HIPAA for Drug and Device Companies

Transcription

1 The Practicalities and Legalities of Implementing Compliance Mechanisms for HIPAA for Drug and Device Companies Implementing Practical Tools, Tactics and Procedures for Meeting the Compliance Requirements of the Health Insurance Portability and Accountability Act's Privacy Ruling April 28-29, 2003, Sheraton Rittenhouse Square, Philadelphia Depending on the circumstances, drug and device companies can fall under the category of "Covered Entity", "Business Associate", or may not fall into either category. However, with many Covered Entities refusing to conduct business unless their partners are HIPAA compliant, drug and device companies have no alternative but to meet the Act's requirements for business relations to continue. The practical implementation of mechanisms that meet the HIPAA Privacy Ruling's compliance requirements is an enormous undertaking. HIPAA has far-reaching implications, impacting not only the clinical research but also the commercial operations of drug and device companies. The objective of this two-day symposium is to propose tools and strategies, along with their implementation pro c e d u res, to e n s u re drug and device companies achieve HIPAA compliance in the business functions impacted by the Act. Working in a highly interactive format with experienced symposium leaders in H I PAA as it pertains to drug and device companies, delegates a re expected to learn the practicalities of implementing compliance mechanisms. The following perspectives are a d d ressed: drug and device companies as Covered Entities, Business Associates, and their compliance obligations as neither a Covered Entity nor a Business Associate. The purpose is to help delegates ensure that their HIPAA privacy infrastructure in place. Networking Opportunities HIPAA has such an extensive and hard-hitting impact across the entire business operations of drugs and device companies. Therefore, take full advantage of this unique opportunity to meet with your industry colleagues to share and explore solutions to the same concerns and challenges you are all now facing with HIPAA. Networking benefits include luncheons and refreshment breaks, panel sessions and discussions. Register Today! Space is limited. Why not register today and take advantage of the special group discount - send four individuals from the same company and each receives 15% off. All four must register at the same time. Please use the registration form on the back of this brochure. Or, if you prefer, phone (888) US or (941) Int'l; or fax (941) We look forward to seeing you April 28-29, 2003 in Philadelphia! HERE'S WHAT DELEGATES AT OUR PREVIOUS HIPAA FOR DRUG AND DEVICE COMPANIES EVENTS HAD TO SAY: "One of the best conferences I have ever attended! Thank you!" Todd Butler, Clinical Project Manager HUMAN GENOME SCIENCES "Very comprehensive conference - well thought out, delivered in a manner that was easy to understand." Christine A. Ebner, Program Manager HUJ FOUNDATION "Excellent symposium - very informative." Stacey P. Koletty Rn, MBA, Clinical Research Nurse A.I. DUPONT HOSPITAL FOR CHILDREN "It was great!" Norma Cantu, Senior Director for CSO SCINEX "Well organized and managed." Jennifer J. Daniels, Associate BLANK ROME COMISKY & MCCAULEY "The speaker selection was outstanding. Good baseline of information and beginning for "what do I do?" Jean S. Cavallo, Senior Manager, AVENTIS PHARMACEUTICALS "Excellent review." Croom Lawrence, Marketing Manager, WYETH PHARMACEUTICALS "Presenters had a good handle on legal issues." R. Rajagopalan, PhD, Senior Manager, TAKEDA PHARMACEUTICALS "Good variety of topics presented." Ron Perry, Acq. Integration Manager, MEDTRONIC To register, Call or Int'l Fax register@iirusa.com Web:

2 HIPAA for Drug and Device Companies' Five Easy Ways to Register Please complete and return this entire form (or a copy) to Customer Service: Fax: (941) % Call: (888) or (941) Int l h Mail: Institute for International Research, NY P.O.Box 3685 Boston, MA j register@iirusa.com f Internet: Please register the following delegate(s) for HIPAA for Drug and Device Companies: REGISTRATION FORM Please register the following individuals at the group discount - Send 4 and receive 15% off each registration. Conference (P0991) I qualify for the Federal Employee rate I would like to order set(s) of documentation I can not attend, but please keep me informed of future events. 