By Patricia A. Bass, JD, MPH,
This month’s Feature article is Part III in our three-part series devoted to RESEARCH REPOSITORIES. The April 2013 CR TIMES Feature article offered an updated overview of research repositories, as well as specific guidance for investigators who wish to conduct “RECIPIENT RESEARCH”. The May 2013 CR TIMES Feature article focused specifically on the establishment of a RESEARCH REPOSITORY and the related IRB review of research repositories. This month, the CR TIMES Feature article addresses institutional agreements related to research repositories, primarily Data Use Agreements and Materials Transfer Agreements (MTAs).
What distinguishes the HIPAA Privacy Rule from earlier privacy laws, is that its restrictions apply not only to Disclosure [defined as release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information], but to Use [sharing, employment, application, utilization, examination, or analysis of such information within an entity]. Moreover, a covered entity may Use or Disclose only in accordance with HIPAA. Research is considered an activity outside of treatment, payment, and health care operations and requires either patient authorization or an exception to the authorization requirement. One exception to authorization is the disclosure and use of a limited data set if the user/recipient agrees to the HIPAA-required Data Use Agreement.
What is the difference between a De-identified Data Set and a Limited Data Set?
De-identified data are stripped of 18 specified data elements (Safe Harbor) or by using a method certified by a statistician. Under HIPAA, a Limited Data Set (LDS) is legally still considered to be identifiable. It is only “facially” de-identified. Practically speaking, this means that the data are not identifiable to the casual observer. The following table summarizes the distinction:
The most significant element that differs between the two is the ability to use date elements.
Another consideration is whether the dataset contains any “unique characteristic elements”. For example, a dataset of subjects who received an injury while attending the Boston Marathon this year, or of those who have had heart attacks during last year’s Super Bowl, have implicit date elements that would allow subjects to be identified and would be considered a Limited Data Set rather than a de-identified data set.
You must go to the covered entity, Boston Medical Center, or any of the BU-covered entities and make a request for the LDS, and then sign a Data Use Agreement. It is a violation of HIPAA to use PHI (Protected Health Information) to create your own LDS without a DUA. Remember, when obtaining a LDS, a Data Use Agreement is required. Note that in some cases, an LDS can be obtained through the Clinical Data Warehouse. If the CDW cannot provide the Limited Data Set, then in some cases it is appropriate for the covered entity to “employ” end user researchers to create their own Limited Data Set. Caveat: Again—no self-help. To create your own LDS, you must enter into a combination Business Associate/Data Use Agreement.
“Material,” for MTA purposes, refers to any tangible biological specimen as distinguished from data associated with the sample. This discussion will be limited to discussing human specimens that are associated with greater or lesser amounts of health information. Human specimens come in many forms: bodily fluids, including excreta (urine, feces); tissue (blood, bone, epithelium, nerve); cell lines and DNA/RNA. As the earlier parts of this series have indicated, the collection and keeping of material for future research purposes are activities governed by federal research “repository” regulations. All “repositories” are covered: collections comprised of specimens from (1) a single research protocol or a group of protocols from one or more investigators; (2) discarded clinical surgery and pathology tissue; and (3) materials specifically collected and catalogued for a large scale bio-bank.
Why is an MTA needed?
Legally speaking, an MTA is a type of transfer of personal property which is called, a “bailment” –the act of giving someone possession of personal property for a purpose other than intending to transfer ownership (valet parking and coat check services are familiar types of bailment relationships). For MTAs, that purpose is scientific research. Thus, the first thing that an MTA does is to delineate what the sender owns. Traditionally, the scope of ownership claimed in an MTA is the “original material”, its progeny1, and unmodified derivatives2. A significant consideration is satisfying any conditions of the grantor or sponsor that funded the research under which the material was created. The next thing an MTA does is to set ownership rules for modifications3. Finally, MTAs contain provisions against re-transfer by the recipient and liability waivers, among other things. Three types of MTAs are most common at academic institutions: transfer between academic or research institutions, transfer from academia to industry, and transfer from industry to academia.
Who owns the transferred material?
Legally, the material is owned by the institution on whose space the research occurred, and who was the awardee of the grant or industry funding. Federal grant and industrial awards also have provisions concerning inventions and other intellectual property (e.g., copyright, trade secrets)
What is the relationship of MTAs to intellectual property?
Under the Patent policy which covers Boston Medical Center and Boston University Medical Campus constituents (BUSM, GSDM, SPH), the institutions claim equity in patentable inventions which faculty, staff, employees or students (including all types of trainees or postgraduate residents or fellows) are working on or arising from programs supported in whole or in part by the institutions’ fund, space, personnel, or facilities. Royalties are allocated to the inventing faculty, staff, etc., their department, and the institutions.
The Material Transfer Agreement also provides a tracking mechanism both for determining inventorship and making these allocations internally, but also for determining the inventorship or ownership interests of outside individuals and institutions. This is similar to the principle of keeping track of an automobile’s title. In informal situations and in the short term, it may appear to be a nicety, but at an important future time (e.g., a licensing or patent deal is contemplated), having a clear title chain is crucial.
What terms are in MTAs?Three types of MTAs are most common at academic institutions: transfer between academic or research institutions, transfer from academia to industry, and transfer from industry to academia. Transfers within institutions and with other non-profit academic institutions are usually quite simple because they usually contain non-commercialization provisions and set aside the invention owners. They also contain terms for handling inventions. Industrial MTAs tend to be more complicated and take longer to negotiate.
These agreements are more complex because in addition to the basic ownership questions, they also have to consider human subjects protection regulations and privacy laws of both the federal (most prominently HIPAA) and state governments. The basic requirements are these:
In general when data are involved, HIPAA requires that only costs can be recovered. Under HIPAA, a covered entity may not “sell” protected health information without specific sales authorization of the individual patient/research subject.
Where can I get a template of an MTA?Various template MTAs exist. However, MTAs must be executed by the institutional property owner—Boston Medical Center or Boston University. For academic-to-academic transfers, the time to completion is rapid PROVIDED [this is the most common rate-limiting factor] the HIPAA and IRB requirements have been satisfied, or capable of simple resolution if these requirements have not been satisfied. If transfer to or from commercial entities are involved, you will need to seek the advice of the BU Office of Technology Development for both BMC and BU projects. For nonprofit and foundation BMC projects, you should contact the BMC Grants Office.
When investigators leave the institution and wish to continue their research at another institution, this may be permissible based on a number of factors, including IRB and other institutional approval. If the removal is approved, then some combination of either or both MTAs or DUAs can be executed between the local institution and the new institution.
There are no quiz questions this month. Take a few minutes and check where you stand with quizzes that count towards Recertification. Click here for an explanation of who needs to be recertified and how to meet the requirements. If you still have questions, please send them to firstname.lastname@example.org.