Appendix IV HIPAA Compliance and IRB Approval for the NOPR

Transcription

1 Appendix IV HIPAA Compliance and IRB Approval for the NOPR HIPAA Compliance and Participation in the NOPR The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires that providers (Covered Entities as that term is defined under HIPAA) have in place an agreement with any Business Associate if the parties in their business dealings exchange Protected Health Information (PHI), as that term is defined in the HIPAA regulations. Under the regulations, submission of claims data by a PET facility (Covered Entity) to the American College of Radiology (ACR) (Business Associate) requires execution of a business associate agreement. This business associate agreement (BAA) serves the purpose of obtaining satisfactory assurance that the Business Associate will appropriately safeguard any PHI received from the Covered Entity. With this agreement in place, the exchange of information between the Covered Entity and the Business Associate will meet HIPAA requirements without disruption of the business arrangement. In order to facilitate the submission of your claims data to the NOPR, the ACR has developed a Business Associates Agreement (BAA) for your use. (The BAA is available at under Sample Forms.) This agreement fully complies with the requirements of HIPAA and is available on the NOPR Web site. Institutional Review Board (IRB) Approval for Registry The only entity engaged in research is the registry itself (i.e., NOPR) because the NOPR intends to use the data it is collecting for research purposes when both the patient and the referring physician have consented to the use of the information for this purpose. The ACR IRB has granted approval for the NOPR to engage in research using these data (see letter below from ACR IRB) Individual PET facilities and referring physicians and their staff are not engaged in research and therefore are not required to have IRB approval for their participation in the activities of the NOPR. Submission of the information for the registry (pre-pet and post-pet case report forms and the PET scan report) is required by CMS for payment for PET studies for all Medicare-insured patients with cancer indications included in the registry. Additionally, CMS is not conducting research. Any participating PET facility may nevertheless elect to have its local IRB review its participation in the NOPR. Some IRBs require, as a matter of institutional policy, that they review all research conducted in the institution, even if only to determine that the facility is not engaged in the research. Materials are provided below to assist in this process (See below, Submission Materials for Institutional IRB Review). The Office of Human Research Protections (OHRP) has reviewed the NOPR procedures for protection of human research subjects and finds them to be in compliance with the applicable DHHS regulations. Any individual IRBs with questions can contact OHRP. Informed Consent Requirements The data collected by the NOPR will be used for two different purposes: (1) payment determination by CMS; and (2) research use by NOPR. Accordingly, two different protocols will be followed concerning the informed consent requirements and the release of patient and physician identified data. Appendix IV: HIPAA Compliance & IRB Approval Page 1 Version: 8/23/06

2 Data Collected for CMS The data collected by the NOPR as required by CMS under the National Coverage Decision for PET for payment determination is not considered research data and will be sent, in its entirety, to CMS on a schedule determined by CMS. Data Collected for NOPR Research The data entered in the registry also will be used as the basis of research by the NOPR to make recommendations and/or observations concerning the impact of PET on patient management. The subjects of this research are the patients who are entered into the NOPR and the referring physicians who provide data on their intended patient management plan. The subjects providing this data can give or withhold consent to allow their data to be used for purposes of the research being conducted at NOPR. This is similar to obtaining subjects consent for involvement in research conducted through a survey or other similar activity conducted at any institution. Although NOPR must obtain consent before a patient s data may be used for research purposes, NOPR has qualified for a waiver of the requirement that such consent be in writing. Pursuant to Section (c)(2) of the Department of Health and Human Services (HHS) regulations on the protection of human subjects, an IRB may waive the requirement of written consent if the research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context. The ACR IRB has determined during their review that the registry s research activities are of minimal risk and a written documentation of consents have been waived for both the patient and the referring physician under Title 45 CFR (c)(2). Both the patient and the referring physician must be provided with the ACR IRB approved information sheets to inform the subjects that their data may be used in research and they must verbally either give or withhold consent to allow their data to be used for research. Patient Information Sheet The standard NOPR Information Sheet for patients is posted on the NOPR Web site, and participating PET facilities are required to give a copy of it to each Medicare patient prior to performing a PET scan that will be covered by the NOPR. The consent form incorporates the eight basic elements of informed consent, as provided by Section (a) of the Code of Federal Regulations. The patient s consent or refusal to have their data included in NOPR research will be included as a required data element in the database. Referring Physician Information Sheet The Information Sheet for referring physicians will be included in the post-pet Forms. The referring physician s consent or refusal to have their response data included in NOPR research will be a required data element in the database as documentation of the referring physician s response. Physicians who do not consent to have the data collected on this form (and the pre-pet Form) used in NOPR research are still required to submit all of the required data elements in order to have the PET study reimbursed by CMS; however, their data elements will be excluded from the research dataset used by NOPR investigators. Data for a particular PET scan will be used in research only if BOTH the patient and the referring physician consent to use of the data for this purpose. If patients or referring physicians have questions about the NOPR research, they can contact NOPR for information before agreeing to participate. If they have questions about the requirements for Medicare coverage and payment for PET scans they can refer to guidance posted on the CMS MLM Matters Website ( or they can contact CMS. Patients and physicians can change their decision to consent or not to consent to use of their data in the NOPR research by contacting their PET facility. The PET facility will inform NOPR headquarters and the database record will be changed to reflect the wishes of the patient and/or physician. Appendix IV: HIPAA Compliance & IRB Approval Page 2 Version: 8/23/06