1. Name 2. Name 3. Name 4. Name Approving Manager Company Address Mail Stop City State Zip Telephone ( ) Fax ( ) Please include me in IIR's Preferred Customer program to receive conference announcements and updates via . Institute for International Research 708 Third Avenue, 4th Floor New York, NY METHODS OF PAYMENT Payment Enclosed Please charge my credit card: Visa MasterCard American Express Diners Club PRSRT STD U.S. Postage PAID IIR Card Number Signature Exp. Date EXHIBITION/SPONSORSHIPS: Please send me more information on how to: Exhibit Sponsorship ATTENTION MAILROOM: If undeliverable to addressee, please forward this important announcement to your Senior Counsel/Director of Clinical Research INCORRECT MAILING INFORMATION If you are receiving multiple mailings, have updated information or would like to be removed from our database, please contact Alma Rodriguez at Or fax this brochure to her attention at Please keep in mind that amendments can take up to six weeks. PLEASE DO NOT REMOVE MAILING LABEL P0891 Highly Interactive Format Be Ready for the Privacy Compliance Deadline of April 2003! The Practicalities and Legalities of Implementing Compliance Mechanisms for HIPAA for Drug and Device Companies Implementing Practical Tools, Tactics and Procedures for Meeting the Compliance Requirements of the Health Insurance Portability and Accountability Act's Privacy Ruling Institute for International Research April 28-29, 2003, Sheraton Rittenhouse Square, Philadelphia

3 Highly Interactive Format Be Ready for the Privacy Compliance Deadline of April 2003! The Practicalities and Legalities of Implementing Compliance Mechanisms for HIPAA for Drug and Device Companies Implementing Practical Tools, Tactics and Procedures for Meeting the Compliance Requirements of the Health Insurance Portability and Accountability Act's Privacy Ruling Symposium Leaders: Sujata T. Dayal, Counsel, Legal Regulatory, ABBOTT LABORATORIES Charles Jaffe, MD, PhD, Director of Medical Informatics, ASTRAZENECA Jennifer J. Daniels, Attorney, BLANK ROME COMISKY & MCCAULEY Carol A. Pratt, PhD, JD, Attorney, DAVIS WRIGHT TREMAINE Mary Marta, Associate, National Health Law Practice, EPSTEIN BECKER & GREEN Steven J. Snyder, Partner, GOULSTON & STORRS Natasha Leskosvek, Attorney, FDA/Life Sciences Group, HELLER EHRMAN WHITE AND MCAULIFFE Stephen A. Timoni, Partner, KIRKPATRICK & LOCKHART Joan Antokol, Privacy Officer, NOVARTIS Judith E. Beach, PhD, Associate General Counsel, Regulatory Affairs Chief Privacy Officer & Chair, Council on Data Protection, QUINTILES Jane R. Langdell, Associate, SMITH ANDERSON BLOUNT DORSETT MITCHELL & JERNIGAN CLE Credit Available See inside brochure for details SYMPOSIUM FOCUS: The objective of this symposium is to provide drug and device companies practical m e chanisms for meeting HIPAA compliance requirements in clinical research and in their commercial operations. The following pers p e c t ives are addressed: drug and device companies as Covered Entities, Business Associates, and their compliance obliga t i o n s as neither a Covered Entity nor a Business A s s o c i a t e. Addressed are the legalities and practicalities of implementing mechanisms for: The collection, use and management of research data in the context of international, national and state privacy laws under HIPA A Data collection, authorization and use for commercial operations under HIPA A Developing internal HIPAA privacy training programs Developing and drafting model forms for Patient Authorizations and Informed Consent Performing a PHI flow assessment to determine where compliance is needed and identifying business associates Identifying and recruiting research subjects under HIPAA Meeting the HIPAA training needs of your sales force and marketing teams Developing an internal Code of Conduct and compliance plan for sales and marke t i n g under HIPA A Using, drafting and negotiating Business Associate Agreements and Clinical Tr i a l A g r e e m e n t s Using and drafting Data Use Agreements and Limited Data Se t s Data analysis and secondary research under HIPA A Managing Protected Health Information (PHI) Facilitating work procedures with IRBs and Pr ivacy Boards under HIPA A The collection and deployment of genetic data and sample banks under HIPA A Implementing and maintaining a HIPAA compliance monitoring program Institute for International Research April 28-29, 2003, Sheraton Rittenhouse Square, Philadelphia The symposium format is designed to be fully interactive. Information presented is practical and solution-orientated. Supported by To register, Call or Int'l Fax register@iirusa.com Web:

