CLIA and Its Restrictions on Returning Individual Results

Laboratories in the United States that perform tests on human specimens for the purpose of providing information for the diagnosis, prevention, or treatment of a disease or for the assessment of the health of an individual are regulated by CLIA¹⁰ and are required by the Centers for Medicare & Medicaid Services (CMS) to be CLIA certified through a process that ensures that certain quality control assurances and requirements are in place (see Chapter 3). CLIA and its associated regulations were put in place to protect patients from harm resulting from inaccurate laboratory testing. Laboratories licensed in states that have enacted laws with requirements equal to or more stringent than those required under CLIA and where CMS has approved the licensure program qualify as CLIA exempt.^11,12 CLIA also allows for an exception from certification requirements in the case of laboratories that conduct tests on human specimens for research purposes and that do not report patient-specific results for the diagnosis, prevention, or treatment of a disease or for the assessment of the health of an individual (CMS, 2014). If laboratories report individual results that could be used for clinical decision making, even if this is not the intended purpose of returning results, CMS has interpreted the regulations to mean that those laboratories must be CLIA certified. These laboratory categories are summarized in Table 6-1.

TABLE 6-1

CLIA Categories of Laboratories.

Many laboratories that generate research results with the potential for use in health care are CLIA certified. For example, CLIA-certified clinical laboratories may be (but are not always)¹³ used to conduct testing on biospecimens collected for clinical trials (Barnes et al., 2015). In such cases, CLIA does not pose any impediment to the return of research results (or to the return of clinical test results generated in the course of a research study). However, a number of potential scenarios in which results are clinically actionable or otherwise valuable to participants could be generated in laboratories that are not CLIA certified (e.g., academic or industry laboratories conducting more basic research, such as biomarker identification, using innovative methodologies that have not yet been validated for clinical use, or laboratories engaged in assay development). Research testing performed in laboratories that are not CLIA certified may create a dilemma for investigators and institutions that feel an obligation to return such results, particularly when they are urgent and might not otherwise be discovered. Under CMS's interpretation of CLIA, investigators would be prohibited from disclosing the results without first becoming CLIA certified. It has been argued that investigators may have a First Amendment right under the U.S. Constitution to share the results of genetic research tests with interested participants as a form of protected free speech (Evans, 2014). However, the validity of this argument has not yet been tested in court (Jarvik et al., 2014), and the potential consequences for CLIA violations may deter investigators from returning results generated in a non-CLIA-certified laboratory. CMS is authorized to impose a civil monetary penalty ($50–$10,000 per day of noncompliance per violation) and can file a civil lawsuit to obtain a court order that prohibits a laboratory from continuing an activity that CMS believes to represent a “significant hazard to the public health.”¹⁴ Although the committee is not aware of any cases where such enforcement actions have been taken against non-CLIA-certified laboratories for the return of research results, CMS recently intervened in the activities of a direct-to-consumer genetic testing firm, directing the company to obtain CLIA certification before providing genetic testing results to consumers (Lee, 2017).

The committee recognizes the importance of ensuring the quality and integrity of laboratory test results. If investigators and their research laboratories plan to offer individual research results to participants, the testing of human biospecimens under an acceptable quality management system is essential (see Recommendation 3). However, as discussed in Chapter 3, expecting all research laboratories to meet CLIA requirements in order to return research results may not be reasonable. The current absolute prohibition on the return of research results from non-CLIA-certified laboratories also fails to account for several factors, including the high quality maintained by some research laboratories, the value that many participants place on results despite uncertain validity, and the access rights afforded by HIPAA to individual results regardless of quality standards. Additionally, there is a paucity of evidence of harm from the return of research results, though as discussed in Chapter 2, the overall body of evidence is limited and “the current state of knowledge reflects lack of evidence, not evidence of a lack of effect.” Thus, as stated in Recommendation 11, it is important for investigators to expand the body of evidence on the benefits and harms associated with the practice as it evolves and becomes more widespread.

CONCLUSION: As many research laboratories are not CLIA certified, CLIA represents a formidable obstacle to the return of individual results to research participants even though the results may meet other quality standards and a right of access to laboratory results has been gaining credibility in other regulatory policies.

