• E-mail
• Print
• Comment
• Font Size
• Digg
• del.icio.us
• Discuss article

An Enhanced Approach to Distinguishing Public Health Practice and Human Subjects Research

Posted on: Sunday, 17 April 2005, 03:00 CDT

What are the Differences between Public Health Practice and Research? This perplexing question constantly arises in the planning and performance of public health activities involving the acquisition and use of identifiable health information. Public health agencies collect and analyze significant identifiable health data from health care providers, insurers, other agencies, or individuals to perform an array of public health activities. These activities include surveillance (e.g., reporting requirements, disease registries, sentinel networks), epidemiological investigations (e.g., to investigate disease outbreaks), and evaluation and monitoring (e.g., public health program development and analysis, oversight functions). Few debate that these essential public health activities, often specifically authorized by law, are classifiable as public health practice.

Other public health activities in which identifiable health data are acquired or used, however, can resemble, include, or constitute human subjects research. "Human subjects research" is legally defined as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge"' that involves living human subjects (or their identifiable, private data). A public health agency may, for example, conduct a double-blinded, controlled study to assess the efficacy of a new vaccine among a randomly-selected group of persons within the affected population. The study's hypothesis, methods, and underlying intent substantiate that the activity is research. As a result, the public health agency must adhere to a series of protections (e.g., individual informed consent absent a waiver) and procedures (e.g., review by an institutional review board [IRB]) designed to protect the health and safety of human subjects.

Lost in a legal and ethical gray zone are a host of public health activities that are not neatly characterized as either practice or research.2 Classification of these types of activities is complicated for many reasons.3 Some suggest that lack of clarification as to what constitutes legitimate public health functions causes confusion.4 The scope of public health is exceedingly broad; its vastness complicates the carving out of distinct research activities. Others think that the definition of human subjects research is inapplicable to public health activities.5 Still others stress a need for national reform to include "some form of explicit, systematic review" for surveillance or other public health practices through ethical bodies external to public health,6 or the outright exemption of public health agencies from the federal human research protections.7 Underlying each of these divergent proposals, however, is the same, persistent question: how are public health practice and research distinct? Until this question is answered, none of these approaches is wholly satisfying.

Many public agencies and practitioners have recognized the importance of drawing distinctions between public health practice and research, including the Department of Health and Human Services (DHHS),8 Centers for Disease Control and Prevention (CDC),9 National Institutes of Health (NIH),10 Department of Energy (DOE),11 National Bioethics Advisory Committee (NBAC),12 and the Institute of Medicine (IOM),13 as well as state and local lawmakers and public health officials. Clearer distinctions are needed because (1) federal, state, and local laws and ethical principles governing human subjects research can require extensive and burdensome procedures. Misclassification of public health practice activities as research can result in these activities being delayed or conducted less efficiently or at higher costs due to the need to adhere to these procedures; (2) the HIPAA Privacy Rule (and other privacy laws) employ different standards for the disclosure of identifiable health information to public health practitioners (or others) without individual written authorization depending on whether the underlying activity is public health practice or research. In general, it is more difficult to acquire identifiable health data under the Privacy Rule for research purposes; and (3) widespread variation in distinctions between public health practice from research have led to confusion among IRBs and public health agencies, inefficient and duplicative reviews, and infringements on information sharing.

Despite its critical importance, there is no national consensus on the ways, factors, or bases for making distinctions between public health practice and research. The federal Common Rule (governing human subjects research), the HIPAA Privacy Rule, and other laws require public health officials and others to make these distinctions, but they provide little guidance. The Office for Human Research Protections (OHRP), CDC, NBAC,14 and others offer approaches for making distinctions that include various factors like assessing the intent of the proposed activity, examining the risks to or burdens on its participants, and reviewing underlying legal authority. While helpful, these guides lack coherence, coordination, and consensus among the public health practice and research communities and IRBs. "What is urgently needed," suggest Amoroso and Middaugh, "is a set of guidelines that clearly differentiates public health practice from research."15

This article, based on a 2004 report produced for the Council of State and Territorial Epidemiologists,16 proposes enhanced criteria to distinguish public health practice and research developed through analysis of existing laws, scholarship, and applied approaches. Modern definitions of "human subjects research" and "public health practice," and their underlying legal frameworks, are presented. Public health practice is supported by a constitutional, statutory, and regulatory legal environment that vests in public health officials the authority to perform general and specific public health functions, and provides for oversight and accountability for public health activities. Essential legal and ethical principles for the performance of human subjects research are largely reflected in the Common Rule, and incorporated into the HIPAA Privacy Rule.

Defining principles to classify public health practice and research activities are also set forth. An examination of key, foundational premises of public health practice and human subjects research helps unravel these activities to resolve simple cases. A set of enhanced guidelines applies to more difficult cases. Rejecting some existing, commonly-used criteria, these guidelines focus on (1) general legal authority, (2) specific intent, (3) responsibility, (4) participant benefits, (5) experimentation, and (6) subject selection as important factors to consider in making distinctions between public health practice and human subjects research. These foundational principles and enhanced guidelines are incorporated into a proposed checklist (see Figure 1) that public health practitioners and others can use as a tool for distinguishing practice and research activities within specific contexts.

Key Concepts of Human Subjects Research and Public Health Practice

Distinguishing public health practice and human subjects research can be difficult because, in some ways, they are alike.17 They often involve the collection and use of individually-identifiable health information about living individuals. They may present actual or potential risks to participants (e.g., privacy violations, discrimination, injuries, coercion, anxiety). Both activities may be justified as laudable in furthering the public good. Society has long accepted the need to acquire identifiable health data (with and without individual consent) for public health purposes like surveillance or epidemiologic investigations. Many individuals also support the acquisition of their own (and others') health data for research. They understand that research findings can lead to improvements in health outcomes for specific (or general) populations.