3 Submission Materials for Institutional IRB Review (If Required) Abstract The National Oncologic PET Registry (NOPR) [ was developed in response to the Centers for Medicare and Medicaid Services (CMS) proposal to expand coverage for positron emission tomography with F-18 fluorodeoxyglucose (PET) to include cancers and indications not presently eligible for Medicare reimbursement. Medicare reimbursement for these cancers can now be obtained if the patient's referring physician and the provider submit data to a clinical registry to assess the impact of PET on cancer patient management ( coverage with evidence development ). Any PET facility that is approved to bill CMS for either technical or global charges can apply to participate in the NOPR. Medicare beneficiaries who are referred for PET for essentially all oncologic indications that are not currently reimbursable under Medicare are eligible to participate in the NOPR. The PET facility is responsible for collecting and entering patient data into the Registry database through a web application at The case is eligible for CMS reimbursement only if the Pre-PET Form is completed and returned to the PET facility prior to the PET scan and the Post-PET Form is completed and returned within 30 days of the PET scan. The NOPR database will notify the PET facility when all case data have been entered. The PET facility can then bill CMS for the study. NOPR data collection has been designed to be fully compliant with the requirements for protection of patient confidentiality required by HIPAA. The primary goal of this registry is to provide CMS with data needed to make payment determinations and is not considered research. All data entered in the registry database will be delivered to CMS as part of its payment determination process. The, secondary, or research, goal of the NOPR is to assess the effect of PET on referring physicians plans of intended patient management across the spectrum of the expanded cancer indications. The subjects of the NOPR research, patients and referring physicians, can consent (or not) to allow their data to be used for purposes of the research being conducted at NOPR, just as subjects can consent to being involved in research conducted through a survey or other similar activity at any institution. The dataset used by NOPR investigators will contain only the data of patients and physicians when both have consented to have the data included. Project Summary The National Oncologic PET Registry (NOPR) [ was developed in response to the Centers for Medicare and Medicaid Services (CMS) proposal to expand coverage for positron emission tomography with F-18 fluorodeoxyglucose (PET) to include cancers and indications not presently eligible for Medicare reimbursement. Medicare reimbursement for these cancers can now be obtained if the patient's referring physician and the provider submit data to a clinical registry to assist in CMS payment determinations. The NOPR is implementing this registry for CMS. The NOPR is sponsored by the Academy of Molecular Imaging (AMI) and managed by the American College of Radiology (ACR) through the American College of Radiology Imaging Network (ACRIN). The NOPR is endorsed by the ACR, the American Society for Clinical Oncology (ASCO), and the Society for Nuclear Medicine (SNM). Any PET facility that is approved to bill CMS for either technical or global charges can apply to participate in the NOPR. Medicare beneficiaries who are referred for PET for essentially all oncologic indications that are not currently reimbursable under Medicare are eligible to participate in the NOPR. The PET facility is responsible for collecting and entering patient data into the Registry database through a web application at Below is a brief summary of the data collection procedure. Appendix IV: HIPAA Compliance & IRB Approval Page 3 Version: 8/23/06

