![]() |
||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||
Feature Article Research Repositories (Part III) - Data Use Agreements and Materials Transfer Agreements By Patricia A. Bass, JD, MPH,
What distinguishes the HIPAA Privacy Rule from earlier privacy laws, is that its restrictions apply not only to Disclosure [defined as release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information], but to Use [sharing, employment, application, utilization, examination, or analysis of such information within an entity]. Moreover, a covered entity may Use or Disclose only in accordance with HIPAA. Research is considered an activity outside of treatment, payment, and health care operations and requires either patient authorization or an exception to the authorization requirement. One exception to authorization is the disclosure and use of a limited data set if the user/recipient agrees to the HIPAA-required Data Use Agreement. What is the difference between a De-identified Data Set and a Limited Data Set? De-identified data are stripped of 18 specified data elements (Safe Harbor) or by using a method certified by a statistician. Under HIPAA, a Limited Data Set (LDS) is legally still considered to be identifiable. It is only “facially” de-identified. Practically speaking, this means that the data are not identifiable to the casual observer. The following table summarizes the distinction:
The most significant element that differs between the two is the ability to use date elements. Another consideration is whether the dataset contains any “unique characteristic elements”. For example, a dataset of subjects who received an injury while attending the Boston Marathon this year, or of those who have had heart attacks during last year’s Super Bowl, have implicit date elements that would allow subjects to be identified and would be considered a Limited Data Set rather than a de-identified data set.
How do I obtain a Limited Data Set? You must go to the covered entity, Boston Medical Center, or any of the BU-covered entities and make a request for the LDS, and then sign a Data Use Agreement. It is a violation of HIPAA to use PHI (Protected Health Information) to create your own LDS without a DUA. Remember, when obtaining a LDS, a Data Use Agreement is required. Note that in some cases, an LDS can be obtained through the Clinical Data Warehouse. If the CDW cannot provide the Limited Data Set, then in some cases it is appropriate for the covered entity to “employ” end user researchers to create their own Limited Data Set. Caveat: Again—no self-help. To create your own LDS, you must enter into a combination Business Associate/Data Use Agreement.
Why is an MTA needed? Legally speaking, an MTA is a type of transfer of personal property which is called, a “bailment” –the act of giving someone possession of personal property for a purpose other than intending to transfer ownership (valet parking and coat check services are familiar types of bailment relationships). For MTAs, that purpose is scientific research. Thus, the first thing that an MTA does is to delineate what the sender owns. Traditionally, the scope of ownership claimed in an MTA is the “original material”, its progeny1, and unmodified derivatives2. A significant consideration is satisfying any conditions of the grantor or sponsor that funded the research under which the material was created. The next thing an MTA does is to set ownership rules for modifications3. Finally, MTAs contain provisions against re-transfer by the recipient and liability waivers, among other things. Three types of MTAs are most common at academic institutions: transfer between academic or research institutions, transfer from academia to industry, and transfer from industry to academia. Who owns the transferred material? Legally, the material is owned by the institution on whose space the research occurred, and who was the awardee of the grant or industry funding. Federal grant and industrial awards also have provisions concerning inventions and other intellectual property (e.g., copyright, trade secrets) What is the relationship of MTAs to intellectual property? Under the Patent policy which covers Boston Medical Center and Boston University Medical Campus constituents (BUSM, GSDM, SPH), the institutions claim equity in patentable inventions which faculty, staff, employees or students (including all types of trainees or postgraduate residents or fellows) are working on or arising from programs supported in whole or in part by the institutions’ fund, space, personnel, or facilities. Royalties are allocated to the inventing faculty, staff, etc., their department, and the institutions. The Material Transfer Agreement also provides a tracking mechanism both for determining inventorship and making these allocations internally, but also for determining the inventorship or ownership interests of outside individuals and institutions. This is similar to the principle of keeping track of an automobile’s title. In informal situations and in the short term, it may appear to be a nicety, but at an important future time (e.g., a licensing or patent deal is contemplated), having a clear title chain is crucial. What terms are in MTAs? Three types of MTAs are most common at academic institutions: transfer between academic or research institutions, transfer from academia to industry, and transfer from industry to academia. Transfers within institutions and with other non-profit academic institutions are usually quite simple because they usually contain non-commercialization provisions and set aside the invention owners. They also contain terms for handling inventions. Industrial MTAs tend to be more complicated and take longer to negotiate.
These agreements are more complex because in addition to the basic ownership questions, they also have to consider human subjects protection regulations and privacy laws of both the federal (most prominently HIPAA) and state governments. The basic requirements are these:
In general when data are involved, HIPAA requires that only costs can be recovered. Under HIPAA, a covered entity may not “sell” protected health information without specific sales authorization of the individual patient/research subject.
When investigators leave the institution and wish to continue their research at another institution, this may be permissible based on a number of factors, including IRB and other institutional approval. If the removal is approved, then some combination of either or both MTAs or DUAs can be executed between the local institution and the new institution.
*****************
|
||||||||||||||||||||||||||||||||||||||