any purpose or the suitability of this information for use. These Guidelines are suggestions only and do not establish a formal standard of compliance. A health care provider that does not follow these Guidelines is not necessarily out of compliance with the law.
|
(48.9KB)