IMPACT OF THE HIPAA PRIVACY RULE ON NIH PROCESSES INVOLVING THE REVIEW,
FUNDING, AND PROGRESS MONITORING OF GRANTS, COOPERATIVE AGREEMENTS AND
RESEARCH CONTRACTS
RELEASE DATE: February 5, 2003
NOTICE: NOT-OD-03-025
National Institutes of Health (NIH)
The purpose of this GUIDE notice is to provide an overview of how the
HIPAA Privacy Rule may affect NIH processes involving the review,
funding, and progress monitoring of grants, cooperative agreements and
research contracts.
The Department of Health and Human Services (DHHS) issued final
modifications to the STANDARDS FOR PRIVACY OF INDIVIDUALLY IDENTIFIABLE
HEALTH INFORMATION, the "Privacy Rule," on August 14, 2002. The Privacy
Rule is a federal regulation under the Health Insurance Portability and
Accountability Act (HIPAA) of 1996 that governs the protection of
individually identifiable health information. The Rule was enacted to
increase the privacy protection of health information identifying
individuals who are living or deceased, and to regulate known and
unanticipated risks to privacy that may accompany the use and
disclosure of personal health information. The Privacy Rule is not an
NIH regulation. It is administered and enforced by the DHHS Office for
Civil Rights (OCR). Those who must comply with the Privacy Rule,
including some grantees and contractors, must do so by April 14, 2003
(with the exception of small health plans which have an extra year to
comply). The OCR website (http://www.hhs.gov/ocr/) provides information
on the Privacy Rule, including a complete Regulation Text for the
Privacy Rule.
I. The Privacy Rule and Research: Roles and Responsibilities
Grant Applicants and Contract Offerors The Privacy Rule applies to
researchers classified under the Rule as covered entities (i.e., a
health care clearinghouse, health plan, or a health care provider that
electronically transmits health information in connection with a
transaction for which DHHS has adopted standards under HIPAA). The Rule
may also affect researchers who obtain individually identifiable health
information from covered entities through collaborative or contractual
arrangements. Decisions about whether and how to implement the Privacy
Rule reside with the researcher and his/her institution. A set of
decision tools on "Am I a covered entity?" are available from the OCR
website (http://www.hhs.gov/ocr/). Researchers should review this and
other information on the Privacy Rule and then discuss with their
appropriate institutional officials (e.g., Office of Research, legal
counsel, etc.) to learn how the Rule applies to them, their
organization, and their specific research project. OCR and the
Department of Justice (DOJ) may impose civil or criminal penalties,
respectively, on covered entities that fail to comply with the Rule.
The roles of several Federal agencies regarding the Privacy Rule are
described below:
Office for Civil Rights (OCR) Oversight and civil enforcement
responsibility for the Privacy Rule are under the auspices of OCR, DHHS.
Department of Justice (DOJ) Enforcement of the criminal penalties for
violations of the Privacy Rule is under the auspice of DOJ.
National Institutes of Health (NIH) Development of educational
materials for researchers, in collaboration with other DHHS research
agencies, is the role of NIH. NIH is not involved in enforcing or
monitoring compliance with the Privacy Rule.
II. How the Privacy Rule may Impact the NIH Grant & Cooperative
Agreement Application and Research Contract Processes
A. New and Competing Continuation Grant & Cooperative Agreement
Applications/Contract Proposals Review and Funding
Grant and Cooperative Agreement Applications:
When conducting investigator-initiated research that involves a covered
entity the Privacy Rule may influence the environment in which the
research takes place. As a result, implementing the Privacy Rule may
affect the feasibility, design, and cost of the research. As with any
issue that can affect feasibility, design, and cost, researchers should
continue to follow the instructions in the PHS 398
(http://grants.nih.gov/grants/funding/phs398/phs398.html) and discuss
such issues, as needed, in the research plan and budget sections of the
application.
It is important to note that the Privacy Rule does not replace or act
in lieu of existing regulations for the protection of human subjects
found in 45 CFR 46. Therefore, instructions in the Human Subjects
section of the PHS 398 remain the same. Researchers should continue to
consider issues of privacy and confidentiality as they affect the
adequacy of protections of human subjects from research risks, and when
appropriate, address these issues in the Human Subjects section of the
research plan.
New and competing continuation grant & cooperative agreement
applications will continue to be evaluated using the existing review
criteria found in PHS 398 and reviewers will continue to use the
existing NIH Instructions to Reviewers for Evaluating Research
Involving Human Subjects
http://grants.nih.gov/grants/peer/hs_review_inst.pdf.
