New evidence of privacy violations in the CAFE study

Last week I posted a HIPAA form for Dan Markingson which the University of Minnesota had produced in response to a complaint by Mike Howard.  What was so puzzling about this HIPAA form was that it had never emerged  during the lawsuit by Mary Weiss, despite her charge that Markingson had not consented to the release of his health information to CAFÉ study sponsors.  In fact, when Stephen Olson was deposed, he was repeatedly questioned about HIPAA regulations (and was unable to give good answers.) At the time, the only relevant document found in Markingson’s medical records was an unsigned “consent for service” document from Fairview Hospital. But the new HIPAA form produced by the university contained a dated signature by Markingson. If the university had been in possession of a signed, dated HIPAA authorization form from Dan Markingson all along, why didn’t it produce that HIPAA form in the lawsuit?

Today the family of another CAFÉ study subject has allowed me to post the HIPAA authorization form found in the medical records of their family member. As you can see, this form appears to be the same form that was given to Mike Howard, and it appears to be specifically written for the CAFÉ study. But it has no signature. The absence of a signature suggests that the private health information of this subject may have been provided to the CAFÉ study sponsors (AstraZeneca and Quintiles) without the consent of the subject.

Another odd feature appears on both forms: a sentence that reads “This authorization does not have an expiration date.” Yet to be valid, all HIPAA authorization forms must specify an expiration date or event. Investigators cannot require subjects to release their health information in perpetuity.

What does this mean?  Well, at a minimum, a single unsigned form suggests a HIPAA violation, which is a felony.  Of course it is possible that, if pressured, the university could produce a signed HIPAA form for this subject. But so far it has not. Still, I would think that the presence of an unsigned form would at least be enough to warrant some hard questions – specifically, did the other subjects in the CAFÉ study authorize the release of their health information, or were their HIPAA forms left unsigned as well?

Perhaps the more alarming question relates to the absence of an expiration date.  That suggests a more systemic problem.  If the HIPAA forms for two subjects in the CAFÉ study contain the sentence “This authorization does not have an expiration date,” it seems likely that all of the HIPAA forms did.  And if that is true, then I would think there is a case to be made that the privacy rights of all 17 of the CAFÉ study subjects were violated. I am not a lawyer, nor am I an expert on HIPAA. But my sense is that these forms would probably prove very difficult for the university to justify in court.