Thursday, February 14, 2013

New evidence of privacy violations in the CAFE study

Last week I posted a HIPAA form for Dan Markingson which the University of Minnesota had produced in response to a complaint by Mike Howard.  What was so puzzling about this HIPAA form was that it had never emerged  during the lawsuit by Mary Weiss, despite her charge that Markingson had not consented to the release of his health information to CAFÉ study sponsors.  In fact, when Stephen Olson was deposed, he was repeatedly questioned about HIPAA regulations (and was unable to give good answers.) At the time, the only relevant document found in Markingson’s medical records was an unsigned “consent for service” document from Fairview Hospital. But the new HIPAA form produced by the university contained a dated signature by Markingson. If the university had been in possession of a signed, dated HIPAA authorization form from Dan Markingson all along, why didn’t it produce that HIPAA form in the lawsuit?

Today the family of another CAFÉ study subject has allowed me to post the HIPAA authorization form found in the medical records of their family member. As you can see, this form appears to be the same form that was given to Mike Howard, and it appears to be specifically written for the CAFÉ study. But it has no signature. The absence of a signature suggests that the private health information of this subject may have been provided to the CAFÉ study sponsors (AstraZeneca and Quintiles) without the consent of the subject.

Another odd feature appears on both forms: a sentence that reads “This authorization does not have an expiration date.” Yet to be valid, all HIPAA authorization forms must specify an expiration date or event. Investigators cannot require subjects to release their health information in perpetuity.

What does this mean?  Well, at a minimum, a single unsigned form suggests a HIPAA violation, which is a felony.  Of course it is possible that, if pressured, the university could produce a signed HIPAA form for this subject. But so far it has not. Still, I would think that the presence of an unsigned form would at least be enough to warrant some hard questions – specifically, did the other subjects in the CAFÉ study authorize the release of their health information, or were their HIPAA forms left unsigned as well?

Perhaps the more alarming question relates to the absence of an expiration date.  That suggests a more systemic problem.  If the HIPAA forms for two subjects in the CAFÉ study contain the sentence “This authorization does not have an expiration date,” it seems likely that all of the HIPAA forms did.  And if that is true, then I would think there is a case to be made that the privacy rights of all 17 of the CAFÉ study subjects were violated. I am not a lawyer, nor am I an expert on HIPAA. But my sense is that these forms would probably prove very difficult for the university to justify in court.





1 comment:

  1. One could also theorize that any HIPAA form offered by the Ambulatory Research Center to CATIE study patients contains the same "No" expiration sentence and in effect makes that form also non-valid. In Dan Markingson's situation, what the University just seems to ignore or try to hide, is the fact the supposed date that Dan signed the agreement is three days after he signed the consent form and was enrolled into the study. There is absolutely no paper document or record anywhere that states Dan agreed to be interviewed by Jean Kenney, Liz Lemke or anyone else connected with the CAFE' study. No record in any of his hospital notes indicating that he possibly gave "verbal" authorization to anyone connected with the CAFE' study to approach him. The unmitigated arrogance of the psychiatry department's research attitude that anything goes has got to come to a halt. Carl Elliott is polite in how he describes Stephen Olson's depo responses regarding abuses of Dan's civil rights, Olson states he really doesn't know if HIPAA was even in effect, what it actually constitutes, never had any training regarding human subjects HIPAA rights, basically could have cared less. That's how they run trials at the ARC.

    ReplyDelete