4 DAY ONE: MONDAY APRIL 28, 2003 SYMPOSIUM FORMAT: The format is designed to be highly interactive. Sessions are broken down into five segments: I. A brief update on the legal interpretations, taking into account the latest release of any HHS Guidance Documents. (Suggested time allocation: 10 minutes) II. III. IV. Mechanisms (tools and strategies) for each practice area to ensure that they are HIPAA compliant are proposed and analyzed in terms of pros and cons. (Suggested time allocation: 20 minutes) Implementation guidance for the different mechanisms. (Suggested time allocation: 20 minutes) Break-out session: under the guidance of the session leader, delegates break into groups to discuss the mechanisms and their implementation as they relate to their own situations and report back to the group. (Suggested time allocation: 40 minutes) V. The session wraps up with trouble-shooting and a concluding summary of the key considerations. (Suggested time allocation: 10 minutes) 8:30 Databases, Sample Banks and EDC: Acquisition, Utilization and Management of Data This session addresses both practices and perspectives on HIPAA. Experts on guidances and their application provide insight into the requirements and obstacles for achieving compliance. Data aggregation and collection planning and strategy EDC and standard transaction requirements PHI (Protected Health Information) management and utilization Data de-identification methodologies Collection and deployment of genetic data and sample banks Data analysis and secondary/retrospective research: Application of HIPAA to secondary/retrospective research Avoidance of repeat patient authorization: requirements for SOP's, training and communication Real-world (practical) solutions to obligation compliance Charles Jaffe, MD, PhD, Director of Medical Informatics ASTRAZENECA PHARMACEUTICALS 10:15-10:30 Morning Refreshment Break 10:30 Limited Data Sets and Data Use Agreements Determination of whether Limited Data Sets will be useful to investigators What are the "minimum necessary" data needed for use in the Limited Data Set Interface with authorizations, waivers by IRBs or Privacy Boards Limited Data Set recipients' responsibilities Application of Data Use Agreements in clinical research Drafting considerations for Data Use Agreements Important elements in Data Use Agreements Developing internal positions on Limited Data Sets and Data Use Agreements Mary Marta, Associate, National Health Law Practice, EPSTEIN BECKER & GREEN 12:15-1:30 Lunch 1:30 Drafting Patient Authorization and Informed Consent Forms and Conducting Patient Recruitment Under HIPAA Patient Authorizations and Informed Consent Developing and drafting model Patient Authorization forms: What are a Clinical Trial Monitor's responsibilities regarding patient authorizations, and does this change if kept separate or combined with informed consent? Meeting the plain language requirements Combine or keep authorization and informed consent separate? What are IRBs' responsibility if authorization is a separate document? Developing internal positions on patient authorizations Patient Recruitment Identifying research subjects Contacting and recruiting subjects Obtaining patient authorization Developing internal positions on patient recruitment under HIPAA Training subject recruitment personnel for HIPAA compliance Natasha Leskosvek, Attorney, FDA/Life Sciences Group, HELLER EHRMAN WHITE AND MCAULIFFE Judith E. Beach, PhD, Associate General Counsel, Regulatory Affairs Chief Privacy Officer & Chair, Council on Data Protection QUINTILES 3:15-3:30 Afternoon Refreshment Break 3:30 Implementing Mechanisms for Working With IRBs, Privacy Boards and Waivers of Consent Under HIPA A What drug and device companies need to do to address the changes in the Privacy Board/IRBs' role and processes The criteria, factors and assessment procedures for waivers of consent Likely mechanisms that IRBs/Privacy Boards will adopt to facilitate the evaluation and granting of waivers What drug and device companies need to do to speed the evaluation and granting of waivers Developing internal positions on working with IRBs/Privacy Boards under HIPAA Carol A. Pratt, PhD, JD, Attorney DAVIS WRIGHT TREMAINE 5:15 End of Day One To register call ; Fax ; register@iirusa.com; Visit our website at Institute for International Research (IIR) BV 2003

