The document is a formal letter from the Council on Governmental Relations (COGR), representing over 145 major research universities, addressed to the Secretary of Health and Human Services. It provides a detailed response to proposed modifications to the HIPAA Privacy Rules as they pertain to research activities involving individually identifiable health information. COGR appreciates the Department’s efforts to clarify and streamline these provisions but strongly advocates for research subject to oversight by Institutional Review Boards (IRBs) under the Common Rule to be exempt from HIPAA Privacy Rule requirements. The letter argues that existing federal regulations (the Common Rule) already mandate robust privacy and data confidentiality protections for research participants, making additional HIPAA requirements unnecessary and potentially duplicative.
COGR offers specific recommendations to harmonize HIPAA with current research practices, including allowing combined consent and authorization forms, clarifying the criteria for waivers of authorization, eliminating the need for expiration dates on research authorizations, and permitting limited, well-defined re-disclosures for scientific validation. The association also urges the Department to allow academic and nonprofit researchers broader access to health information registries without needing separate authorizations, mirroring privileges granted to FDA-regulated entities. Concerns are raised regarding the heightened regulatory burden on IRBs and covered entities resulting from strict de-identification and accounting requirements, which could impede important research without tangible privacy benefits. COGR concludes by recommending that the Department integrate HIPAA privacy standards into the Common Rule guidance rather than through separate, overlapping regulations, emphasizing that protecting participant privacy remains the research community’s top priority while also ensuring that regulatory frameworks support scientific progress.
