BIO's Recommendations for National Privacy Legislation

The Biotechnology Industry Organization (BIO) supports national legislation to protect the confidentiality of all individually identifiable medical information. BIO believes that this medical information must be respected, treated confidentially and safeguarded from discriminatory misuse.

Medical research holds great promise for alleviating the suffering associated with many diseases. Standards to protect the confidentiality of individually identifiable medical information, therefore, should be implemented to ensure that vital medical research is encouraged and facilitated. Laws that inappropriately restrict the use of individually identifiable medical information could slow the development of new drugs and biologics and dash the hopes of patients whose lives depend on access to innovative treatments.

Regulations already exist to protect the safety of individuals and the confidentiality of information generated about them during the course of most medical research studies. Under these regulations, the National Institutes of Health (NIH) and the Food and Drug Administration (FDA) require informed consent from participants and approval by a national or local review board for medical research. BIO believes any changes to the requirements for obtaining informed consent for research purposes should be made to existing regulations in the context of federal oversight of research, rather than through privacy legislation.

BIO believes that privacy legislation should be national in scope to avoid impeding medical research with a patchwork of inconsistent state laws. Efforts to protect the confidentiality of individually identifiable medical information and to promote research are best served by a uniform standard. States that impose greater restrictions on research over and above a national standard could drive research out of a state, negatively impacting research at universities and companies as well as denying patients in those states access to clinical research.

BIO's recommendations for drafting privacy legislation are focused on individually identifiable medical information used in the research and development of new diagnostics and treatments. We recognize there are other important and necessary uses of medical information, such as for patient care and reimbursement, that are not encompassed in these recommendations.

• BIO supports the enactment of comprehensive legislation to protect the confidentiality of medical information that identifies a specific individual.

   

• Privacy legislation should be carefully crafted to allow the continuation of vital medical research.

   

• Genetic information cannot be scientifically or practically separated from other medical information and therefore should not be addressed separately.

   

• Medical research using information that identifies a specific individual should continue to be governed by existing FDA and NIH regulations to protect the safety of medical research participants and the confidentiality of information generated about them.

   

• Medical information that identifies a specific individual should not be disclosed without that individual's consent, unless the disclosure is authorized by law. Medical information that does not identify a specific individual should not be subject to consent requirements, as it does not raise privacy concerns.

   

• Establishing ownership rights in medical information and samples is not an appropriate mechanism for protecting confidentiality. Statutes that would confer ownership of medical information and samples will hinder research.

   

• Privacy legislation should protect the current practice of storing tissue samples and medical information which is critical to medical research.

   

• Privacy legislation should not require the destruction of medical information and samples as this is detrimental to medical research.

   

• Medical information should be safeguarded from discriminatory misuse.

   

• Privacy legislation should provide effective remedies for violations.

   

• Privacy legislation should be national in scope to avoid impeding medical research with a patchwork of inconsistent state laws. Efforts to protect medical information identifying a specific individual and to promote research are best served by a uniform standard. Federal law should preempt all state health information law with certain exceptions, such as doctor-patient privilege and licensing.

Q. How should privacy legislation apply to medical research?

A. Privacy legislation should be carefully crafted to allow the continuation of vital medical research. BIO recommends that the use of patient identifiable information in medical research should continue to be governed by existing regulations to protect the safety and privacy of research subjects, specifically those cited in the Code of Federal Regulations at 21 CFR 50 and 45 CFR 46.

The regulatory system governing medical research in America today is both comprehensive and complex. Biotechnology and pharmaceutical research is closely regulated by the FDA. For both the public and private sectors, strict national and institutional guidelines prescribe how medical research shall be conducted. The research process is carefully monitored to ensure strict patient confidentiality. In addition to obtaining FDA or NIH review, clinical trials also must be approved by institutional review boards (IRBs), in compliance with NIH guidelines and FDA regulations, to assure patient safety and confidential treatment of data.

Q. Should privacy legislation address genetic information separately from other medical information?