5 DAY TWO: TUESDAY APRIL 29, :30 Drafting and Using Business Associate Agreements and Clinical Trial Agreements When to use Business Associate Agreements and Clinical Trial Agreements Developing internal positions on Business Associate Agreements and Clinical Trial Agreements under HIPAA Tactics for negotiating agreements Drafting and implementing Business Associate Agreements 'Accounting of Disclosures' procedures: mechanisms research sponsors can adopt to ease the administrative burden of covered entities Sujata T. Dayal, Counsel, Legal Regulatory ABBOTT LABORATORIES Steven J. Snyder, Partner GOULSTON & STORRS 10:15-10:30 Morning Refreshment Break 10:30 Conducting International Clinical Trials Under HIPAA: Meeting the Requirements of Global Data Privacy and Protection International research data collection and use. Meeting the requirements of: HIPAA The European Directive The U.S. Safe Harbor for transfers of personal information from the EU to the US Select privacy laws in Central and Eastern Europe, Asia Pacific, Latin America, and the U.S. states The practicalities of international data transfer strategies Developing internal positions on the global collection and use of data Jennifer J. Daniels, Attorney, BLANK ROME COMISKY & MCCAULEY 1:30 Implementing Mechanisms for Ensuring Commercial Operations are HIPAA Compliant Data collection, authorization and use for sales and marketing under HIPAA Meeting the HIPAA training needs of your sales force and marketing teams Developing an internal Code of Conduct and compliance plan for sales and marketing under HIPAA Joan Antokol, Privacy Officer NOVARTIS Stephen A. Timoni, Partner KIRKPATRICK & LOCKHART 3:15-3:30 Afternoon Refreshment Break 3:30 Implementing and Maintaining an Internal HIPAA Compliance Monitoring Program Performing a PHI flow assessment: determining where compliance is needed and identifying business associates Selecting a privacy officer Developing and distributing a notice of privacy practices Developing internal HIPAA privacy training programs Compliance with patient access and other rights Implementing and maintaining a HIPAA compliance monitoring program Jane R. Langdell, Associate SMITH ANDERSON BLOUNT DORSETT MITCHELL & JERNIGAN 5:15 Close of Symposium 12:15-1:30 Lunch Privacy and Ethics C o r p o r a t e / P rocedural Compliance Corporate/General/Legal Counsel Information Protection Quality Assurance/Quality Management/Quality Contro l / G C P WHO SHOULD ATTEND Pharmaceutical, biotech and medical device companies, contract research organizations (CROs), clinical investigators, academic medical centers, research institutes and universities, Institutional Review Boards (IRBs) and patient recruitment companies, and any organization involved with patient data handling/management for clinical research, sales and marketing practices for drug and device companies. Primarily senior professionals in the following areas would find this symposium to be of most value: Regulatory Aff a i r s / O p e r a t i o n s Drug/Medical Safety Clinical Operations/Clinical Researc h Patient Recruitment Sales and Marketing It is anticipated that the audience will already have a moderate level of understanding of the legalities of the HIPAA Privacy Ruling. To register call ; Fax ; register@iirusa.com; Visit our website at Institute for International Research (IIR) BV 2003

6 SYMPOSIUM OBJECTIVES: This highly interactive two-day symposium is designed to provide you with the legal knowledge and practical mechanisms you need to fully comply with the HIPAA Privacy Ruling as it relates to drug and device companies in clinical research and commercial operations. Specific objectives include addressing the legalities and practicalities of implementing mechanisms for: The collection, use and management of re s e a rch data in the context of i n t e rnational, national and state privacy laws under HIPA A Data collection, authorization and use for commercial operations under H I PA A Developing internal HIPAA privacy training pro g r a m s Developing and drafting model forms for Patient Authorizations and Informed Consent Performing a PHI flow assessment to determine where compliance is needed and identifying business associates Identifying and recruiting re s e a rch subjects under HIPAA Meeting the HIPAA training needs of your sales force and marketing teams Developing an internal Code of Conduct and compliance plan for sales and marketing under HIPA A Using, drafting and negotiating Business Associate Agreements and Clinical Trial Agre e m e n t s Using and drafting Data Use Agreements and Limited Data Sets Data analysis and secondary re s e a rch under HIPA A Managing Protected Health