Public health practice, however, is not synonymous with human subjects research. Public health practice involves the application of proven methods to monitor the health status of the community, investigate unusual occurrences of diseases or other conditions, and implement preventive control measures based on current understanding within public health sciences. Research involves testing new, unproven treatments or strategies that are not known to be efficacious. As such, research entails rigorous monitoring of potential adverse, unexpected consequences to selected human subjects in the application of new, often unproven interventions.

The bases through which identifiable health data may be collected for practice and research are also different. Health data may be collected for public health practice without informed consent and outside of federal and state human subjects research laws because (1) traditionally, acquisition of these data has been viewed as a quintessential function of government to achieve public health goals; (2) the public has explicitly or implicitly authorized the activitythrough laws enacted through the political process (e.g., disease reporting requirements pursuant to state or local laws or regulations); (3) administrative protections of individual interests in public health are often built into authorizing laws and regulations; and (4) public health officials are accountable to the public for their activities.

In contrast, research data are acquired under a different social construct. Research is not always tied to grants of legislative authority and could be conducted unchecked absent legal protections. Researchers, unlike public health practitioners, must typically seek advance written and informed consent of subjects (and sometimes their communities) unless modified or waived in accordance with the Federal Policy for the Protection of Human Subjects (the "Common Rule").18 These (and other) research requirements are designed to protect the safety, welfare, dignity, and privacy of participants in a research study. Similar protections of individual interests may underlie public health practice, but they arise under different legal requirements. Existing conceptions of human subjects research and public health practice further inform these observations, as summarized below.

Defining Human Subjects Research

The modern definition of human subjects research is a product of its two parts: "research" and "human subjects." The nearly universally-accepted definitions of these terms are found in the Common Rule. Research is defined as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."19 (The same definition is also featured in the HIPAA Privacy Rule [as discussed below]). A "human subject" is a living individual about whom a researcher obtains (1) data through intervention or interaction with the individual; or (2) individually-identifiable health information. Human subjects research is not limited to any particular actor (e.g., public or private sector individual) or a specific setting (e.g., institution, agency, or corporation). Thus, a public health agency and its representatives may conduct human subjects research even in the pursuit of public health goals and objectives.20

NBAC and others question whether the common definition of research can or should be applied to public health.21 Many public health practice activities, such as disease surveillance, are (like research) routinely and systematically carried out, but are not considered research. NBAC notes that the term "generalizable" is an imprecise conceptual distinction for public health activities that, by their nature, focus on populations rather than individuals. It alternatively suggests basing a definition for public health research on the locus of benefits.22 If the benefits from the activity are focused on the members of the participating population through improvements in the public's health, the activity is public health practice. If the participants in the activity are not the intended primary beneficiaries, then the activity may be classified as research. A definition of public health research involving human subjects consistent with this approach may be stated as follows: the collection and analysis of identifiable health data by a public health authority for the purpose of generating knowledge that will primarily benefit those beyond the participating community who bear the risks of participation.

Defining Public Health Practice

Public health practice is more difficult to define than research, in part, because public health is so conceptually broad. Public health, according to the Institute of Medicine (IOM), is what we do collectively to assure the conditions for people to be healthy.23 While public health activities under this conception extend beyond those performed by governmental public health authorities, protecting the public's health is a quintessential function of government. Thus, for purposes of distinguishing public health practice and research, the focus is on those activities of federal, state, tribal, and local public health agencies, and their authorized partners. Even so, public health practice remains broad.

NBAC and CDC view public health practice as those governmental activities performed to "prevent or control disease and improve health or to improve a public health program or service in a specific population."24 This view, however, does not help distinguish public health practice and research; as stated, it could include human subjects research. Others define public health practice categorically, listing various types of traditional government practice activities.25 Snider and Stroup at CDC suggest that public health activities that are supported by statutory or other legal authorization (e.g., disease reporting) may be viewed as public health practice largely because law- and policy-makers "recognize that routine surveillance is not research."26 Arguably, collective consent underlying such data acquisitions is obtained through the public enactment of authorizing laws. Legal authorization, however, is not completely determinative of whether an activity is practice or research. Public health authorities may be legally authorized to conduct research activities in conjunction with or in addition to practice activities. In these cases, the authorities must adhere to research principles and ethics in conducting research activities regardless of their legal authorization.

A working definition for public health practice involving identifiable health data builds on the definition for public health research. Public health practice may be defined as: the collection and analysis of identifiable health data by a public health authority for the purpose of protecting the health of a particular community, where the benefits and risks are primarily designed to accrue to the participating community.

Existing Guidance Distinguishing Public Health Practice and Human Subjects Research

An existing array of guidance is used by public health practitioners, researchers, and IRB members to decide whether a proposed activity is public health practice or research. Many decision-makers, however, refer to CDC guidance on the distinctions between public health practice and research.27 In 1999, CDC developed a set of guidelines to distinguish public health research and non-research (i.e., public health practice activities) for CDC staff and its state and local partners. CDC considered and rejected several criteria (e.g., statistical analysis, publication intentions, hypothesis testing, subject selection, methodological design, and statutory authority) as sufficient on their own to distinguish public health practice from research. Instead, it focused on the element of "design" within the Common Rule definition of human subjects research. CDC suggested that distinctions between public health research or practice are best made by examining the intent of the project on a case-by-case basis. The intent of public health research is to "generate or contribute to generalizable knowledge."28 "Generalizable knowledge" is defined by CDC as new information that has relevance beyond the study population or program, information that is added to scientific literature, or knowledge that is systematically collected with methods that reduce bias (such as randomization and controls). Additional factors that may contribute to classifying an activity as public health research include (1) whether the intended benefits of the project always extend beyond the study participants; and (2) whether the data collected exceed requirements for care of the study participants.

