The Health Insurance Portability and Accountability Act of 1996 (HIPAA, or the Privacy Rule) [2] and the 21^st Century Cures Act (the Cures Act) require, among other things, that patients have access to their Protected Health Information (PHI) upon request. Hence, research records or results that are maintained by the covered entity as part of a designated record set (i.e., are included in the EMR) would be accessible to research participants unless one of the Privacy Rule’s or Cures Act’s permitted exceptions applies.

One of the permitted exceptions applies to PHI created or obtained by a researcher during the course of clinical research. The Privacy Rule and the Cures Act permit the individual’s access rights in these cases to be suspended while the clinical research is in progress, provided the research participant agreed to this denial of access when consenting to participate in the clinical research study. In addition, the research study team must inform the research participant that the right to access protected health information will be reinstated at the conclusion of the clinical trial.

California’s Information Practices Act (CIPA) and Patient Access to Health Records Act (PAHRA) also give patients access rights. CIPA prevails over PAHRA with respect to records maintained by a state agency, and under CIPA, the study is not required to disclose personal information if it pertains to the physical/psychological condition of the person, if the study determines that disclosure would be detrimental to the person. In addition, if the withholding of results has been disclosed on the consent form, the participant has agreed to such withholding, and the law requiring access does not apply.

During the course of the research, there is a chance the study team will find something unexpected that may require clinical follow-up. Participants in research studies can obtain incidental findings from the research if they are part of the EMR, but these results may also be withheld while the research is being conducted. Depending on the immediacy of the need to take appropriate clinical action, however, concerns over study integrity must be balanced against participant safety, and participant safety must always be factored into any decision regarding return of incidental findings.

The Privacy Rule and the Cures Act apply only to information, including research results, that is contained in the covered entity’s EMR. Research data that is not included in the participant’s EMR is considered Research Health Information (RHI) and is not subject to these disclosure rules. RHI does not need to be released to participants, either during or at the conclusion of the research, by federal regulations. However, unless the consent form specifically states that research results will never be released, then RHI containing PII may be requested by a participant and will need to be provided under CIPA. The exception to such required release, as indicated above, is if the investigator determines that disclosure would be detrimental to the person. In such cases, if the consent form did not provide for indefinite withholding of research results, the investigator would cite the Civil Code when declining to provide the results. Study teams should describe in the consent form whether RHI will be provided, under what circumstances, and when.

Under no circumstances will the IRB permit disclosing individual participant data associated with investigational or unvalidated assays, as they can be harmful when used to guide clinical decisions. The Clinical Laboratory Improvement Amendments of 1988 (CLIA) prohibit the return of individual research laboratory results to research participants unless the results were generated by a CLIA-certified laboratory. Additionally, the FDA has specific requirements for and restrictions on the use of an investigational assay, or an approved assay used in an investigational manner, as a diagnostic procedure.

The action of returning or sharing results with research participants should be thought of as offering the results. When individual research results are offered, participants should be given the opportunity to decide whether or not to receive the results, rather than automatically receiving them.

If a participant requests their individual research data that is being withheld, the IRB may determine that a participant’s request may be accommodated based on:

1. Whether the data collection tools are validated
2. How the data are planned to be used. The IRB may determine that it is not appropriate to release individual participant data if there is a possibility that the data may be misused (e.g., for clinical purposes when not appropriate or possibly harmful).
3. Evaluating the process for sharing the data. One of the considerations in evaluating whether the process for sharing is appropriate is based on whether the study team possesses appropriate expertise to provide counseling for the participant. The IRB may require that key personnel be added to the study to facilitate appropriate sharing.

• Ensure that researchers have a plan for results that will be offered for return, including an assessment of clinical actionability and urgency
• Assess plans for sharing other types of research results and determine whether such sharing should be permitted
• Review all plans for the return of results in consideration of the risk of returning the results versus anticipated benefits
• Review the consent process to determine if the information provided to participants addressing the conditions of sharing of results are appropriate, including the ability of participants to opt out of the return of non-critical results