Currents in Contemporary Ethics

45 C.F.R. Part 46, Subpart A (2004). The Common Rule was originally published on January 26, 1981, and it became effective July 27, 1981. 46 Fed. Reg. 8366 (1981).

Pub. L. No. 104-191, 42 U.S.C. §§ 300gg – 300gg-2 (2004).

Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Parts 160, 164 (2004).

Title II, subtitle F, §§ 261–264 (“Administrative Simplification”).

65 Fed. Reg. 82,463 (2000).

Pub. L. No. 104-191, § 264.

65 Fed. Reg. 82,462–82,829 (2000).

45 C.F.R. § 164.534 (2004).

67 Fed. Reg. 53,181 (2002).

U.S. Government Accountability Office, “Health Information: First-Year Experiences under the Federal Privacy Rule 19” (2004), available at <www.gao.gov/cgi-bin/getrpt?GAO-04-965> (last visited February 24, 2005) [hereinafter GAO]; National Committee on Vital and Health Statistics, “Letters to Secretary Tommy G. Thompson, September 27, 2002 and November 25, 2002,” available at <www.ncvhs.hhs.gov> (last visited February 24, 2005).

See, e.g., National Committee on Vital and Health Statistics, “Letter to Secretary Tommy G. Thompson,” (March 5, 2004), available at <www.ncvhs.gov/040305.2htm> (last visited February 24, 2005) (excuse to avoid public health reporting).

GAO, supra note 10, at 20–21.

45 C.F.R. § 160.102 (2004).

45 C.F.R. § 160.103 (2004) (definition of health plan).

45 C.F.R. § 160.103 (2004) (definition of health information).

Under the Privacy Rule, individuals may request limitations on the use and disclosure of protected health information, but covered entities are not required to agree to the request. 45 C.F.R. § 164.522 (2004).

U.S. Department of Health and Human Services, Office for Civil Rights, “Guidance on Standards for Privacy of Individually Identifiable Health Information” at 7–9 (December 3, 2002), available at <www.hhs.gov/ocr/hipaa/privacy.html> (last visited February 24, 2005).

45 C.F.R. § 164.520(c)(2) (2004).

45 C.F.R. § 164.508(a) (2004).

45 C.F.R. § 164.524 (2004).

45 C.F.R. § 164.526 (2004).

45 C.F.R. § 164.528 (2004).

45 C.F.R. § 160.306 (2004); U.S. Department of Health and Human Services, Office for Civil Rights, “How to File a Health Information Privacy Complaint with the Office for Civil Rights,” available at <http://www.os.hhs.gov/ocr/privacyhowtofile.htm> (last visited February 7, 2005).

45 C.F.R. § 46.103 (2004).

U.S. Department of Health and Human Services, “Office for Human Research Protections: Compliance Oversight,” available at <www.hhs.gov/ohrp/compliance/index.html#overview> (last visited February 7, 2005).

45 C.F.R. § 160.202 (2004) (Privacy Rule).

U.S. Department of Health and Human Services, National Institutes of Health, “How Do Other Privacy Protections Interact with the Privacy Rule?” available at <http://privacyruleandresearch.nih.gov/pr_05.asp> (last visited February 7, 2005).

45 C.F.R. § 164.501 (2004) (Privacy Rule); 45 C.F.R. § 102(d) (2004) (Common Rule).

U.S. Department of Health and Human Services, “Research Repositories, Databases, and the HIPAA Privacy Rule” (2004), available at <http://privacyruleandresearch.nih.gov/research_repositories.asp> (last visited February 24, 2005); U.S. Department of Health and Human Services, Office for Protection from Research Risks, “Issues to Consider in the Research Use of Stored Data or Tissues” (1997), available at <www.hhs.gov/ohrp/humansubjects/guidance/reposit.htm> (last visited February 7, 2005).

U.S. Department of Health and Human Services, National Institutes of Health, “Clinical Research and the HIPAA Privacy Rule,” at 12 (2004), available at <http://privacyruleandresearch.hih.gov/clin_research.asp> (last visited February 7, 2005).

Id. at 7.

U.S. Department of Health and Human Services, National Institutes of Health, “How Can Covered Entities Use and Disclose Protected Health Information for Research and Comply with the Privacy Rule?” at 12, available at <http://privacyruleandresearch.nih.gov/pr_08.asp> (last visited February 7, 2005).

45 C.F.R. § 116(d) (2004).

45 C.F.R. § 164.512(l)(2)(ii) (2004).

45 C.F.R. § 102(f) (2004).

45 C.F.R. § 164.502(f) (2004).

45 C.F.R. § 164.512(l)(iii) (2004).

45 C.F.R. § 164.514(b) (2004).

45 C.F.R. § 164.514(e) (2004).

U.S. Department of Health and Human Services, Office for Human Research Protections, “Guidance on Research Involving Coded Private Information or Biological Specimens” (2004), available at <www.hhs.gov/ohrp/humansubjects/guidance/cdebid.pdf> (last visited February 7, 2005).

National Committee on Vital and Health Statistics (NCVHS), “Letter to Secretary Tommy G. Thompson,” March 5, 2004, available at <www.ncvhs.hhs.gov/0440305/2.htm> (last visited February 7, 2005).

Research Repositories, Databases, and the HIPAA Privacy Rule, supra note 29, at 12.

45 C.F.R. § 46.116 (2004).

See Wolf L. E. and Lo B. , “Untapped Potential: IRB Guidance for the Ethical Research Use of Stored Biological Materials,” IRB: Ethics & Human Research 26, no. 4 (2004): 1–8. See generally National Bioethics Advisory Commission, Research Involving Human Biological Materials: Ethical Issues and Policy Guidance, vol. 1, at 63 (1999).

How Can Covered Entities Use and Disclose Protected Health Information for Research and Comply with the Privacy Rule? supra note 32, at 4.

Id. at 6.

Clinical Research and the HIPAA Privacy Rule, supra note 30, at 12.

NCVHS Letter to Secretary Thompson , supra note 42.

45 C.F.R. § 46.116(a)(8) (2004).

Clinical Research and the HIPAA Privacy Rule, supra note 30, at 4.

45 C.F.R. § 164.502(b) (2004).

45 C.F.R. § 164.502a(b)(2)(iii) (2004).

Research Repositories, Databases, and the HIPAA Privacy Rule, supra note 29, at 5.

Clinical Research and the HIPAA Privacy Rule, supra note 30, at 17–18.

Id. at 18. Research records maintained by a non-covered entity also would not be considered part of a designated record set.