Legal Issues in Human Subject Research
By Cinead Kubiak
2010 Annual IRB Board Member Training
Disease Reporting
• Reporting AIDS and HIV Testing
• Mandatory Disease Reporting
• Mandatory Reporting of Cancer
Reporting AIDS and HIV Testing
Health Care Providers must report AIDS or HIV infection to the Utah Dept. of Health.
Guidelines provide details of reporting and details of IRB authority to grant exemption from
reporting requirement.
 Investigators complete the HIV Testing Checklist and disclose mandatory reporting in
the consent document.
 Board Members verify that disclosure of mandatory reporting is made in the consent
document. In rare cases, Board Members may grant exemption from reporting
requirements.
Language from IRB’s consent template:
‘If HIV testing is performed as a result of study participation, state that additional
consent will be required for the University of Utah Hospitals and Clinics or PCMC
(as applicable) which describes how results will be given to the participant and the
methods or opportunities participants will be given for appropriate counseling and
medical care.’
Mandatory Disease Reporting
Health care providers are required to report communicable diseases within 24 hours of concluding that a report is
required (refer to http://health.utah.gov/epi/report.html for a current list of Utah’s reportable diseases).
 If testing is performed for any communicable or infectious diseases reportable by Utah State law as a result of
study participation, Investigators disclose mandatory reporting in the consent document.
 Board Members verify disclosure of mandatory reporting that is made in the consent document.
Language from IRB’s consent template:
If testing is performed as a result of study participation for any communicable or infectious diseases
reportable by Utah State law, the following must be addressed in this section (refer to
http://health.utah.gov/epi/report.html for a current list of Utah’s reportable diseases):
 Tell the participant about the state reporting.
 Describe how results will be given to the participant to comply with state reporting requirements.
 Describe the methods or opportunities participants will be given for appropriate counseling and
medical care.
Mandatory Reporting of Cancer
All hospitals, radiation therapy centers, and other facilities and health care
providers are required to report to the Department of Health new cases of
cancer within six months of diagnosis.
 If an Investigator is a health care provider who diagnoses cancer in a
patient, he/she is responsible for the mandatory reporting of cancer
as described.
 No verification necessary by Board Members.
Criminal Reporting
• Mandatory Reporting of Injury as a Result of Criminal Conduct
• Mandatory Reporting of Child Abuse
• Mandatory Reporting of Abuse of Vulnerable Adult
Mandatory Reporting of Injury as a
Result of Criminal Conduct
Any health care provider who cares for any person who suffers from an injury
resulting from criminal conduct (including as gunshot wounds, stabbings,
explosive devices), shall immediately report to a law enforcement agency the facts
regarding the injury.
 It is not possible to predict when a health care provider will care for a person
who suffers from an injury resulting from criminal conduct. If an
Investigator is a health care provider, he/she is subject to mandatory
reporting of injury as a result of criminal conduct as described.
 No verification necessary by Board Members.
Mandatory Reporting of Child Abuse
Any person that has reason to believe that a child has been subjected abuse, or neglect, or who observes a child being subjected to
conditions or circumstances which would reasonably result in sexual abuse, physical abuse, or neglect, shall immediately notify
the nearest law enforcement agency, or office of the Division of Child and Family Services.
If an Investigator has reason to believe a child has been abused, neglected or observes a child being subjected to
conditions which would reasonably result in abuse or neglect, he/she must report such observations as described.
Since it is not possible to predict the observation of abuse or neglect, if a study involves the possibility of the disclosure
of abusive situations, Investigators should include language regarding the reporting of abuse in the consent
document.
 Board Members verify language regarding the reporting of abuse is in the consent document, if applicable.

Language from IRB’s consent template:
In some cases this section must include a statement about mandatory reporting of confidential information such as
when the researcher is legally obligated to reveal instances of child abuse, elder abuse, or abuse of the disabled. If
your study involves the possibility of disclosure of abusive situations, the following mandatory language from
the Department of Health and Human Services must be inserted:
‘However, if you disclose actual or suspected abuse, neglect, or exploitation of a child, or disabled or elderly adult,
the researcher or any member of the study staff must, and will, report this to Child Protective Services (CPS),
Adult Protective Services (APS) or the nearest law enforcement agency.’
Mandatory Reporting of Abuse of
Vulnerable Adult
Any person who has reason to believe that any vulnerable adult has been the subject of abuse, neglect, or
exploitation shall immediately notify Adult Protective Services intake or the nearest law enforcement agency.