In contrast, the intent of public health practice according to CDC is to prevent or control disease or injury, and improve health status, programs, or services.29 Additional factors CDC uses to determine whether an activity is public health practice include whether: (1) the intended benefits of the project are primarily for participants or their community; (2) data collected are needed to assess or improve a public health program or service, the health of the participants, or the health of the participants' community; (3) knowledge generated extends beyond the scope of the activity; and (4) the project activities are non-experimental. As CDC explains, a practice activity may produce generalizable knowledge provided this was not part of the primary intent from the outset.30 If the primary intent changes, what is initially deemed public health practice can become public health research.

Shifting intents, however, underscore the primary weakness of CDC's existing criteria: the same activity could arguably be classified as practice or research depending on the prioritization of its objectives. To avoid more complicated and time-consuming IRB review, public health practitioners have an incentive under CDC's approach to characterize an activity as intended to primarily benefit the public's health. "Ultimately," as suggested by James Buehler, former Associate Director for Science, CDC National Center for HIV, STD, and TB Prevention (NCHSTP), "this is an unsatisfying way to address the ethical questions inherent in public health research or practice."31

Public health practitioners and scholars have suggested other criteria to distinguish research from practice in the public health and clinical health care settings. John Middaugh, former Alaska state epidemiologist, suggests that public health practice has several attributes that research lacks: (1) subject (participant) selection in public health practice is usually non-random, (2) public health practice focuses on populations rather than individuals, (3) public health program evaluations are conducted for quality assurance or to develop programs, (4) public health practice is statutorily-authorized, and (5) only state and local agencies are authorized to receive funds to conduct public health practi\ce. These attributes, though helpful, do not necessarily draw clear distinctions between practice and research. Casarett, Karlawish, and Sugarman propose two criteria to determine whether a clinical quality improvement initiative constitutes research. A quality- improvement initiative should be considered research if "(1) the majority of patients involved are not expected to benefit directly from the knowledge to be gained or (2) additional risks or burdens imposed make the results generalizable."32 Although these criteria refer specifically to quality improvement efforts in clinical settings, they have been applied more broadly by IRBs to distinguish research from public health practice.

The Need for Clarity

Distinguishing between public health practice and research is no mere exercise in semantics. DHHS, through its secretary's Advisory Committee on Human Subjects Research Protections (SACHRP) and OHRP, is currently examining these issues in an attempt to provide national clarification. As stated in part above, and summarized below, many reasons strongly support these efforts:

* The existence of differing standards contributes to divergent findings. What is classified as practice in one setting is deemed research in another. The same activity can be (and routinely is) simultaneously classified by different persons as practice, research, or both. As a result, public health practitioners at every level of government find it difficult to properly assess their own activities;

* Public health practice activities that are misclassified as research require public health authorities to engage in time- consuming reviews through governmental or private sector IRBs. In some cases, IRB processes, even when expedited, may thwart an activity to the detriment of the public's health. In other cases, the IRB may require additional protections for persons viewed as human subjects that defeat public health objectives in principle or design, or for lack of funding;

* Conversely, public health research that is misclassified as practice may allow governmental health authorities to collect and analyze sensitive health data in possible violation of health information privacy interests, or interact with human subjects without complete adherence to research protections;

* Human subjects research and health information privacy protections support the acquisition and use of identifiable health data for public health practice and research, but impose greater restrictions on researchers in the interests of protecting human subjects. One consequence is the creation of incentives for public health practitioners to characterize their activities as practice to avoid IRB review;

* Conversely, lacking clearer criteria, a national trend among public health practitioners is to err on the safe side. They submit many activities for IRB review simply to avoid the specter and controversy of engaging in unlawful and unethical human subjects research. This further burdens IRBs already overwhelmed with their responsibilities to protect human research subjects;33 and

* Even when a public health activity is clearly and legitimately classified as practice, the activity may eventually cross over to research. In these cases, IRB review is needed prior to the research activity commencing. Precisely when does practice cross over to become research?34 Existing criteria do not address this question.

Legal Framework Underlying Distinctions Between Public Health Practice and Research

Distinctions between public health practice and human subjects research, though complex, are attributable in part to their very different legal and ethical traditions. Public health practice, unlike research, is supported by a constitutional, statutory, and regulatory legal environment that empowers public health officials, authorizes the performance of general and specific public health functions, and provides for oversight and accountability for public health activities. Essential legal and ethical principles for the funding and performance of human subjects research are largely reflected in the federal Common Rule and incorporated into national health information privacy protections via the HIPAA Privacy Rule. Understanding these legal foundations, as explained below, helps separate public health practice from human subjects research.

Constitutional and Other Legal Principles Concerning Public Health

Public health services in the United States are grounded in constitutional principles.35 Though the federal and most state constitutions do not create any affirmative duty for government to act in the interests of communal health,36 federal, state, and local governments are vested with the ability to regulate, protect, and promote the publics health. The federal government draws upon its enumerated powers under the Constitution, specifically the powers to tax, spend, and regulate interstate commerce, to promote the public's health and safety through national public health laws executed by a host of federal public health and health care agencies.