4 When a patient eligible for entry into the NOPR presents at the PET facility, the facility contacts the referring physician and obtains confirmation that the referring physician will submit the required preand post-pet Forms. The facility registers the patient on the NOPR via a Web form, at which time a Registry case number is assigned. The NOPR will send confirmation to the PET facility and a request for the pre-pet data to the PET facility for delivery to the referring physician. The referring physician must complete and return the Pre-PET Form to the PET facility for entry into the NOPR database by midnight of the day of the PET scan. At some time before the PET study, or when the patient arrives for the PET scan, the PET facility will provide the patient with the ACR IRB approved standard NOPR Patient Information Sheet that is posted on the NOPR Web site. The patient will be able to contact the NOPR directly for more information, if necessary. The patient will indicate his or her consent verbally to staff at the PET facility. Written consent is not required. The PET facility will note in the database if the patient gave or withheld consent for use of his or her data in future NOPR research. After the PET scan is performed, the PET facility sends the PET report to the referring physician, enters the study completion date into a Web form, and submits the report text electronically to the NOPR database. After the PET Report Form is entered, the database will send the PET facility a patient-specific Post- PET Form and a fax cover sheet for delivery of the Post-PET Form to the referring physician. This form will also include an ACR IRB approved Referring Physician Information Sheet for the physician. The physician will indicate on the Post-PET Form to whether consent for use of the response data in future NOPR research is given or withheld consent for use of the response data in future NOPR research. This form must be completed, returned to the PET facility, and entered into the NOPR database within 30 days of the PET scan. The patient's referring physician must agree to complete pre- and post-pet data collection forms consisting of approximately 5 questions regarding the patient's planned management. The Pre-PET Form must be completed by the referring physician and returned to the PET facility prior to the patient's PET scan. After the PET is performed a patient-specific Post-PET Form will be ed to the referring physician for completion within 30 days. The case is eligible for CMS reimbursement only if the Pre-PET Form is completed and returned to the PET facility prior to the PET scan and the Post-PET Form is completed and returned within 30 days of the PET scan. The NOPR database will notify the PET facility when all case data have been entered. The PET facility can then bill CMS for the study. All collected data will be submitted to CMS. The dataset compiled for use by NOPR investigators will only contain only the data for those PET scans where both the patient s and the referring physician s consent have been obtained. The primary goal of this registry is to provide CMS with data needed to make payment determinations and is not considered research. All data entered in the registry database will be delivered to CMS as part of their payment determination process. The, secondary, or research, goal of the NOPR is to assess the effect of PET on referring physicians plans of intended patient management across the spectrum of the expanded cancer indications. The subjects of the NOPR research, patients and referring physicians, can consent (or not) to allow their data to be used for purposes of the research being conducted at NOPR, just as subjects can consent to being involved in research conducted through a survey or other similar activity at any institution. The dataset used by NOPR investigators will contain only the data of patients and physicians who have consented to have their data included. It is anticipated that sufficient numbers of patients and physicians who have consented to have their data included in the research dataset should be accrued to accurately estimate the proportion of change in the intended treatment management after PET. These data will be classified and evaluated by cancer type and by clinical indication. Appendix IV: HIPAA Compliance & IRB Approval Page 4 Version: 8/23/06

5 To provide an early assessment of effect size, NOPR investigators will first look at the data for a particular combined category of cancer type and cancer indication after two-hundred (200) patients have been accrued to that category or after the Registry has been operational for one year. This information will be used to provide better estimates of the required sample size for the particular combined category in order to provide a sufficiently reliable estimate of frequency of change in intended management before submission of the research to CMS for a coverage decision review. Note that determining what constitutes a clinically important effect size (and its required confidence interval) sufficient to prompt a submission to CMS is highly dependent on the particular cancer and the particular indication. The magnitude of clinically important change will be primarily determined by the NOPR Working Group based on the information from the first 200 patients and the available literature for the specific disease category. Advice from outside experts will be obtained for any disease category in which a consensus can not be reached within the NOPR Working Group. NOPR data collection has been designed to be fully compliant with the requirements for protection of patient confidentiality required by HIPAA. Appendix IV: HIPAA Compliance & IRB Approval Page 5 Version: 8/23/06

6 Letter from CMS on Registry Participation for Reimbursement Under the National Coverage Determination Appendix IV: HIPAA Compliance & IRB Approval Page 6 Version: 8/23/06

7 Initial ACR IRB Approval Letter for the NOPR Appendix IV: HIPAA Compliance & IRB Approval Page 7 Version: 8/23/06

8 Appendix IV: HIPAA Compliance & IRB Approval Page 8 Version: 8/23/06