Concerns Regarding an Access Right to Research Results Under HIPAA

Since 2000, HIPAA has included a rule that individuals have a right of access to inspect and obtain a copy of their PHI maintained in a designated record set. According to guidance issued in 2002, “any research records or results that are actually maintained by the covered entity as part of a designated record set would be accessible to research participants unless one of the Privacy Rule's permitted exceptions applies” (OCR, 2013b). Prior to 2014, there was an explicit exception from the access right for all HIPAA-covered laboratories “subject to” CLIA and laboratories “exempt from” CLIA.¹⁵ As discussed earlier in this chapter, the 2014 amendment removed both of these exceptions.¹⁶ As a result of this amendment, all laboratories that are part of a covered entity, regardless of their status under CLIA, must now comply with the access right under the HIPAA Privacy Rule.¹⁷ This means that all of an individual's protected health information in the designated record set, regardless of whether it is generated in a clinical laboratory or during the course of research, must be provided to that individual upon request.

This recent regulatory change has been met with mixed reactions and has been a focus of significant controversy. The change has been welcomed by some as a critical step forward in the movement to acknowledge participants' critical contributions to research and to respect their desires to receive information about themselves, even research information. At the same time, however, the increased access has generated concern among some researchers, clinical care providers, and regulators by providing an access right to research results and even uninterpreted data (e.g., genomic sequence data), which may not meet the high standards for quality that are required of clinical test results (Barnes et al., 2015; Evans, 2018a). Laboratories may now be compelled to share research results with unclear meaning (e.g., genomic variants of unknown significance) or questionable validity, raising fears that, without proper context or a clear understanding of the limitations, the receipt of such results could cause undue anxiety or prompt unnecessary intervention. Institutions have also expressed concerns regarding the potential financial impacts of the disclosure requirements on laboratories, because the HIPAA access right is an unfunded federal mandate (Evans, 2018b).

In addition to these concerns, the expanded right of individuals to access their laboratory results under HIPAA creates the potential for conflict with other federal regulations related to the protection of patients and research participants, as discussed below.

HIPAA and CLIA

For those non-CLIA-certified research laboratories that are HIPAA-covered entities, a legal dilemma can arise if a participant requests individual research results that constitute PHI contained within a DRS (the respective obligations of laboratories regarding individual access to laboratory results under CLIA and HIPAA are summarized in Table 6-2). Returning research results that are part of the DRS in order to comply with the expanded HIPAA access rule would force non-CLIA-certified laboratories to either violate CLIA (as currently interpreted by CMS) or forfeit the exception for research laboratories and obtain CLIA certification, which has significant cost and resource implications (Barnes et al., 2015). One researcher who spoke with the committee during its public workshop had compared costs for a large-scale exome sequencing study using CLIA- and non-CLIA-certified laboratories and estimated a three-fold difference in cost for the data generation alone.¹⁸ As discussed in Chapter 3, opportunity costs associated with CLIA certification also pose barriers for many laboratories. HIPAA Privacy Rule violations, which are enforced by the HHS Office for Civil Rights, can be costly, with monetary penalties as high as $50,000 for each day that the covered entity is in violation (Barnes et al., 2015), putting laboratories without the means to obtain and maintain CLIA certification in the difficult position of having to weigh the relative risks of violating CLIA or HIPAA.

TABLE 6-2

Legal Obligations Related to Individual Access to Laboratory Test Results.

To avoid such conflicts, and in the absence of additional guidance from OCR, some research institutions are interpreting the definition of a designated record set to exclude research results and setting policies accordingly. The rationale is presumably that research results are often not used to make decisions about individuals, which is required in order for it to be considered part of the DRS. Johns Hopkins Medicine, for example, has indicated that, based on its interpretation, a research record is not part of the DRS and only information that is entered into a patient's medical record during research would be part of the DRS and therefore subject to the HIPAA access rule (Johns Hopkins Medicine, 2015). Similarly, New York University's Langone Health System has interpreted the definition of the DRS as excluding research results generated in laboratories not certified by CLIA. This approach, which creates variation across institutions in the ability of research participants to access their results, has been facilitated by ambiguity in the definition of the designated record set and a lack of clear guidance from OCR. The Secretary's Advisory Committee on Human Research Protections (SACHRP, 2015) and other groups have called for clarification of the duties of HIPAA-covered entities to provide results from laboratories that are not CLIA certified and for guidance on how the term DRS should be interpreted.