Information (PHI) Facilitating work pro c e d u res with IRBs and Privacy Boards under HIPA A The collection and deployment of genetic data and sample banks under H I PA A Implementing and maintaining a HIPAA compliance monitoring pro g r a m CLE Credits Available: IIR has be certified by the New York State Continuing Legal Education Board as an Accredited Provider of continuing legal education in the State of New York for the period of January 1, 2003 through January 1, CLE credits are available for most other states and may vary depending on your state's rules and regulations. ADMINISTRATIVE DETAILS 5 Easy Ways to Register REGISTRATIONS: Please complete and return the registration form to Customer Service Manager: % h nj FAX: (941) CALL: Toll Free (888) or (941) Int'l MAIL: IIR NY, P.O. Box 3685, Boston, MA register@iirusa.com WEB: f Your Full Registration for Attending 'HIPAA for Drug and Device Companies' Includes: Full symposium presentations and panel sessions Luncheons and networking refreshment breaks Documentation including speaker presentations and handouts Your investment for attending is as follows. The Federal Employee rate is $595. Pre-Symposium Registration Before March $1795 Pre-Symposium Registration After March $1895 On-site Registration $1995 GROUP DISCOUNTS AVAILABLE - SEND YOUR WHOLE TEAM! Send 4 individuals from the same company and receive 15% off each registration. All individuals must register at the same time. Payments must be received by April 14, You may pay by check, Visa, MasterCard, Diner's Club or American Express. Please make checks payable to "Institute for International Research" and write the name of the delegate(s) and our re f e re n c e #P0991 on the face of the check. If payment has not been received by April 28, 2003, a cre d i t c a rd hold will be re q u i red and will be processed 2 weeks following the confere n c e. DATES: April 28-29, 2003 VENUE: Sheraton Rittenhouse Square 18th at Locust Street Philadelphia, Pennsylvania Phone (215) Book Early! Hotel Will Sell Out *This number is for general hotel information only. Hotel will not accept individual call-ins for hotel room reservations at IIR's negotiated group rate. HOTEL DISCOUNTS: All hotel bookings should be made through The Global Executive's Internet booking site. Please visit to make your reservation. If you do not have web access, or need additional assistance, please call The Global Executive at or or send them an at conf@globalexec.com. The hotel will not accept individual calls for room reservations at the IIR negotiated rate. CANCELLATIONS: Should you be unable to attend for any reason, please inform us IN WRITING prior to April 14, 2003 and a credit voucher for the full amount will be issued. If you prefer, a full refund, less a $195 non-refundable deposit will be issued. No refunds or credits will be given for cancellations received on or after April 14, Substitutions of enrolled delegates may be made at any time. Please indicate upon registration whether you are eligible for a discount. No two discounts can be combined. If for any reason, IIR decides to cancel this conference, we are not responsible for covering airfare, hotel or other costs incurred by conference registrants. Program content is subject to change without notice. All speakers and topics listed are confirmed as of press time. When substitutions must be made due to speaker cancellations, IIR makes every effort to find a replacement of equal caliber to present the scheduled topic. Press permission must be obtained prior to the event and is dependent upon speakers' approval. The press may not quote speakers or delegates unless they have obtained their approval in writing. Any disabled individual desiring an auxiliary aid for this conference should notify IIR at least 3 weeks prior to the conference in writing or by faxing to (212) DOCUMENTATION ORDER The Documentation is a compilation of the speaker handouts including overheads, power point presentations, articles and charts. If you are unable to attend the program, or would simply like to order additional sets of documentation for your colleagues, they are available for $395 per set, including postage and shipping in the U.S., plus any applicable sales tax. Please fill out the order form on the back of the brochure. The documentation is available for shipment two weeks after the conference takes place. CREDIT CARD PAYMENTS ONLY. To register call ; Fax ; register@iirusa.com; Visit our website at Institute for International Research (IIR) BV 2003