Some Requests For Applications (RFAs) and Program Announcements (PAs)
may request applications for specific areas of research and could
indicate the need to provide a plan for acquiring or accessing data
under the Privacy Rule. In such cases, the review criteria listed in
the RFA or PA could be augmented to include adequacy of such plans and
reviewers would evaluate these.
NIH funding decisions for new and competing continuation grants and
cooperative agreements will continue to be based on scientific merit,
programmatic need, and availability of funds. Program staff will
continue to discuss and seek resolution of issues or problems noted in
the summary statement including issues noted regarding the effect of
the Privacy Rule with investigators prior to funding.
Research Contract Proposals:
When performing research under a research contract that involves a
covered entity, the Privacy Rule may affect the environment in which
the research takes place. As a result, implementing the Privacy Rule
may affect the feasibility, design, and cost of the research. As with
any issue that can affect feasibility, design, and cost, researchers
should discuss the issues, as needed, in the technical and business
proposal sections of the contract proposal.
It is important to note that the Privacy Rule does not replace or act
in lieu of existing regulations for the protection of human subjects
found in 45 CFR 46. Therefore, instructions in Section L of the
solicitation remain the same. Researchers should continue to consider
issues of privacy and confidentiality as they affect the adequacy of
protections of human subjects from research risks, and when
appropriate, address these issues in the Human Subjects section of the
technical proposal.
For new contract solicitations, reviewers will use the evaluation
criteria set forth in Section M of the solicitation and continue to use
the existing instructions found in Manual Chapter 6315-1
(http://www1.od.nih.gov/oma/manualchapters/contracts/6315-1/). Some
Requests for Proposals (RFPs) could indicate the need to provide a plan
for acquiring or accessing data under the Privacy Rule. In such cases,
the review criteria listed in the RFP could be augmented to include
adequacy of these plans and reviewers would evaluate these.
NIH funding decisions for new research contracts will continue to be
based on technical merit and cost. The technical evaluation report will
include a discussion of issues and problems, including any noted
regarding the Privacy Rule. The contracting officer will include these
issues and problems during discussions held with offerors in the
competitive range and seek resolution prior to award.
B. Non-Competing Applications/Contracts Progress Monitoring
Grants and Cooperative Agreements:
During the period of award, principal investigators of grants and
cooperative agreements communicate progress and issues about the
research with NIH program and grants management staff in annual
progress reports, as well as on as-needed bases. If situations are
encountered that significantly delay the study, change the study design
or procedures, or change the costs of the research, these issues should
be communicated to NIH staff as soon as possible. This same practice
applies to significant research delays or problems associated with
acquiring or accessing data under the Privacy Rule; issues should be
communicated to NIH staff. NIH staff will evaluate situations on a
case-by-case basis.
Research Contracts:
During the contract period of performance, the contractor communicates
progress and issues about the research to the contracting officer and
project officer on a regular and as needed basis. If it encounters
situations that significantly delay the study, change the study design
or procedures, or change the costs of the research these should be
communicated to NIH staff as soon as possible. In this same manner,
significant research delays or problems associated with acquiring or
accessing data under the Privacy Rule should be communicated to the
contracting officer and project officer who will evaluate the situation
on a case-by-case basis.
III. Where to obtain information on the Privacy Rule
As part of its oversight role, OCR is providing a number of
publications on implementing the Privacy Rule through its web site at
http://www.hhs.gov/ocr and http://www.hhs.gov/ocr/hipaa/. As the
research community, DHHS, OCR, and NIH gain experience with
implementation of the Rule, additional FAQ's and publications will be
posted on these OCR web sites.
NIH staff can provide assistance in locating educational materials on
the Privacy Rule. For general questions about how the Privacy Rule may
affect the review, funding, and progress monitoring of NIH grants,
cooperative agreements and research contracts, please contact program
and grants management staff in the NIH Institutes relevant to your area
of scientific interest.
Della M. Hann, Ph.D.
Office of Extramural Research
National Institutes of Health
9000 Rockville Pike
Building 1, Room 152
Bethesda, MD 20892
Phone: (301) 402-2725
Fax: (301) 402-3469
E-Mail: [email protected]
Weekly TOC for this Announcement
NIH Funding Opportunities and Notices
| ||||||
![]() |
Department of Health and Human Services (HHS) |
![]() |
||||
NIH... Turning Discovery Into Health® |