Contract analysis

I. Executive Summary This memorandum analyzes the requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as implemented through the regulations set forth at 45 C.F.R. Parts 160 and 164, as they apply to the collection, use, and disclosure of protected health information ("PHI") in connection with the CLARION clinical trial (Protocol PPC-4871-III). The analysis is undertaken at the

II. Regulatory Background and Applicability A. Overview of HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E) The HIPAA Privacy Rule, codified at 45 C.F.R. Part 164, Subpart E, establishes national standards for the protection of individually identifiable health information. The Privacy Rule was promulgated by the U.S. Department of Health and Human Services ("HHS") pursuant to the administrative simplification provi

III. HIPAA Authorization for Research Use and Disclosure of PHI A. When Authorization Is Required (45 C.F.R. § 164.508(b)–(c)) The general rule under the HIPAA Privacy Rule is that a covered entity may not use or disclose PHI for research purposes without a valid, written authorization from the individual whose PHI is at issue, unless an applicable exception (such as a waiver of authorization, preparatory-to-research

1. Description of the PHI to Be Used or Disclosed. The authorization must contain a specific and meaningful description of the categories of PHI that will be used or disclosed in connection with the trial. For the CLARION study, this description should encompass all protocol-specified data elements, including medical history, physical examination findings, laboratory results (including those generated by Northbridge

2. Names or Classes of Persons Authorized to Make the Use or Disclosure. The authorization must identify who is authorized to use or disclose the subject's PHI. In the CLARION trial, this includes the Veridian Network site at which the subject is enrolled and the principal investigator and study staff at that site. For example, at Site 001 (Graystone University Medical Center), the authorization would identify Grayst

3. Names or Classes of Persons Authorized to Receive the PHI. The authorization must identify who may receive the subject's PHI. For the CLARION trial, the recipients include: • Penterra Pharmaceuticals Corp. (Sponsor) • Meridian Contract Research Organization, Inc. (CRO) • The U.S. Food and Drug Administration and other regulatory authorities as required by law • Institutional Review Boards, including the Graystone

4. Description of Each Purpose of the Requested Use or Disclosure. The authorization must describe the purpose for which the PHI will be used or disclosed. For the CLARION trial, the stated purpose should be: "Clinical research under Protocol PPC-4871-III (the CLARION trial), a Phase III clinical study evaluating the investigational drug penterafenib (PPC-4871) for the treatment of advanced hepatocellular carcinoma,

5. Expiration Date or Expiration Event. The authorization must include an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The Privacy Rule permits the use of the statement "end of the research study" as the expiration event for a research authorization. 45 C.F.R. § 164.508(c)(1)(v). We recommend using the following formulation: "This authorization does no

6. Signature and Date. The authorization must be signed and dated by the individual (research subject) or the individual's personal representative. If signed by a personal representative, the authorization must describe such representative's authority to act for the individual. Required Statements (45 C.F.R. § 164.508(c)(2)). In addition to the core elements, the following statements must be included in the authoriza

1. Right to Revoke. The authorization must include a statement informing the individual of the right to revoke the authorization in writing, and must describe the exceptions to the right to revoke and how the individual may revoke authorization. The authorization should state: "You have the right to withdraw (revoke) this authorization at any time by providing written notice to the study investigator at [site name an

2. Consequences of Refusing to Sign. The authorization must include a statement regarding the ability or inability to condition treatment, payment, enrollment, or eligibility for benefits on the authorization. Under 45 C.F.R. § 164.508(b)(4)(i), a covered entity may condition the provision of research-related treatment on the individual's provision of authorization for the use or disclosure of PHI for such research.