CONCLUSION: The operationalization of HIPAA access rights to include CLIA-exempt laboratories and those operating under the CLIA research exception creates an insoluble conflict between patients' right to access their research results contained within the DRS and non-CLIA-certified laboratories' prohibition from returning such results under the current CMS interpretation of CLIA.

CONCLUSION: OCR has contributed to the confusion of investigators by failing to define the DRS and, specifically, the status of results generated in research laboratories that are not CLIA certified.

Investigational Device Exemption Regulations and Return of Individual Research Results

FDA regulates, among other things, devices “intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals.”²⁰ FDA's investigational device exemption (IDE) offers a regulatory pathway for investigators using an investigational device that has not yet been approved or cleared by FDA for the purposes for which it will be used in a particular study. FDA broadly defines an investigational device as one “that is the object of an investigation”²¹ conducted for purposes of determining safety or effectiveness and involving one or more participants (Federal Register, 1980).

FDA's IDE process is intended to protect the interests of participants whose clinical care might be affected by the results of investigational devices. If a study proposes to use a laboratory test in a manner that has not been cleared or approved by FDA, the investigators, with oversight from their IRB, must determine whether the IDE regulations apply because the test is an investigational device. If so, investigators must next consider whether the study nevertheless qualifies as exempt from IDE regulations. An investigational device that is subject to the IDE regulations is exempt if it is non-invasive and not used for diagnostic purposes without confirmation of the diagnosis by a “medically established” diagnostic product or procedure. If the study does not qualify as exempt, the investigator must determine whether the device poses “significant risk” (i.e., presents a potential for serious risk to the health, safety, or welfare of a participant)²² or “non-significant risk.” Figure 6-1 shows this decision-making process and the implications for IDE requirements.

FIGURE 6-1

Investigational device exemption process for research studies. NOTE: FDA = Food and Drug Administration; IDE = investigational device exemption; IRB = institutional review board; NSR = non-significant risk; SR = significant risk. SOURCE: NHGRI, 2017.

The return of research results to research participants may affect the IDE process in at least two ways. First, in the case of studies involving devices, such as whole-genome sequencing, that are being used for purposes not yet cleared or approved by FDA, it appears that the return of results may play a role in determining whether the IDE regulations apply. A National Human Genome Research Institute (NHGRI) webpage focused on IDE regulations states,

If the investigator does not propose to return results to participants or their physicians, and the results will not otherwise be used to direct or inform the clinical care of that participant, then the investigational device study is exempt from the IDE regulation. (NHGRI, 2017)

Second, the return of research results to research participants may affect the risk classification of a non-exempt investigational device study. This risk classification determines the rigorousness of the requirements necessary to obtain an IDE. An abbreviated process can be used to obtain an IDE for devices that are not significant risk. In determining whether a device poses a significant risk, FDA considers many factors, such as the health status of the population under study and how the information generated by the device will be used in the study, including whether and how results will be returned. In a June 2016 workshop hosted by NHGRI, representatives from FDA explained that the risk of returning investigational device results to healthy volunteers would be considered different from the risks if members of the participant population have a disease or health condition (NHGRI, 2017).²³ The NHGRI resource that reflects information learned from that workshop and the experience of NHGRI grantees describes an example of a significant risk study as one that

might involve genome sequencing of healthy participants with an intent to return variants of unknown significance (VUS). In this instance, the risk might stem from concern that test results with unknown clinical significance would lead healthy individuals to pursue unnecessary treatments that could expose them to harm. If this study design does not also include appropriate risk-mitigating measures, it could be considered SR [significant risk]. (NHGRI, 2017)

The committee is aware of only one reported case, the Newborn Sequencing in Genomic Medicine and Public Health program—North Carolina Study, in which the return of research results to healthy volunteers was a key consideration in FDA's determination that investigators needed to pursue a full IDE (NHGRI, 2016). However, the potential for the return of results to trigger additional regulatory hurdles is an additional barrier for investigators considering returning research results and may incentivize them against return.

