Privacy is protected in biobank-based research in the US primarily by the Health Insurance Portability and Accountability Act Privacy Rule and the Federal Policy for Protection of Human Subjects. Neither rule, however, was created to function in the unique context of biobank research, and therefore neither applies to all biobank-based research. Not only is it challenging to determine when the HIPAA Privacy Rule or the Common Rule apply, but these laws apply different standards to protect privacy. In addition, many other (...) federal and state laws may be applicable to a particular biobank, researcher, or project. US law also does not directly address international sharing of data or specimens outside of the EU–US Safe Harbor Agreement, which only applies to receipt of data by certain US entities from EU countries, and is in the process of revision. Although new rules would help clarify privacy protections in biobanking, any implemented changes should be studied to determine the sufficiency of the protections as well as its ability to facilitate or hinder international collaborations. (shrink)

The HIPAA Privacy Rule is notoriously weak because of its incomplete coverage, numerous exclusions and exemptions, and limited rights for individuals. The three areas in which it provides the most protection are fundraising, marketing, and research. Provisions of the 21st Century Cures Act, pending in Congress, and the Notice of Proposed Rulemaking to amend the federal research regulations, awaiting final regulatory action, would weaken the privacy protections for research. If these measures are adopted, the HIPAA Privacy Rule would have so (...) little value that it might not be worth the aggravation and burden. (shrink)

In financial disputes involving research, the parties are traditionally individual researchers and their institutions, biotech and pharmaceutical companies, and other entities engaged in the commercial development of biomedical research. Occasionally, research subjects claim that researchers have misled them or misappropriated their biological materials to derive financial gain. The best known example is the case of Moore v. Regents of the University of California, decided in 1990.With new developments in genomics, large-scale repositories of tissue and other biological specimens are increasingly important. (...) Biobanks have been established by various researchers, commercial entities, health-care institutions, and even entire countries. Individuals who contribute specimens almost always retain no commercial interest in any resulting research and language to that effect is now customarily included in informed consent documents signed at the time the specimen is given. Suppose, however, that the research subjects actually collect the specimens themselves, recruit the researcher, and provide financial support for the research. (shrink)

On January 25, 2013, theFederal Registerpublished the Department of Health and Human Services omnibus amendments to the Health Insurance Portability and Accountability Act Privacy, Security, Enforcement, and Breach Notification Rules. These modifications also include the final versions of the HIPAA regulation amendments mandated by the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act. Although the amended rules were effective on March 26, 2013, covered entities and their business associates have a compliance date of (...) September 23, 2013.It has been 10 years since the April 14, 2003 compliance date for the original HIPAA Privacy Rule. Despite HHS’ clarification of some issues by posting answers to frequently asked questions, there have been no significant amendments to the Privacy Rule since 2003. (shrink)