Primary responsibility for protecting the public's health, however, is held by the states (and local governments via delegated state authority). The Tenth Amendment reserves to the states extensive powers. Commonly known as the police powers,37 they represent the inherent authority of government to enact laws and promulgate regulations to protect the health, safety, morals, and general welfare of the people.38 Police powers are exceedingly broad in scope; they justify virtually any exercise of state or local government to preserve, protect, or promote the public's health that does not infringe constitutionally-protected individual or community rights.39 The breadth of public health is seen in state statutory definitions of public health. For example, the comprehensive Turning Point Model State Public Health Act builds a definition of public health around the IOM s conception.40 "Public health" (in the Turning Point Act) means:

assuring the conditions in which the population can be healthy. This includes population-based or individual efforts primarily aimed at the prevention of injury, disease, or premature mortality, or the promotion of health in the community, such as assessing the health needs and status of the community through public health surveillance and epidemiological research, developing public health policy, and responding to public health needs and emergencies.

Corresponding to broad legal conceptions of public health is an array of specific powers and duties authorized under state and local laws. Among other functions, public health laws authorize vaccination,41 isolation and quarantine,42 inspection of commercial and residential premises,43 abatement of public health nuisances,44 regulation of air and surface water contaminants,45 standards for safe food46 and drinkingwater,47 fluoridation of local water supplies,48 and licensure of health care facilities and workers.49 Each of these and other public health functions are supported by state and local efforts to gather identifiable health data for surveillance, investigations, or evaluations through methods grounded in modern public health sciences.50

The Common Rule on Human Subjects Research

Unlike the broad powers to protect the public's health, human subjects research is tightly regulated through federal, state, and local laws, highlighted by the federal Common Rule. The Common Rule, codified in a series of federal regulations, applies to virtually all research involving human subjects that is conducted by (or with funding from) federal agencies. For most activities determined to be human subjects research (as defined above), the Common Rule requires advance review by an IRB or medical ethics board in compliance with various specifications.51 Among other things, IRBs must assess whether:52 (1) there is appropriate individual or guardian consent for data collection;33 (2) the privacy of identifiable information is protected;54 (3) there exists a sound, safe, and effective research design;55 (4) research subjects are equitably selected;56 (5) appropriate data safety monitoring is provided;57 and (6) vulnerable populations (e.g., children, prisoners, mentally- disabled) are protected.58

Five key questions underlie a determination of human subjects research: (l) is the activity research?;59 (2) if so, does the research involve human subjects?; (3) if so, is the research supported in whole or part by federal funds?; (4) if so, is the research subject to exemption?; and (5) if not exempt, is it entitled to expedited review by an IRB?

Is the activity research? Whether an activity is research or not is the basic question addressed in this article. Though the Common Rule defines research, it does not provide much guidance on how to determine if an activity is research or non-research (i.e. a public health activity or clinical practice). An IRB does not have to oversee the determination of whether an activity is or is not research.60 The Common Rule states, "Department or Agency heads retain final judgment as to whether a particular activity is covered by this policy."61

OHRP specifically acknowledges that the acquisition of identifiable health data or specimens by public health authorities for "...legitimate public health purposes within the[ir] recognized authority..., is not research."62 Of course, "...utilization of such information or specimens by [public health] investigators for research purposes would constitute engagement in research...."ftj If the activity is research or possesses significant features of research the inquiry proceeds to the next question.

Does the research involve human subjects? An institution is only engaged in human subjects research when the researcher obtains (1) data through intervention or interaction with a living individual; or (2) individually-identifiable private information about a living individual. "Individu\ally-identifiable" means the identity of the subject about to whom the private information pertains is or may readily be ascertained by the investigator or associated with the information.64 These criteria do not themselves define an activity as research; they merely identify whether it is human subjects research. This determination is important because if the research does not involve human subjects, the Common Rule does not apply. In clear cases, the determination whether human subjects are involved does not need to be made by an IRB. In ambiguous cases, this responsibility may rest with the IRB.65

Is the research funded by a federal source? If human subjects research receives funding or support from any federal agency (that has signed on to the Common Rule - most federal agencies have) or is performed by a federal agency, the Common Rule applies. If human subjects research receives no federal funding or support, the Common Rule does not apply (although most IRBs apply its principles to virtually all research).

Is the research subject to an exemption? If an activity meets all of the first three criteria, it is covered by the Common Rule, unless specifically exempted. Unlike the prior questions, a determination of exemption may not be made by those conducting the activity. Rather it should be submitted to the IRB, or some authority other than the investigator. Among other categories, the Common Rule exempts: (1) research on common educational practices,66 or involving educational tests, surveys, or observations of public behavior;67 (2) research involving existing data, documents, records, pathological specimens or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects;68 (3) research conducted by agency/department heads to evaluate public benefit or service programs; procedures for obtaining these benefits or services; possible changes or alternatives to the programs or procedures or payment levels; and service methods when conducted pursuant to specific federal statutory authority;69 and (4) taste and food quality examinations and consumer acceptance studies.70 Applying these exemption criteria is not automatic. NBAC recommends that an exemption should not be based merely on a review of the research methods, but also on the premise that there are few, if any, risks to participants and that they retain a right to refuse to participate.71

Is the research entitled to expedited review? Even when it is determined that an activity is non-exempt human subjects research, such research may be entitled to expedited IRB review if it involves minimal risks to participants and involves activities among a list of categories provided by DHHS.72 Expedited review may only be sought through the IRB. Unlike exempted research, the Common Rule still applies. Relevant research categories that may be subject to expedited review as described by OHRP73 include: (1) clinical studies of new applications of drugs and medical devices when the drug or device is already being marketed; (2) collection of blood samples by finger stick, heel stick, ear stick, or venipuncture; (3) prospective collection of biological specimens for research purposes by noninvasive means; (4) collection of data through noninvasive procedures (not involving general anesthesia or sedation) routinely employed in clinical practice, excluding procedures involving x- rays or microwaves; (5) research involving materials (data, documents, records, or specimens) that have been collected, or will be collected solely for non-research purposes (such as medical treatment or diagnosis); (6) research on individual or group characteristics or behavior, or research employing survey, interview, oral history, focus group, program evaluation, human factors evaluation, or quality assurance methodologies; (7) continuing review of certain research previously approved by the convened IRB; and (8) continuing review of research (unless conducted under an investigational new drug application or investigational device exemption) where other categories do not apply but the IRB documents that the research involves no existing or new greater than minimal risks.

