Data from various types of studies conducted on brain tissue in the HBTRC collection will be available from studies using different technologies, such as gene expression profiling, quantitative RT-PCR, situ hybridization, and immunocytochemistry and will have the potential for providing powerful insights into the subregional and cellular distribution of genes and/or proteins in different brain regions and eventually in specific subregions and cellular subtypes. All qualified investigators who would like to gain access to more detailed information regarding the subjects (including diagnostic reports on postmortem brain tissue) must demonstrate that they are aware of the HIPAA requirements for confidentiality by reviewing information here.

HIPAA Regulations Regarding Confidentiality of Patient Records

HIPAA is the Health Insurance Portability and Accountability Act of 1996. HIPAA required the development of a law that would provide privacy protections for health information. Since this law was not written by Congress as requested by HIPAA, the Department of Health and Human Services (DHHS) was required to write a regulation to protect individually identifiable health information. This is called the Privacy Rule. Hospitals, physicians, health care providers and scientists are all directly covered by the Privacy Rule.

• Researchers who access existing protected health information must comply with the Privacy Rule because all entities and affiliated individuals must protect the privacy of individually identifiable health information used or released for treatment and other purposes, including research.
• The definition of protected health information includes information relevant to the provision of health care, as well as information generated in the context of research. Hence, although some research information may not have proven clinical validity or utility, the Privacy Rule considers it to be identifiable health care information that must be protected.
• The regulation covers information not tissue, except to the extent any identifiable medical information is attached to the tissue sample.
• Genetic information is not provided a higher standard of privacy coverage under this federal regulation. Of note, there is a state genetics privacy law, but this does not apply to IRB approved research activities.
• The regulation covers individually identifiable information which is referred to as protected health information (PHI), in any form, including written, electronic, or oral. The regulation provides a stringent definition of "de-identified."
• The Privacy Rule creates privacy standards and also gives individuals a number of rights; these standards and rights will also apply to their research information. These include:
  • Only the minimum necessary information can be used or disclosed. There are two exceptions when PHI is being used or disclosed for treatment purposes, or if there is an authorization for use and disclosure.
  • Individuals must receive a notice of how their PHI will be used and protected.
  • Patients and subjects have the right to request a history of how and to whom their PHI has been disclosed over the previous 6 years. Tracking of disclosures is not required if the disclosure was made pursuant to written authorization. Any disclosure made after obtaining a waiver of consent and authorization will have to be tracked. Disclosure of a limited data set for research does not require tracking.
  • Individuals have the right to request access to their PHI.
  • Individuals have the right to request that their PHI be amended.

*** The Privacy Rule affects research in two different ways: 1) accessing existing PHI i.e. in this case, information associated with postmortem brain studies; and 2) handling PHI that is created during a research study.