 If an Investigator has reason to believe a vulnerable adult has been abused, neglected or exploited, he/she
must report such observations as described. Since it is not possible to predict the observation of abuse or
neglect, if a study involves the possibility of the disclosure of abusive situations, Investigators should include
language regarding the reporting of abuse in the consent document.
 Board Members verify language regarding the reporting of abuse is in the consent document, if applicable.
Language from IRB’s consent template:
In some cases this section must include a statement about mandatory reporting of confidential information such as
when the researcher is legally obligated to reveal instances of child abuse, elder abuse, or abuse of the disabled. If
your study involves the possibility of disclosure of abusive situations, the following mandatory language from
the Department of Health and Human Services must be inserted:
‘However, if you disclose actual or suspected abuse, neglect, or exploitation of a child, or disabled or elderly adult,
the researcher or any member of the study staff must, and will, report this to Child Protective Services (CPS),
Adult Protective Services (APS) or the nearest law enforcement agency.’
Privacy
• Genetic Testing Privacy Act
Genetic Testing Privacy Act
According to Utah law, special protection applies with regard to genetic information.The law
places restrictions on the use/disclosure of private genetic information to employers and to
health insurers.
Issues regarding privacy and confidentiality constitute a large portion of the potential risks in
genetic research. Such risks include
 Discovery of non-paternity
 Negative impact on the participants’ insurability or employability
 Social discrimination
Genetic Testing Privacy Act (cont.)
The investigator must provide a plan to protect privacy and confidentiality in the new study application and the consent
document, addressing the following considerations:
 Investigators must establish a method to secure information related to genetic testing in a highly secure and confidential
manner, and communicate this method in a manner satisfactory to the IRB and the participant.The investigator must specify
who will have access to genetic results, limiting access only to those who will need the results to appropriately conduct the
research.
 For studies that may discover non-paternity, a plan must be described for protecting the rights and privacy of the
participants and their family members.The investigator may choose to withhold all knowledge of non-paternity from the
participant.This should be adequately conveyed in the consent document.
 Genetic results obtained through the study may be required by the IRB to be excluded from the participants’ medical records,
in order to prevent inadvertent disclosure to insurance companies or employers. If genetic results will be included in the
medical record, participants must be informed of this in the consent document.
 Genetic studies which involve the long-term storage of specimens, genetic material, or data in tissue banks must follow the
Tissue Banking Guidelines to ensure confidentiality.
 Investigators may want to consider acquiring a Certificate of Confidentiality, if appropriate (see IRB guidance on
Certificates of Confidentiality).
 Results must be sufficiently anonymized to ensure privacy to participants (and family members) when the time comes for the
investigator to publish the results of the study.
Genetic Testing Privacy Act (cont.)
Disclosing Results to Participants:
 Information developed in the course of genetic studies may vary considerably with respect to its impact and value to subjects.
Investigators should not disclose genetic results to participants or their physicians if the results are not clinically relevant (i.e.,
the claimed association between marker or gene and disease is generally accepted by the medical genetics community).The
purpose of the study should be conveyed to the participants appropriately in the consent document and genetic results must not be
indicated as medically important if the value and reliability of the results has not been established.
 If the investigator intends to disclose results to participants, the method should be described in the protocol summary and consent
document.Written information in conjunction with other methods of disclosure is preferred by the IRB when disclosing results.
Keep in mind that when participants are informed about the results of their genetic testing, complete anonymity is virtually
impossible to accomplish, and additional protections for privacy and confidentiality may be needed.
See: http://www.research.utah.edu/irb/guidelines/pdf/Genetic_Research_A1509.pdf
 Investigators should consider the protections provided by law regarding the disclosure of genetic
information when writing the risks and confidentiality sections of the informed consent document.
 Board Members review the consent document to ensure the genetic guidelines are met.
Consent for Medical Treatment
• HIPAA
• Consent to Health Care
• Advanced Health Care Directive Act
• Emancipation
• Consent of Minors
HIPAA
To protect patient privacy,“covered entities” (all health plans, health care “clearinghouses,”
and health care providers) must obtain specific, written authorization from a patient to
use or disclose PHI. Patients must also be notified about their right to restrict the use and
disclosure of such information. Covered entities must make reasonable efforts to limit the
health information disclosed to the minimum necessary to accomplish the intended
purposes.
Options for Conducting HIPAA-Compliant Research:
 Obtain HIPAA authorization from individuals to use their protected health information
(PHI)
 Use a de-identified Data Set that contains no PHI
 Use a Limited Data Set with an effective Data Use Agreement in place as applicable
 Obtain an IRBWaiver of (HIPAA) Authorization
HIPAA (cont.)