State/Local Human Subject Protections

State and local public health laws and regulations may mimic Common Rule protections, but can also provide additional protections for human subjects in public health activities. Scott Burris, Professor of Law, Temple School of Law, has examined state protections for human subjects in public health practice.74 His key findings include:

* A few states (e.g., CA, NY, VA) have passed laws that specifically govern human subjects research. Most states' human subjects research protections, however, are embedded within their public health regulations, authorizing statutes, and case law.

* State law explicitly authorizes acquisition of health data for public health purposes through a form of collective consent and provides formal notice of the types of data to be collected and the purposes for their collection. These laws do not typically require individual informed consent.

* Most states protect the privacy of data collected by public health agencies, though the level of protection and procedures for further use (if any) vary according to the type of data (e.g., cancer registry data may be treated differently than HIV data).

* A few states have legal provisions explicitly addressing research design, but not at the level of specificity of the Common Rule.

* State public health laws do not typically require a specific data-safety monitoring process to assess risks. Rather, harms to subjects of public health practice may be identified through the practice itself or other methods of government accountability.

In sum, myriad state regulations may address or mirror the core protections of the Common Rule. Different oversight mechanisms are employed by states to hold public health officials accountable for compliance. In several states, boards or councils of health maintain a formal supervisory role regarding health department activity.75 In some cases, the board or council actually conducts oversight activities, including reviewing practice activities.76 In addition to explicit oversight provisions, accountability mechanisms hold public health authorities accountable for their research activities. Professor Burris identifies several of these mechanisms, including: (1) hierarchical management structure, (2) political or judicial accountability, and (3) accountability via public opinion through media exposure.77

The HIPAA Privacy Rule and Other National Privacy Laws

Individually-identifiable health information has traditionally been used by or disclosed to public and private sector entities (e.g., health care workers, pharmacies, researchers, insurance companies, and employers) for many reasons with or without an individual's explicit knowledge or consent. For decades, there has been no national approach to protecting health information privacy. The U.S. Constitution does not explicitly grant individuals a right to health information privacy, although the Supreme Court has crafted some basic health information privacy protections from constitutional norms.78 A patchwork of federal and state privacy laws offer a baffling array of provisions that many view as unsatisfactory to fully protect the privacy of health data that are increasingly digitized within a national electronic health information infrastructure.79

In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA), authorizing DHHS to promulgate the first systematic national privacy protections through administrative regulation. Implementation of the DHHS' Privacy Rule began on April 14, 2003 through its Office for Civil Rights (OCR). The Privacy Rule covers protected health information (PHI) created or received in any form by covered entities (e.g., most health care insurers, providers, and health data clearinghouses). PHI includes individually-identifiable data that relate to the past, present, or future physical or mental health or condition of a person, or the provision or payment of health care to a person.80 Correspondingly, it does not include non-identifiable health information or "de- identified data" (health statistics or other aggregate health data that do not or cannot identify individuals).81 However, the standard of what is individually-identifiable PHI is broader than the Common Rule conception of "private information." PHI is information that (1) identifies the individual on its face according to a series of key identifiers, or (2) can be used to identify the individual under a "reasonable basis."82 In sum, a broader range of health data may be considered identifiable under the Privacy Rule than the Common Rule.

The Privacy Rule and Public Health

The impact of the Rule on public health practice and research has been documented by CDC, NIH, and many others.83 Most relevant are the Rule's disclosure provisions. In general, a covered entity may not disclose PHI without individual written authorization,84 subject to a series of exceptions, including disclosures to governmental public health authorities (and their public or private sector partners)85 for public health purposes.86 The Privacy Rule allows public health disclosures of PHI without written authorization: (1) when specifically required by federal, tribal, state, or local laws (e.g., required disclosures), or (2) as otherwise permitted or authorized by law (e.g., permissible disclosures). Disclosures of PHI may be made whenever they are required by law (as typically determined by the public health authority). State public health reporting statutes often mandate the disclosure of PHI to public health authorities for public health purposes. Public healthauthorities do not have to rely on specific laws that authorize each collection of information for multiple diseases or conditions to seek disclosure of PHI from covered entities. PHI can also be acquired by public health authorities provided they are generally authorized, or permitted, to collect or receive the information for public health purposes.

Other provisions within the Privacy Rule allow covered entities to disclose PHI without individual authorization for specific purposes related to public health, including: (1) in emergency circumstances; (2) to identify the body of a deceased individual, or determine the cause of death; (3) to entities engaged in organ procurement, banking, or transplants; and (4) for activities related to national defense and security. Once PHI is disclosed to a public health authority, the Privacy Rule does not control the maintenance, use, and disclosure of the data, although other privacy laws regulations or policies may.