3. Potential for Re-Disclosure. The authorization must include a statement that PHI disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and may no longer be protected by the HIPAA Privacy Rule. This is particularly important because several of the recipients identified in the authorization (including Penterra, Meridian CRO, Pinnacle, and Northbridge) may not themselves be HIPAA co

IV. Waiver or Alteration of Authorization for Research (45 C.F.R. § 164.512(i)) A. IRB/Privacy Board Waiver Criteria The HIPAA Privacy Rule provides that a covered entity may use or disclose PHI for research without individual authorization if an IRB or Privacy Board has approved a waiver or alteration of the authorization requirement. 45 C.F.R. § 164.512(i)(1)(i). This waiver mechanism is intended for situations in

1. Minimal Risk to Privacy. The use or disclosure of PHI involves no more than minimal risk to the privacy of individuals. This determination requires the IRB or Privacy Board to find that: (a) there is an adequate plan to protect the identifiers from improper use and disclosure; (b) there is an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there

2. Impracticability Without Waiver. The research could not practicably be conducted without the waiver or alteration of the authorization requirement. This criterion requires a showing that obtaining individual authorization from each subject whose PHI is needed would be so burdensome as to render the research impracticable — for example, because the research involves a large retrospective cohort, subjects cannot be

3. Necessity of PHI. The research could not practicably be conducted without access to and use of the PHI. This criterion requires a showing that de-identified data or other non-PHI sources would be insufficient for the research purposes. The IRB or Privacy Board must document its waiver approval in writing. The documentation must include: (i) identification and authority of the approving IRB or Privacy Board; (ii) f

V. Reviews Preparatory to Research (45 C.F.R. § 164.512(i)(1)(ii)) The HIPAA Privacy Rule provides a specific exception that permits covered entities to use or disclose PHI for reviews preparatory to research without obtaining individual authorization and without an IRB or Privacy Board waiver. Under 45 C.F.R. § 164.512(i)(1)(ii), a covered entity may use or disclose PHI for this purpose provided the following three

1. Purpose Limitation. The use or disclosure of PHI is sought solely for the purpose of preparing a research protocol or for similar purposes preparatory to research.

2. No Removal of PHI. No PHI is removed from the covered entity by the researcher during the review. The PHI must remain within the covered entity's systems and cannot be recorded, copied, or taken off-site.

3. Necessity. The PHI sought by the researcher is necessary for the preparatory research purposes. Additionally, the researcher must provide the covered entity with a representation, which may be oral or written, that the above conditions are satisfied. Application to the CLARION Trial. The preparatory-to-research exception is directly relevant to the CLARION trial's subject recruitment process. Site investigators —

VI. Limited Data Sets (45 C.F.R. § 164.514(e)) A. Definition and Permissible Uses A "limited data set" is a category of health information that has been stripped of certain direct identifiers but that may retain other potentially identifying information. Specifically, a limited data set excludes the following 16 categories of direct identifiers of the individual and of the individual's relatives, employers, and house

VII. De-Identification of PHI (45 C.F.R. § 164.514(a)–(c)) A. Two Methods of De-Identification Under the HIPAA Privacy Rule, health information that has been de-identified in accordance with 45 C.F.R. § 164.514 is no longer considered PHI and is therefore not subject to the Privacy Rule's restrictions on use and disclosure. De-identification may be achieved through one of two methods:

1. Expert Determination Method (§ 164.514(b)(1)). Under this method, a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recip

2. Safe Harbor Method (§ 164.514(b)(2)). Under this method, de-identification is achieved by removing 18 categories of identifiers: (i) names; (ii) geographic subdivisions smaller than a state (except for the initial three digits of a zip code if certain population thresholds are met); (iii) dates (except year) directly related to an individual, and all ages over 89 (aggregated to a single category of "90 or older");

1. The subject identification numbering system used in the Pinnacle EDC system is not derived from PHI. The screening numbers and randomization numbers should be system-generated sequential or random numbers that bear no relationship to the subject's name, date of birth, medical record number, or other identifier.

2. The master linking log is maintained exclusively at the site level and is not shared with Penterra, Meridian CRO, or any other entity outside the covered entity.

3. Neither Penterra nor Meridian CRO has the ability to re-identify subjects using the coded data and any other information in their possession. Recommendation. We recommend that the Pinnacle EDC system be configured to generate subject identification numbers that are purely sequential or algorithmically random and that are not derived from any PHI. Sites should be instructed to maintain master linking logs as confid

VIII. Data Sharing Architecture and Business Associate Agreements A. PHI Data Flow Mapping for the CLARION Trial Understanding the HIPAA compliance requirements for the CLARION trial requires a clear mapping of the data flows through which PHI moves among the various parties. Based on our review of Protocol PPC-4871-III, the draft MCTA, and the Meridian CRO Master Services Agreement, the following data flows have bee