FDA has not provided binding guidance on the role of the return of individual research results in the IDE process, including the determination of whether a device is an investigational device or the determination of whether the device poses significant risk. As a result, it is unclear how the IDE regulations actually affect most studies that return results in practice. It is also unclear if and how these analyses will change if investigators return results only in response to individual requests under HIPAA.

CONCLUSION: FDA's interpretation of how the return of individual research results triggers application of the IDE process and affects the risk assessment is unclear. FDA has introduced further confusion by suggesting that the return of individual research results for healthy individuals triggers a significant risk determination, requiring a full IDE.

CONCLUSION: It is unclear how access to individual research results under HIPAA affects FDA's risk assessment for IDEs.

Inconsistent Use of Terminology in Federal Regulations

Terminology that is inconsistent across different regulations can cause unnecessary ambiguity and confusion. The inconsistencies often relate to the process by which laws are written—i.e., different terms with origins in different laws may have the same meaning. In addition to the confusion created by different uses of the term “CLIA exempt,” as mentioned above, at least two other examples of terminology are ambiguous or confusing and need to be harmonized across the relevant regulations.

The first relates to terms used to describe the information that individuals can access under CLIA and HIPAA. The original CLIA access rule provided authorized persons access to “test results” generated in CLIA-regulated and CLIA-exempt laboratories. Of note, “authorized persons” did not include the patients themselves (or their personal representative) except in states that explicitly permitted direct patient access. Under the 2014 CLIA access rule, patients and their personal representatives can now access their “completed test reports.” The term “completed test report” was not defined, but the preamble to the access rule indicated that test results were complete when “all results associated with an ordered test are finalized and ready for release” (Federal Register, 2014, p. 7295). However, how the completed test report differs from the test results that can be accessed by the individuals authorized to order or receive them remains unclear. This ambiguity also contributes to confusion regarding research results that individuals can obtain under the HIPAA access rule, which allows individuals to access their protected health information that is contained within the DRS. The 2014 amendment to the HIPAA Privacy Rule states (in response to a comment) that laboratory test reports do not become part of the designated record set until they are complete.²⁴ Some legal scholars have suggested that OCR could clarify that laboratory research results with uncertain clinical significance would not be considered “complete” and thus excluded from the DRS or, alternatively, could issue guidance that research test results are explicitly included in the DRS regardless of their clinical significance (Barnes et al., 2015).

The second terminology issue relates to the description of the identifiability of results. Federal regulations use different terms based on the standards applied when removing the linking information. According to HHS convention, “de-identified” describes results where the linking information has been removed in accordance with HIPAA standards,²⁵ while “non-identified” refers to results where the linking information has been removed in accordance with the Common Rule, which prescribes standards that are different than HIPAA standards (OHRP, 2016a).²⁶ Adding further confusion is the use of the term “identifiable sensitive information” in the 21st Century Cures Act in reference to certificates of confidentiality.

CONCLUSION: Inconsistent use of terminology by different regulatory agencies creates unnecessary ambiguity and confusion for investigators, institutions, and research participants.

Discrimination Concerns for Research Participants

The possibility that participants who receive individual research results may face discrimination if the results indicate a previously undiagnosed condition (or a genetic predisposition for a condition) is a concern among both proponents and opponents of the practice. Federal and state laws provide some protections for individuals against discrimination on the basis of disabilities, pre-existing conditions, and genetic information, but gaps remain.

First, the Americans with Disabilities Act (ADA) prohibits discrimination against individuals with disabilities in the areas of employment, public services, and public accommodations.²⁷ Specifically, employers are prohibited from “discriminating against individuals who (with or without reasonable accommodation) can perform the essential functions of employment positions in hiring, promotion, training, compensation, and other job-related decisions.”²⁸ Additionally, employers cannot conduct medical examinations or ask questions of job applicants and employees regarding whether they have a disability or the nature or severity of their disability unless the questions are related to the applicant or employee's job.²⁹ However, employers may require individuals to release their health records after making a conditional offer of employment.