PHI Identifiers:
1. Names
2. Geographic subdivisions smaller than a state if it contains less than 20,000 people (the initial three digits of the zip code are allowed). This includes street
address, city, county, precinct, and zip code (or equivalent geocodes). The initial three digits of a zip code may be included if, according to the currently publicly
available data from the Bureau of Census the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000
people, and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to “000”
3. Dates - All elements of dates (except year) for dates directly related to an individual (including birth date, admission date, discharge date, date of death), and
all ages over 89 (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
4. Telephone numbers
5. Fax numbers
6. E-mail addresses
7. Social security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate or license numbers
12. Vehicle identifiers, serial numbers, and license plate numbers
13. Device identifiers and serial numbers
14. Internet Universal Resource Locators (URLs)
15. Computer Internet Protocol (IP) addresses
16. Biometric identifiers
17. Full-face photographs and comparable images
18. Any other unique identifying number, characteristic, or code, except as permitted for re-identification of the de-identified data
HIPAA (cont.)
Language from IRB’s consent template:
AUTHORIZATION FOR USE OF YOUR PROTECTED HEALTH INFORMATION
Include the Authorization section as outlined:
Signing this document means you allow us, the researchers in this study, and others working with us to use information about your
health for this research study.You can choose whether or not you will participate in this research study. However, in order to
participate you have to sign this consent and authorization form.
This is the information we will use: Modify the following list as appropriate – delete or add items as necessary.
<<Name>>
<<Address>>
<<Telephone number>>
<<Family medical history>>
<<Allergies>>
<<Current and past medications or therapies>>
<<Information from a physical examination, such as blood pressure reading, heart rate, breathing rate, and temperature>>
<<All other tests and procedures that will be performed in the study>>
<<Any other personal health information that will be obtained from other sources to be used in the research record, including prior medical history,
tests or records from other sites>>
Others who will have access to your information for this research project are the University’s Institutional Review Board (the
committee that oversees research studying people) and authorized members of the << insert appropriate institution(s) e.g. University of
Utah Health Sciences Center, Primary Children’s Medical Center, Shriners Hospital >> who need the information to perform their duties (for
example: to provide treatment, to ensure integrity of the research, and for accounting or billing matters).
HIPAA (cont.)
Use one of the following 2 disclosure options, as applicable:
Disclosure Option 1: If you might disclose PHI to anyone outside the University, Primary Children’s Medical Center and/or Shriners use the following
language:
In conducting this study, we may share your information with groups outside the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center,
Primary Children’s Medical Center, Shriners Hospital >>. The information we share may include information that directly identifies you. These are the groups:
Modify this list as appropriate - delete or add items as necessary. For EACH LISTING, include a brief description of WHY they will receive the information.
The examples below are suggestions and may be used as applicable.

Other local hospital(s) that we are working with: <<list VA Salt Lake City Health Care System or any other local hospitals where information could be shared>> who are working
with the investigators in studying the impact of this treatment;

Other academic research centers we are working with: <<list all other academic centers including those at the University that may not be within UUHSC, and
explain their roles in project>> who are working with the investigators in studying the economic impact of this treatment;
<<Name of group or company>>, a research data coordinating office that is responsible for collecting results and findings from all the researchers;
<<Name of group or company>>, a pharmaceutical company that will use the results for submissions to the Food and Drug Administration;
<<Name of agency>>, a federal agency that needs to confirm the accuracy of the results submitted to the government.
<<Name of group or company>>, a contract research organization, whose job is to review and correct any mistakes before the results are given to the
sponsor or government;
<<name any other groups and why they will receive the results>>





Information disclosed to groups outside the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center, Primary Children’s Medical Center, Shriners
Hospital >> may no longer be covered by the federal privacy protections.
Disclosure Option 2: If you not going to disclose PHI to anyone outside the University of Utah Health Sciences Center, Primary Children’s Medical Center
and/or Shriners Hospital, describe how you will protect and share de-identified information. The next 2 paragraphs are sample statements. Include one of the
following or a similar statement, as applicable.
Example: If we share your information with anyone outside the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center, Primary Children’s Medical
Center, Shriners Hospital >> you will not be identified by name, social security number, address, telephone number, or any other information that would directly identify you,
unless required by law.
