HIPAA and Collection of Data and Tissues for Future Use
Unlike the consent form, which may seek permission for the present and future uses of identified or coded data or tissues for research purposes [link], HIPAA Research Authorization Forms cannot be “blanket,” all-inclusive authorizations. Both the NIH guidance and the HIPAA guidance agree that the Research Authorization Form may not be for “unspecified research” or “future, unspecified projects,” but must “pertain only to a specific research study.” In addition, HIPAA prohibits “compound” or single authorizations for the primary study and for future research (secondary studies) involving data and tissue samples collected for use in the primary study when the provision of research-related treatment, payment, or eligibility for benefits is conditioned on participation in the primary study. In these cases, investigators should develop a second HIPAA Research Authorization Form covering the development of the database or repository. The reason for the use and disclosure of personal health information in the second HIPAA Research Authorization Form (covering the secondary studies of the banked data or tissue samples) would be for future research as related to the condition of interest. A broad description (e.g., cancer, mental illness) is favored over a specific description, so that future research is not unnecessarily limited.
A final consideration for investigators when developing a data or tissue repository is under what circumstances to combine the consent and HIPAA Research Authorization Form. If the purpose of the protocol is solely for banking of specimens, then a compound or single form would suffice as the consent and HIPAA form for this stand-alone study.