The Genetic Information Nondiscrimination Act of 2008 (GINA)³⁰ prohibits discrimination in health insurance and employment contexts based on genetic information, which is defined as information about an individual's genetic tests, about the genetic tests of family members, or about the presence of a disease or disorder in family members. Congress's intent in passing GINA was to remove barriers to genetic testing for personal health and research purposes by providing legal protection against the misuse of genetic test results. GINA expanded protections instituted earlier through HIPAA by prohibiting group and individual insurers from using genetic information to set premiums or make eligibility decisions for individuals or groups. The law further prohibits health plans from requesting or requiring genetic testing prior to an individual's insurance enrollment and from requesting, requiring, or purchasing genetic information for underwriting purposes.³¹

GINA similarly limits both access to and use of genetic information by employers (Prince and Berkman, 2012).³² Thus, employers are prohibited from requesting, requiring, or purchasing genetic information about employees or their family members.³³ Employers also may not use genetic information to make employment decisions (e.g., hiring, firing, promotion, and compensation) or to deprive employees of employment opportunities.³⁴ Finally, employers must treat the genetic information of their employees as confidential medical records that generally may not be disclosed.³⁵

While GINA affords important protections for patients and research participants, it notably does not regulate discrimination based on non-genetic information (e.g., a positive test result for a protein biomarker for Alzheimer's disease) (Arias and Karlawish, 2014). Moreover, GINA is limited to genetic information and does not apply to discrimination based on already expressed genetic conditions, although the Patient Protection and Affordable Care Act closed this loophole in health insurance by prohibiting individual and group insurers from denying coverage based on any kind of pre-existing condition.³⁶ GINA also does not confer protection against the discriminatory use of genetic information by life, disability, or long-term care insurers or in other contexts in which discrimination may occur, such as housing and education. These gaps in GINA's protections may discourage people from participating in biomedical research, particularly when there is the potential to uncover unanticipated findings indicating an increased risk for a health condition (Green et al., 2015).

Most states have sought to augment federal anti-discrimination protections related to genetic information. In a few cases, state laws have focused on preventing discrimination against individuals with specific genetic traits (e.g., sickle cell trait or cystic fibrosis trait), but the majority are more broadly aimed at preventing the discriminatory use of genetic information in employment and insurance decisions. Twenty-four states have enacted laws addressing gaps in GINA's protections by limiting genetic discrimination in life, disability, or long-term care insurance, and California's law further bars discrimination in emergency medical services, housing, mortgage lending, and public education. The implication of this patchwork of statutes is that the protections for research participants who choose to receive their research results will vary by geographic location, and participants will need to understand the anti-discrimination protections in their state.

CONCLUSION: Research participants who choose to receive results from the testing of their biospecimens (or who exercise their right of access under HIPAA) should be informed about the discrimination protections under GINA and the ADA and relevant state laws and what GINA/ADA/state laws do not protect against.

Liability Concerns for Investigators, Laboratories, and Institutions

Survey data have indicated that a fear of legal liability influences investigators' decisions on whether to return individual research results (Ramoni et al., 2013). Concerns regarding the liability associated with not returning results can motivate some investigators to disclose research results to participants, but, at the same time, fears of lawsuits stemming from inaccurate findings or medical mismanagement subsequent to the receipt of results may discourage investigators from returning them.

The legal liability for investigators concerning the return of individual research results most likely appears in the form of tort liability,³⁷ which falls under state law. In the absence of federal regulations or case law directly addressing a researcher's duty to disclose significant research results, investigators and their institutions are left to make difficult decisions about whether and when to return results in the context of significant legal uncertainty surrounding this issue (McGuire et al., 2014).

