LSHC Horizons Brochure 2024 - Flipbook - Page 41
Hogan Lovells | 2024 Life Sciences and Health Care Horizons | Privacy and Cybersecurity
Secondary use of research data in the U.S.
We have all this data—can we use it? This is a
common question given the potential value of
data. Several factors affect whether data from a
research study may be used for secondary research
in the United States.
Consent: One key consideration is whether
the secondary use falls within the informed
consent form (ICF) obtained for the initial study.
Sometimes a secondary use is part of the main
study or the ICF includes specific consent for the
intended secondary research use.
IRB waiver: If consent for the secondary use of
data was not obtained, an Institutional Review
Board (IRB) may be able to waive the ICF and
Health Insurance Portability and Accountability
Act (HIPAA) authorization, subject to certain
requirements. If consent was requested, however,
and a subject refused, the IRB may not waive the
subject’s consent.
State law: State health information privacy and
sensitive condition laws could impose additional
requirements, particularly for genetic data or
genetic testing. Some state laws even provide
individuals with property rights in their genetic
information. Applicable state laws should be
carefully assessed.
Melissa B. Levine
Counsel
Washington, D.C.
De-identification: If the data will be fully deidentified in accordance with HIPAA and relevant
research regulations, this helps mitigate risk,
including under state law. Thus, consideration
should be given for whether de-identified data can
be used. Note, however, that coded data may not
be considered fully de-identified under HIPAA.
Other restrictions: Applicable clinical trial or
other agreements may limit use of research data.
In addition, if the data was collected from outside
the U.S., it may be subject to restrictions under the
laws of the country of origin.
Each of these considerations should be assessed
to determine the permissibility of a secondary use
of data. Including permission for secondary uses
in ICFs from the start helps maximize the ability
to use research data for such purposes. While
the language can be broad, some description is
necessary under the Common Rule and HIPAA,
which require sufficient information that a
reasonable person would expect their information
to be used. Secondary research consent can be
part of the main study ICF—an opt-in is not
required. This could cause some individuals not
to participate in the main study but eases the
operational burdens of tracking who opted-in
to the secondary research uses.
41