Example: In records and information disclosed outside of the << insert appropriate institution(s) e.g. University of Utah Health Sciences Center, Primary Children’s Medical
Center, Shriners Hospital >> your information will be assigned a unique code number. We will keep the key to the code <<state how code is kept e.g. “in a locked file”, “in a
password protected computer,” etc.>>. We will destroy the key to the code at the end of the research study.
HIPAA (cont.)
Include the following verbatim:
You may revoke this authorization. This must be done in writing. You must either give your
revocation in person to the Principal Investigator or the Principal Investigator’s staff, or mail it to
<<insert name and mailing address of PI>>. If you revoke this authorization, we will not be able to
collect new information about you, and you will be withdrawn from the research study. However,
we can continue to use information we have already started to use in our research, as needed to
maintain the integrity of the research.
Include the following paragraph if participants will not have access to their
information during the study:
You have a right to information used to make decisions about your health care. However, your
information from this study will not be available during the study; it will be available after the study
is finished.
Include one of the following 2 sentences:
This authorization does not have an expiration date.
This authorization lasts until this study is finished.
Consent to Health Care
Lists the persons who are authorized and empowered to consent for any health care not prohibited by law.


If Investigators must obtain consent from a legally authorized representative (including permission of a parent/guardian), the investigator must
establish that the consenting individual has the legal authority to do so.
Board Members review the consent document to ensure the LAR signature block is present.
Language from IRB’s consent template:
This signature block for Legally Authorized Representatives (LAR) is only used for populations unable to provide informed consent.
Only use the LAR signature block if it has been explained in the new study application (subject to approval by the IRB). Delete this if
you do not plan to enroll participants using an LAR.
If the participant is unable to give consent and authorization, consent and authorization is given by the authorized personal
representative of the individual:
LEGALLY AUTHORIZED REPRESENTATIVE CONSENT STATEMENT:
I confirm that I have read this consent and authorization document. I have had the opportunity to ask questions and those questions have been answered to my
satisfaction. I am willing and authorized to serve as a surrogate decision maker for
______________________________________
Participant’s Name
I have been informed of my role and my obligation to protect the rights and welfare of the participant. I understand that my obligation as a surrogate decision
maker is to try to determine what the participant would decide if the participant were able to make such decisions or, if the participant’s wishes cannot be
determined, what is in the participant’s best interests. I will be given a signed copy of the consent and authorization form to keep.
______________________________________
Name of Authorized Personal Representative
______________________________________
_____________
Signature of Authorized Personal Representative
Date
Indicate the legal representative’s authority to act for the individual:
□ Spouse
□ Adult (18 years of age or over) for his or her parent
□ Individual with power of attorney
□ Guardian appointed to make medical decisions for individuals who are incapacitated
Advance Health Care Directive Act
Utah recognizes special power of attorney documents and medical directives in which
individuals can provide advance directives of medical care in the event the individual is
not able to make his or her wishes known.Through power of attorney documents, an
individual can also name another individual who can consent on his or her behalf.
 If Investigators must obtain consent from a legally authorized representative,
the investigator must establish that the consenting individual has the legal
authority to do so.
 Board Members should verify that the LAR signature block is present in the
consent form.
Language from IRB’s consent template:
See LAR section in Consent Template (previous slides)
Emancipation
A person 16-years of age or older may petition the court to obtain the
legal status of emancipation. The common law doctrine of emancipation is
accepted unless it conflicts with the statutes or constitutions of the United
States or of Utah. The common law doctrine of emancipation is accepted
unless it conflicts with the statutes or constitutions of the United States or
of Utah.
 If an individual under the age of 18 is emancipated, he or she is not
considered a child as defined by federal regulations, in which case
Subpart D does not apply. Investigators should contact general
counsel for guidance regarding emancipated youth.
Consent of a Minor to Treatment for
Sexually Transmitted Disease
A minor, regardless of his or her age, is authorized under Utah law to
consent to medical care for diagnosis or treatment for a sexually
transmitted disease.This holds true even if the results of the test are
ultimately negative.
A person under the age of 18 is no longer considered a child as
defined by federal regulations and Subpart D does not apply if
he/she is seeking treatment for a sexually transmitted disease
(provided that the research is directly related to the condition).
Consent of Minor to Treatment for
Pregnancy and Childbirth
Any female, regardless of age, has authority to consent to health care when
given for treatment of her pregnancy or childbirth.This does not extend to
health care decisions regarding abortion.
A person under the age of 18 is no longer considered a child as defined by
federal regulations and Subpart D does not apply if he/she is seeking
treatment for a pregnancy or childbirth (provided that the research is
directly related to the condition).This does not extend to health care
decisions regarding abortion.