The Privacy Rule and Research

The default standard under the Privacy Rule is that PHI may not be disclosed for research purposes unless an individual provides written authorization. As with public health disclosures, the Rule also allows for disclosures of PHI for research purposes without written authorization. However, the research exception is much more narrowly tailored than the public health exception. As OCR explains in its guidance on the Rule,87 covered entities are permitted to disclose PHI to others for research (as defined in the Common Rule) without individual authorization under certain limited instances. These include: (1) pursuant to IRB or Privacy Board approval via a waiver of authorization based on similar criteria in the Common Rule; 88 (2) the disclosure of PHI is needed solely to prepare a research protocol or for similar purposes preparatory to research;89(3) the disclosure is solely for research on PHI of decedents;90 or (4) PHI is disclosed in a limited data set pursuant to a data use agreement between the covered entity and the researcher.91

Thus, the Privacy Rule requires differing standards for the disclosure of PHI for public health practice and research purposes. More difficult and time-consuming procedural requirements for disclosing PHI for research provide an incentive to characterize a public health activity as practice. Like the Common Rule, however, the Privacy Rule offers no meaningful guidance to distinguish between practice and research. As a result, depending on how a public health activity is classified, various health information privacy protections, including an IRB or Privacy Board review, may be required.

Supplemental Research Privacy Protections

In addition to privacy protections for research data emanating from the HIPAA Privacy Rule, federal law also offers specific privacy protections for identifiable health data used in health research. Sections 308(d) and 301(d) of the federal Public Health Service Act (PHSA) authorize the execution of assurances and certificates of confidentiality, respectively, to protect statistical and research data. Specifically, these sections allow public health agencies (like CDC) and outside researchers to assure human research subjects and others that recipients of their health data will protect their confidentiality. Assurances of confidentiality under section 308(d)92 apply to statistical data collections conducted by federal public health agencies. section 308(d) provides that no identifiable information may be used for any purpose other than that for which it was supplied, unless the agency or person has consented. Certificates of confidentiality, available to researchers within and outside government, are authorized under section 301(d).93 They may be granted by DHHS to protect research participants from legally-compelled, non-consensual disclosures of any identifiable information (including health data) to persons not connected with the research. This confidentiality protection is generally sought by researchers for sensitive health data (e.g., related to sexual practices or illegal conduct) to encourage subjects to participate or provide accurate or complete data. IRBs reviewing research proposals can recommend that the researcher obtain a certificate of confidentiality as part of the IRB approval for the study.

State and Local Public Health Information Privacy Laws

State and local health information privacy laws, like existing federal privacy protections, create a myriad of privacy protections. A few states have comprehensive medical privacy laws that are similar in scope to the HIPAA Privacy Rule. Additional state and local health information privacy laws relate to disease- or condition-specific subjects. For example, many states protect the privacy of genetic tests or information, provide enhanced provisions for super-sensitive health data like HIV/AIDS, or support additional security measures for governmental health data collections.

State public health privacy laws are also inconsistent and fragmented.94 These laws do not always properly balance individual privacy interests with collective public health interests. Some state public health privacy laws may stymie information flows, apply more protections to specific health information with little justification, or significantly discount individual privacy. A 1999 project to develop enhanced public health privacy protections under the auspices of the CDC led to the Model State Public Health Privacy Act (MSPHPA).95 Provisions of MSPHPA, which are also featured in the comprehensive Turning Point Model State Public Health Act,96 provide strong and consistent privacy safeguards for public health data while preserving the ability of state and local health agencies to use the data for the common good.97 Like most existing public health privacy laws, MSPHPA authorizes uses or disclosures of identifiable health data held by public health agencies for research purposes, but does not attempt to systematically distinguish public health practice from research.

Enhanced Guidelines to Distinguish Public Health Practice and Human Subjects Research

Existing definitions, theories, approaches, and legal foundations inform the analysis of the distinctions between public health practice and research, but does not sufficiently guide public health practitioners, IRB members, and others to make clear distinctions in every case where the Common Rule and the HIPAA Privacy Rule are implicated. Classifying a public health activity as practice or research can be relatively simple for easy cases. The challenge is to develop improved criteria for making distinctions in hard cases, including activities that have practice and research components. This section presents a twostage process utilizing guidelines and a corresponding checklist to make distinctions between public health practice and research in easy and hard cases. The first stage neatly separates public health practice and research based on some of their essential characteristics. For the hard cases, a second stage introduces enhanced guidelines that provide justifiable, additional factors for making distinctions.

Regardless of the complexity of the case, this dual stage approach requires public health authorities to honestly describe their intent, motivation, and objectives for their activities by answering some basic questions: (1) what prompted the performance of the activity; (2) on what (or whose) authority is the activity conducted; (3) what do the performers of the activity hope to achieve; (4) how will information from the activity be used; and (5) who will benefit from the activity? Incomplete facts, inaccurate observations, misstatements, or manipulations of stated objectives can lead to improper classifications or erroneous findings.

A primary assumption underlying the proposed distinctions between public health practice and research is that a public health agent or entity (or an authorized partner) seeks to collect, use, or disclose identifiable health information, bodily tissues, or biological samples for a specified activity. The collection of data will likely come through persons within and outside of public health (e.g., private health care providers). If the data are non-identifiable from the outset, the Common Rule provisions and HIPAA Privacy Rule requirements for disclosure are largely not implicated. If the data are not health-related, the Privacy Rule is unimportant, though the Common Rule may still apply because it also covers non-health data used for research purposes.

Although this primary assumption addresses most data collection practices for public health or research purposes, other data uses may fall outside of this assumption and yet still require distinction. For example, public health authorities may acquire identifiable health data from non-covered entities. These data acquisitions would not implicate the Privacy Rule, but may still require an assessment of whether the collection supports public health practice or research. Furthermore, public health authorities may engage in research activities under the Common Rule without acquiring identifiable health data. Human subjects research includes the collection of non-identifiable data through intervention or interaction with a living individual. Such collections do not implicate the Privacy Rule, but the Common Rule may still apply. Thus, it is important to consider the primary assumption underlying this dual stage approach.

