Randy Billings reports:
A former patient at a city-run health clinic has formally asked federal regulators to determine whether Portland officials violated privacy laws by sharing the names and contact information of more than 200 HIV-positive patients with university researchers without patient consent.
Jenson Steel, a former patient at the city’s HIV Positive Health Clinic and member of the Patient Advocacy Committee, said he filed a complaint last Thursday with the U.S. Department of Health and Human Services’ Office of Civil Rights. He and other members of the committee have asked the city to halt the research until the office issues a ruling.
Read more on Press Herald. Note that this relates to a matter I had recently raised on this site in the context of other research when an institutional review board (IRB) gave researchers patients’ consent without the patients’ specific knowledge or consent. In this case, it was a state law that permitted an IRB to give researchers consent:
The federal complaint comes after the Maine Attorney General’s Office concluded that the city complied with the state’s HIV confidentiality statute, because the disclosure was for the limited purpose of research and approved by the University of Southern Maine’s Institutional Review Board. However, the Attorney General’s Office, which reviewed the process at Steel’s request, does not have the authority to rule on potential violations of the federal Health Insurance Portability and Accountability Act, and concerned patients were referred to the federal DHHS Office of Civil Rights.
There were somewhat more than 200 people to be surveyed. Could they really not have just sought and obtained their consent? Was it necessary to use a waiver procedure, or was it just convenient? HIV status is among the most sensitive information. Maybe HIPAA and state laws shouldn’t be so quick to allow waiver of consent based on IRB approval?