Considerations for Changes to CLIA Regulations

CLIA regulations serve an important function in ensuring that the clinical results returned to patients are high quality and likely to be accurate. Requiring research laboratories to obtain CLIA certification before returning individual research results similarly increases the likelihood that the research results returned to participants are valid. However, the burdens associated with CLIA certification (e.g., direct costs, human resource requirements) as well as the inconsistencies between some of the CLIA regulations and the functions of a research laboratory create an incentive for investigators to plan not to return results, which, given participants' interest in receiving results, may adversely affect public participation in biomedical research (Crawley, 2001; Hiratsuka et al., 2012; Northington Gamble, 2006). Even in the absence of a plan to return results, investigators and decision makers in their institutions may face a moral dilemma in the event that an unanticipated result generated in a laboratory that is not CLIA certified has implications for the participant's well-being that are so great as to create an ethical imperative to return the result. Moreover, as described above, current conflicting regulatory requirements for CLIA and HIPAA can create legal dilemmas for laboratories that are covered entities, forcing them to choose which of the regulations to intentionally violate in order to comply with the other. Some have suggested that having a plan and allocating funds in the research budget for confirmatory testing in a CLIA-certified laboratory when a need arises to return unanticipated results could help resolve these kinds of dilemmas (Beskow and O'Rourke, 2015; Bookman et al., 2006). However, this assumes that additional samples can be collected from the participant, which is not always possible in research studies, and that a CLIA-certified laboratory is able to validate the research result. For some cutting-edge technologies and novel assays, a validated test in a CLIA-certified laboratory may not be available (Prucka et al., 2015). For example, if the research laboratory is performing a test for a new serum biomarker for a stroke, a CLIA-certified laboratory may not have a validated test for the biomarker. Even when retesting is possible, given the added cost of doing so, the committee does not believe that the possibility of retesting will address the current disincentives for returning research results to participants on a more routine basis. Therefore, the committee considers and describes below proposed changes to the CLIA regulations. In the absence of changes to the CLIA regulations,³⁹ the committee believes that at the very least HIPAA regulations need to be changed or clarified so that non-CLIA-certified laboratories cannot be compelled to disclose PHI in the DRS of questionable analytic validity that are requested by participants. Potential changes to HIPAA regulations are discussed in the next section.

On one end of the range of options is a requirement that all testing on human biospecimens (not just those returning results) be conducted in CLIA-certified laboratories. In addition to removing current disincentives to return research results, resolving any possible CLIA–HIPAA conflict, and increasing confidence in the validity of results being returned to participants (both in planned and unplanned return scenarios), such a requirement could help address the broader concerns regarding the quality of research results and the reproducibility in biomedical research. However, the committee did not consider this a viable option, given the likely adverse impacts on many research laboratories, both in terms of the sustainability of costs (particularly for new and smaller laboratories operating earlier in the translational research continuum) and the impacts on innovation. A large number of laboratories conducting research on human biospecimens would require assistance (both financial and technical) for the staff training and operational changes that would be needed to obtain CLIA certification. Institutional core resources could help ameliorate this burden for individual laboratories/investigators, but not all institutions have the capacity to develop this kind of centralized infrastructure. Several groups have concluded that it would be infeasible for all research laboratories that test human biospecimens to become CLIA certified (Barnes et al., 2015; SACHRP, 2016) and such a requirement could disincentivize research on biospecimens, thereby slowing progress in some important research areas (e.g., assay development and novel biomarker identification).

On the other end of the continuum is the option for CMS to amend CLIA regulations so that research results could be returned to participants from any research laboratory without restriction (regardless of whether the laboratory operated under a quality management system and with no requirement for oversight). Although this would remove the current disincentive associated with the burden of CLIA certification for laboratories interested in returning research results, the committee rejected this option because of the potential harms associated with returning results lacking validity, particularly if the results are not accompanied by information conveying the limitations of the reliability and interpretation. The committee also was concerned that this would create a perverse incentive to test human biospecimens for clinical decision making in research laboratories in order to avoid the burden associated with meeting and maintaining the CLIA certification requirements.

Between these two extremes is a third option for CLIA regulatory changes which allows investigators and their institutions greater flexibility in determining the conditions under which returning results is appropriate when they have not been generated in a CLIA-certified laboratory. For the safety reasons discussed in Chapter 3, investigators planning to return research results that are intended for use in clinical decision making should ensure that those results are generated (or verified prior to use and return) in a CLIA-certified laboratory. However, the committee also recognizes that in some scenarios CLIA certification may not be appropriate to the nature of the research conducted by a laboratory and therefore recommends that the National Institutes of Health (NIH) lead the development of an externally accountable⁴⁰ quality management system for research laboratories testing human biospecimens (see Recommendation 2).

The adoption of this standard by research laboratories would adequately support confidence in the analytic validity of research results so that they can be offered to participants, but it would require CMS to revise the CLIA regulations to allow for the return of results from laboratories operating under this research quality management system when the results are not intended for use in clinical decision making (see Box 3-1). To prevent abuse (i.e., by unscrupulous parties seeking to avoid CLIA certification costs and resources even when results are intended to inform clinical decision making) and protect the well-being of research participants, this exception from CLIA requirements would necessitate institutional processes (and the associated infrastructure and resources) for laboratory oversight and risk management. For example, external assessments of a laboratory's quality management system could be reported to the IRB as a condition of protocol approval prior to starting research incorporating the planned return of individual research results not intended for clinical decision making.