To be sure, no set of criteria will completely resolve quandaries about the distinctions between public health practice and research. The objective, however, is to provide enhanced guidance that leads to resolution in a wider majority of cases. Additional, agencyspecific analyses may also be required. For example, additional regulations applying to the CDC, Food and Drug Administration (FDA), Centers for Medicare and Medicaid Services (CMS), or other p\otential funders or performers of practice or research activities may apply and require further analyses.

Stage 1 - Essential Characteristics of Public Health Practice and Research

The initial step to distinguish public health practice activities from human subjects research activities is to review those parameters that are exclusive to each activity. What is it about public health practice that is unique? What must be shown for an activity involving identifiable health data to be characterized as human subjects research under the Common Rule? These essential characteristics, or foundations, of public health practice and research help separate the easy and hard cases, and eliminate some cases altogether from further need for classification.

Public Health Practice

Essential characteristics of public health practice (defined earlier as the collection and analysis of identifiable health data by a public health authority for the purpose of protecting the health of a particular community, where the benefits and risks are primarily designed to accrue to the participating community) include:

* Involves specific legal authorization for conducting the activity as public health practice at the federal, state or local levels;

* Includes a corresponding governmental duty to perform the activity to protect the public's health;

* Involves direct performance or oversight by a governmental public health authority (or its authorized partner) and accountability to the public for its performance;

* May legitimately involve persons who did not specifically volunteer to participate (i.e., they did not provide informed consent); and

* Supported by principles of public health ethics that focus on populations while respecting the dignity and rights of individuals.

Human Subjects Research

Essential characteristics of human subjects research (defined earlier as the collection and analysis of identifiable health data by a public health authority for the purpose of generating knowledge that will benefit those beyond the participating community who bear the risks of participation) include:

* Involves living individuals;

* Involves, in part, identifiable private health information;

* Involves research subjects who voluntarily participate (or participate with the consent of their guardian) absent a waiver of informed consent; and

* Supported by principles of research ethics that focus on the interests of individuals while balancing the communal value of research.

These characteristics distinguish practice from research in many of the easy cases. For example, a public health reporting requirement may be specifically authorized via legislation or administrative regulation. The laws may require the public health agency to perform the activity to protect the public's health. Some states, like New York, statutorily clarify that epidemiological investigations or other common public health practices are not human subjects research.98 These activities are public health practice so long as their design and implementation do not cross over to the realm of research. As well, if an activity may lawfully require the non-voluntary compliance of autonomous individuals, it is likely not classifiable as research because voluntary consent is a foundation of research. Only through the approval of a waiver of the consent requirement pursuant to regulatory reviews may persons participate in human subject research without providing specific informed consent. Furthermore, if an activity is designed as research, but does not involve identifiable health data about living individuals, it should not be classified as research for the purposes of this analysis (because it does not implicate the HIPAA Privacy Rule). If a human subjects research study is specifically exempted from the Common Rule, the activity can be performed without adhering to the requirements of the Common Rule.

Stage 2 - Enhanced Guidelines

The essential characteristics of public health practice and research suggested in Stage 1 may help resolve the simpler cases, but more complicated scenarios remain. A state public health authority may, for example, be specifically authorized to investigate a public health problem and choose to engage in a series of activities, including in part asking participants to voluntarily complete a written survey that indirectly references health data. Reviewing the essential characteristics of public health practice or research may not fully allow the practitioner to properly classify this activity. Additional guidance is needed.

Many enhanced criteria have previously been proposed to facilitate these distinctions. These include an examination of (1) who is performing the activity, (2) whether the findings of the activity are to be published (and where), (3) the urgency underlying the activity, and (4) the source of funding. None of these criteria are particularly helpful in making meaningful distinctions, and thus should be rejected for many reasons.

Consideration of who is performing the activity (whether government or private sector) is dissatisfying for two reasons: (a) it is assumed (for the purposes of this approach) that a public health authority is either conducting, funding, or overseeing the activity, thus implicating the Common Rule or other research protections regardless of who actually performs the activity; and (b) the HIPAA Privacy Rule and other laws allow governmental public health agencies to authorize private sector actors (via contract or other agreements) to conduct public health functions. Some suggest that intention to publish the results of their analyses of identifiable health data in a peer-reviewed journal or other source supports a finding of research. Whether persons performing the activity intend to publish, however, is not particularly helpful for distinguishing practice from research. Public health practitioners and researchers routinely publish their findings (without identifiable health data) whether engaged in practice or research.

The exigencies of a set of circumstances may justify a quick classification of an activity as public health practice, or even immediate action without prior classification. However, urgency alone is insufficient to distinguish between practice and research. Public health dilemmas may require quick actions through activities that are practice-oriented and activities that are research. Public health agencies and IRBs can expedite classification decisions in such emergent cases. Finally, the source of funding or support for the performance of a public health activity is an insufficient basis to classify the activity as research or practice. While technically the Common Rule is only implicated when federal funds are used to conduct or support human subjects research, or if an institution has voluntarily extended its assurance of compliance to all human subjects research regardless of funding, Common Rule standards are nearly universal. As well, the HIPAA Privacy Rule applies waiver requirements that are similar to the Common Rule for uses and disclosures of PHI without written authorization on a national basis regardless of funding sources.

