A newly amended version of the bipartisan 21st Century Cure bill, which seeks to advance medical innovation, has overcome its first Congressional hurdle: it was passed unanimously by the House Committee on Energy and Commerce on May 21 without any revisions to the bill’s controversial provisions.
The bill would make significant changes to the HIPAA Privacy Rule, with new legislation that calls for the Secretary of Health and Human Services to revise or clarify HIPAA's stipulations on the use of protected health information (PHI) for research purposes. Essentially, this would allow covered entities or business associates as defined by HIPAA to use or disclose PHI for research purposes without patient authorization. The goal of these changes is to remove research barriers and to support research that could lead to promising advances in medical treatments and devices. As the current HIPAA Privacy Rule stands, PHI can only be used or disclosed by certain covered entities for the purposes of healthcare treatment, payment, and other operations without first getting authorization from the patient.
The new legislation, while promising furthered research into medical advances, does of course raise a number of privacy concerns. Michelle DeMooy, deputy director of the privacy project of the Center for Democracy & Technology, pointed out that “because the bill also promotes the advancement of personalized medicine...that research undoubtedly will involve use of highly sensitive, highly identifiable genetic data.” DeMooy added that one possible solution to this could be adding to the legislation certain data de-identification requirements that would prevent researchers from being able to identify or contact individuals whose health information they have. Even so, many privacy advocates still wonder about where the field of medicine could be headed if healthcare providers, insurers, and business associates can sell health information or control how it is disclosed.
The same version of the bipartisan 21st Century Cure bill was first passed on May 14 by the health subcommittee of the House Committee on Energy and Commerce. Now that it has been passed by the full House committee, the next step is for it to see the full House of Representative for approval. If the bill is passed, it will mean updated policies regarding PHI for healthcare entities and business associates who want to take advantage of the greater flexibility to use and disclose protected health information for research.