Prior to the establishment of an externally accountable quality management system for research laboratories or in cases where investigators did not plan to return results (i.e., unanticipated results or results requested by participants under HIPAA), the proposed CLIA exception could further allow decisions regarding the return of individual research results to be made at the institutional level contingent on an IRB review and approval process (see Recommendation 3). All research results returned to participants would need to be qualified with information that helps recipients understand the limits of the information being returned in order to minimize the risk of harm from a misinterpretation or misapplication of the results.

Considerations for Changes to the HIPAA Access Right

The proposed changes to the CLIA regulations to allow the return of individual research results from laboratories operating under the NIH-defined externally accountable quality management system or following an IRB review and approval process (discussed above and in Chapter 3) would go a long way toward resolving the CLIA–HIPAA conflict. However, it would still leave open the issue that, under the HIPAA access right, laboratories could be compelled to share research results with questionable validity or a high potential for misinterpretation. Some may argue that individuals should still have a right to access their information even if it is poor quality, and in regards to other types of information in the DRS, such as physician notes and electronic medical records (EMRs) information, that is the case. However, there is a crucial difference between laboratory results and these other types of protected health information—an individual has no way to know or verify if the laboratory result is accurate or if it even belongs to the individual. By contrast, a patient or patient's caregiver may recognize by himself or herself (or in consultation with the provider) that the information in the EMRs is incorrect. Thus, it is important to have some mechanism for individuals to have confidence in the quality of laboratory test results. Given the inherent uncertainty in research, results with these characteristics may be generated even when laboratories have established quality management systems in place, and investigators and institutions may not feel comfortable returning such results. Therefore, the committee considered additional regulatory changes related to the HIPAA right of access. While cautious about restricting one of the currently available pathways for participants to access their research results, particularly in an environment where results are rarely offered to participants, the committee believes that carefully considered changes are warranted to reduce the risk of harm from the return of research results.

HIPAA's access right applies only to laboratories that are—or are part of—a covered entity and to results that are maintained within the DRS for that entity. Consequently, two⁴¹ different pathways are proposed that restrict the right of access to research results: research laboratories can be legally separated from the HIPAA-covered part of the entity so that they are no longer subject to HIPAA's requirements, or the DRS can be defined to exclude all or some research results.

The legal mechanism for implementing the first approach is the creation of a hybrid entity (Barnes et al., 2015), which is an entity whose business functions include both covered and non-covered functions.⁴² Some academic medical centers have elected to become hybrid entities, with research laboratories that do not conduct covered transactions excluded from the covered portion of the entity. Such laboratories could not be compelled to provide access to research results under HIPAA.

However, a number of significant challenges and costs to creating a hybrid entity limit the viability of this approach on a wide scale (Barnes et al., 2015). First, some personnel may be involved with both covered (e.g., health care delivery) and non-covered (e.g., some research⁴³) functions, making separation of the subparts difficult to define. The conduct of covered transactions by the non-covered part of the hybrid entity could result in a fine from the HHS OCR. For a fee, legal and other consultants can help institutions properly separate components into covered and non-covered elements. Second, in accordance with the HIPAA Privacy Rule, institutions would need to ensure that information from the covered part of the entity is shared with the non-covered part in the same way that information from any two separate entities is shared. This would necessitate separate information systems, which conflicts with the proposed use of the medical EHR for communication of research results noted above. Hybrid entities cannot have a unified electronic record system. In addition to the infrastructure costs associated with separate information systems, creating a hybrid entity restricts data sharing across covered and non-covered components⁴⁴ (Barnes et al., 2015) and could thereby impede some kinds of research—e.g., research involving the review and analysis of medical records cannot be conducted by laboratories in the non-covered part of the entity. Moreover, while the creation of hybrid entities can be done on an institution-by-institution basis, no regulatory mechanism universally excludes research laboratories from the covered portion of an entity. Thus, while this approach may make sense for some individual institutions, the committee does not consider it to be a viable option for addressing the issues with HIPAA access to results of questionable validity and its potential conflict with the CLIA requirements.

