LEGISLATURE OF THE STATE OF TEXAS: SECTION 1. TITLE 2, HEALTH AND SAFETY CODE - AMENDED BY ADDING SUBTITLE I TO READ AS FOLLOWS: SUBTITLE 1. MEDICAL RECORDS CHAPTER 181. MEDICAL RECORDS PRIVACY. SUBCHAPTER A GENERAL PROVISIONS.
Sec. 181.102. INFORMATION FOR RESEARCH.
(a) A covered entity may disclose protected health information to a person performing health research, regardless of the source of funding of the research, for the purpose of conducting health research, only if the person performing health research has obtained:
(1) individual consent or authorization for use or disclosure of protected health
information for research required by federal law;
(2) the express written authorization of the individual required by this chapter;
(3) documentation that a waiver of individual consent or authorization required for use
or disclosure of protected health information has been granted by an institutional review board or privacy board as required under federal law; or
(4) documentation that a waiver of the individual's express written authorization
required by this chapter has been granted by a privacy board established under this section.
(b) A privacy board:
(1) must consist of members with varying backgrounds and appropriate professional
competency as necessary to review the effect of the research protocol for the project or projects on the privacy rights and related interests of the individuals whose protected health information would be used or disclosed;
(2) must include at least one member who is not affiliated with the covered entity or an entity conducting or sponsoring the research and not related to any person who is affiliated with an entity described by this subsection; and
(3) may not have any member participating in the review of any project in which the member has a conflict of interest.
(c) A privacy board may grant a waiver of the express written authorization for the use of protected health information if the privacy board obtains the following documentation:
(1) a statement identifying the privacy board and the date on which the waiver of the
express written authorization was approved by the privacy board;
(2) a statement that the privacy board has determined that the waiver satisfies the
following criteria:
(A) the use or disclosure of protected health information involves no more than
minimal risk to the affected individuals;
(B) the waiver will not adversely affect the privacy rights and welfare of those
individuals;
(C) the research could not practicably be conducted without the waiver;
(D) the research could not practicably be conducted without access to and use of
the protected health information;
(E) the privacy risks to individuals whose protected health information is to be
used or disclosed are reasonable in relation to the anticipated benefits, if any, to the individuals and the importance of the knowledge that may reasonably be expected to result from the research;
(F) there is an adequate plan to protect the identifiers from improper use and
disclosure;
(G) there is an adequate plan to destroy the identifiers at the earliest opportunity
consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or the retention is otherwise required by law; and
(H) there are adequate written assurances that the protected health information
will not be reused or disclosed to another person or entity, except:
(i) as required by law;
(ii) for authorized oversight of the research project; or
(iii) for other research for which the use or disclosure of protected health information would be permitted by state or federal law;
(3) a brief description of the protected health information for which use or access has been determined to be necessary by the privacy board under Subdivision (2)(D); and
(4) a statement that the waiver of express written authorization has been approved by the privacy board following the procedures under Subsection (e).
(d) A waiver must be signed by the presiding officer of the privacy board or the presiding officer's designee.
(e) The privacy board must review the proposed research at a convened meeting at which a majority of the privacy board members are present, including at least one member who satisfies the requirements of Subsection (b)(2). The waiver of express written authorization must be approved by the majority of the privacy board members present at the meeting, unless the privacy board elects to use an expedited review procedure. The privacy board may use an
expedited review procedure only if the research involves no more than minimal risk to the privacy of the individual who is the subject of the protected health information of which use or
disclosure is being sought. If the privacy board elects to use an expedited review procedure, the review and approval of the waiver of express written authorization may be made by the presiding
officer of the privacy board or by one or more members of the privacy board as designated by the presiding officer.
(f) A covered entity may disclose protected health information to a person performing health research if the covered entity obtains from the person performing the health research
representations that:
(1) use or disclosure is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research;
(2) no protected health information is to be removed from the covered entity by the person performing the health research in the course of the review; and
(3) the protected health information for which use or access is sought is necessary for the research purposes.
(g) A person who is the subject of protected health information collected or created in the course of a clinical research trial may access the information at the conclusion of the research trial.