The enhanced guidelines, below, provide meaningful bases to distinguish between research and public health practice when applied to any proposed or actual activity that fits the parameters of the primary assumption. None of these guidelines alone are sufficient to fully classify an activity. For more complex, multi-stage, or multi- dimensional activities, the activities themselves must first be unbundled and examined separately using these criteria. Public health practitioners, for example, cannot conclude that a multi- faceted activity that includes research components is public health practice just because most of the work is practice. Rather, they must separate and examine each of the various components to make proper distinctions, and apply appropriate regulatory frameworks depending on each components' classification. If the application of any one of these guidelines leads to a classification that an activity is research, the activity should likely be treated as research. These guidelines include:

General Legal Authority

Two of the essential characteristics of public health practice (see Stage 1) are that there may be specific legal authority to engage in public health practice and a corresponding duty of public health agencies to fulfill that duty. In most of the cases, a specific legal duty supports classifying the corresponding activity as practice. In some cases, however, public health authorities may act pursuant to general legal authorization. For example, a public health agency may seek to collect data on the prevalence of an emerging condition within a subset of the population, but may not have precise legal authority to acquire data for the specific condition. It may instead rely upon a general legislative authorization to "acquire any health data needed to monitor health conditions in the population."

The existence of general legal authorization supports a finding of public health practice, but does not conclusively lead to this end. General legal authority may also allow the public health authority to use research methods to improve the public's health. The brief statement of authority above, for example, may authorize a public health authority to use practice or research techniques to fulfill its objective. While circumstantial analysis of the meaning of the scope and limits of the general legal authorization is necessary to draw firm conclusions, this is a potential factor to consider.

Specific Intent

CDC and others have focused on the role of intent as a primary factor to distinguish practice and research. CDC suggests that the intent of public health practice is to "prevent or control disease or injury and improve health, or improve a public health program or service." The intent of research is "to generate or contri\bute to generalizable knowledge." The weakness of these statements is their generality; they might easily apply to either practice or research. Greater specification of underlying intent is needed. The intent of research may be restated as "to test a hypothesis and seek to generalize the findings or acquired knowledge beyond the activity's participants." The intent of public health practice may be restated as "to assure the conditions in which people can be healthy through public health efforts that are primarily aimed at preventing known or suspected injuries, diseases, or other conditions, or promoting the health of a particular community." If specific intent clearly and irreversibly changes during the administration of the activity (e.g., a surveillance activity crosses over to a research study), renewed analysis of the activity is needed. If specific intent underlying the activity is sustainable as research and practice (e.g., a hybrid case), the activity must by default be viewed as research. If any intent underlying the activity relates to research, OHRP advises that the activity must be viewed as research, at least under this element of the enhanced guidelines.

Responsibility

In the research context, the focal point of responsibility for the health, safety, and well being of individual participants falls upon a specific individual, typically the principal investigator (PI), as well as those working under the PI's supervision. The PI must adhere to the conditions of the Common Rule in conducting the research and can be held personally accountable for the health and safety of research subjects. Research subjects are entitled to expect that the PI and staff will conduct the research within the limits of the subjects' informed consent and other ethical duties consistent with the Common Rule.

Public health practice does not always feature direct individual responsibility for the welfare of participants. In many practice activities, the responsibility for individuals' welfare falls generally upon government entities. Public health practitioners are still accountable for their actions that may impact the health, safety, or welfare of participants in a practice activity, but this does not arise because of a relationship with participants like that of a PI and her subjects. It arises because legal and ethical duties assumed by public health practitioners as governmental representatives require them to promote these interests in the performance of their activities.

Participant Benefits

Public health practice and human subjects research activities both offer the potential to benefit the community through improvements in health outcomes. However, an assessment of the potential (or expectation) of benefits to participants concerning each activity provides an opportunity for drawing better distinctions. Participants in human subjects research may receive (nor expect) no direct benefit from (and may even be harmed by) the activity. While human subjects may individually benefit, research is designed primarily to help researchers and society make potential gains through advancements in scientific knowledge. Such advancements are valuable to society, but should not ethically be derived at the expense of participants who may face risks. Whenever risks are imposed on participants to make the results generalizable beyond the participants themselves, the activity should be classified as research.

Unlike research, public health practice activities are premised on providing some benefit to participants or the population of which they are members. Though failures in design or implementation of public health practice activities may limit or defeat these benefits, the supporting objective remains the same: public health practice should contribute to improving the health of participants. Research, however, may not. If the activity offers no expectation or prospect of benefit to the participants, then the activity should be classified as research.

Experimentation

There is an experimental quality to research that public health practice does not always share. Research may involve introducing something non-standard to research subjects or to the analysis of their identifiable health data. Sometimes, what is introduced is experimental (e.g., the application of a new and unproven medical procedure). In other cases, existing methods of analysis are used to produce new knowledge (e.g., the exploration of a subject's health data to assemble knowledge previously unknown).

Although innovations are part of public health practice, it is dominated by the use of standard, accepted, and proven interventions to address a known or suspected public health problem. Through the use of standard practices, public health practitioners can properly assess the nature of the problem and apply proven techniques to limit its impact on the population's health.99 Applying non- standard approaches in public health practice activities may not provide meaningful data to guide additional public health responses. Thus, if any activity involves introduction of non-standard or experimental procedures, the activity is more likely research rather than public health practice.

Subject Selection

Human subjects research is largely (though not exclusively) driven by the desire of a researcher to test an underlying hypothesis. The research study is designed to answer the question. To reduce the possibility of bias, the researcher may select human subjects randomly so that the results can be generalized to a larger group. Practitioners of public health activities rarely choose participants. Participants are selected because they have or are at risk of, a particular disease or condition and can likely benefit from the activity. Public health practice activities are not designed to test hypotheses but to benefit the participants or their communities. Thus, if an activity utilizes control groups or randomly selects its participants to eliminate bias, the activity is likely research rather than public health practice.

Checklist fo

Source: Journal of Law, Medicine & Ethics, The

More News in this Category