An alternative approach that could have broader reach if implemented by OCR is to more explicitly define what is and is not included in the DRS. Defining the DRS so that it does not include research results—specifically those results not intended for clinical decision making⁴⁵—would prevent laboratories from being compelled to disclose such results when requested by participants (although investigators and institutions could still decide to return the results if they were generated in a laboratory with an accepted externally accountable quality management system or if the disclosure was reviewed through an independent process and approved by the IRB per Recommendation 3). The committee notes that some research institutions are already taking this approach, but by each institution documenting its interpretation of what OCR intends to be included in the DRS in its own way, different standards are being created at different institutions, resulting in inconsistent and inequitable access to research results for participants.

Although defining the DRS to exclude all research results not intended for clinical decision making would resolve the issues of access to unreliable results and the potential CLIA–HIPAA conflict, this approach is unnecessarily restrictive since it also impedes access to high-quality research results that may have value to participants. Additionally, the fact that HIPAA excludes the right of access for protected health information only during the duration of the research study suggests that OCR did intend for research results to be part of the DRS once a study has reached completion. Instead, the committee favors a more inclusive approach to defining the DRS that would preserve access to individual research results generated in CLIA-certified laboratories and laboratories with a quality management system consistent with Recommendation 2 (see Figure 6-2). This approach reduces the risks (to participants and investigators) from returning unreliable results while maximizing access to reliable research results.

FIGURE 6-2

Determining whether participants have the right to access their individual research results under HIPAA. ^a CLIA-certified includes tests run in a CLIA-certified, -accredited, or -waived laboratory. ^b See Recommendation 2.

Recommendation 12: Revise and Harmonize Regulations to Support the Return of Individual Research Results.

Regulators and policy makers should revise and harmonize the relevant regulations in a way that respects the interests of research participants in obtaining individual research results and appropriately balances the competing considerations of safety, quality, and burdens on the research enterprise.

Specific actions that should be taken include

A.

Because the designated record set (DRS) is intended to include information used to make decisions about individuals, those decisions should be based on test results that are of sufficient quality to be valuable for decision making. Accordingly, the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) should define the DRS to include only individual research results generated in a CLIA-certified laboratory or under the externally accountable quality management system for research laboratories (see Recommendation 2);

B.

OCR should require all HIPAA-covered entities that conduct research on human biospecimens to develop a plan that is reviewed and approved by the IRB for the release of individual research results in the designated record set to participants in a responsive manner when requested under HIPAA;

C.

CMS should revise CLIA regulations such that when there is a legal obligation under the HIPAA access right to return individual research results, a laboratory will not be considered in violation of CLIA and need not obtain CLIA certification before satisfying this legal obligation;

D.

CMS should revise CLIA regulations to allow research results to be returned from a non-CLIA-certified laboratory when they are not intended for clinical decision making in the study protocol (as defined in Box 3-1) and the laboratory conducts its testing under the quality management system with external accountability or the IRB has approved the return of results (as described in Recommendation 3);

E.

CMS and OCR should harmonize the definitions of the following terms, providing a clear explanation and justification for any differences or discrepancies: “test report” and “completed test report” (CLIA), and “PHI in the designated record set” (HIPAA);

F.

OCR, OHRP, and NIH should harmonize the definitions of the following terms, providing a clear explanation and justification for any differences or discrepancies: “de-identified” (HIPAA), “non-identified” (Common Rule), and “identifiable sensitive information” (21st Century Cures Act regarding certificates of confidentiality);

G.

HHS (including CMS, FDA, NIH, OHRP) should ensure that all regulations, policies, and guidance relevant to human research refer to research “participants,” rather than research “subjects,” in accordance with the ethical principles of autonomy and respect for persons; and

H.

FDA should clarify and provide additional guidance that if a device is not exempt from investigational device exemption (IDE) regulations, disclosure of results in many circumstances, including to healthy volunteers, will not necessarily entail significant risk, and FDA should clarify when it will consider the return of individual research results to entail significant risk. Additionally, FDA should provide guidance to IRBs on how to determine significant risk if the device is not exempt from IDE regulations.