1 CTR. FOR DRUG EVALUATION & RESEARCH & CTR. FOR BIOLOGICAL EVALUATION & RESEARCH, U.S. DEP't OF HEALTH & HUMAN SERVS., GUIDANCE FOR INDUSTRY: POSTMARKETING STUDIES AND CLINICAL TRIALS — IMPLEMENTATION OF SECTION 505(O)(3) OF THE FEDERAL FOOD, DRUG, AND COSMETIC ACT (2011) [hereinafter FDA, April 2011 GUIDANCE], available at http://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/UCM172001.pdf.

2 Pub. L. No. 110-85, 121 Stat. 823 (to be codified as amended in scattered sections of 21 U.S.C.).

3 21 U.S.C.A. § 355(o)(3) (West 2012).

4 Pub. L. No. 75-717, 52 Stat. 1040 (1938) (codified as amended at 21 U.S.C. §§ 301-399d (2006)).

5 See LAWRENCE M. FRIEDMAN ET AL., FUNDAMENTALS OF CLINICAL TRIALS 2-5 (3d ed. 1998) (discussing clinical research, exemplified by a randomized, controlled clinical trial that monitors outcomes prospectively in two groups of people who either are or are not subjected to a particular treatment).

6 “Observational studies” is one of many terms for methodologies that draw inferences by observing data about individuals without actively intervening in the choices they make about their healthcare. See Protection of Human Subjects, 43 Fed. Reg. 56,174, 56,181-82 (Nov. 30, 1978)Google Scholar (using the term “research using … records” to refer to research that studies previously collected medical information); COMM. ON HEALTH RESEARCH & THE PRIVACY OF HEALTH INFO., INST. OF MED., BEYOND THE HIPAA PRIVACY RULE: ENHANCING PRIVACY, IMPROVING HEALTH THROUGH RESEARCH 7 (Sharyl J. Nass, Laura A. Levit & Lawrence O. Gostin eds., 2009) [hereinafter IOM, PRIVACY REPORT], available at http://www.nap.edu/catalog/12458.html (distinguishing “information-based” research from clinical research); BENGT D. FURBERG & CURT D. FURBERG, EVALUATING CLINICAL RESEARCH: ALL THAT GLITTERS IS NOT GOLD 29-37 (2d ed. 2007) (using the term “observational” to refer to methodologies that study data); Casarett, David et al., Bioethical Issues in Pharmacoepidemiologic Research, in PHARMACOEPIDEMIOLOGY 587, 588 (Strom, Brian L. ed., 4th ed. 2005)Google Scholar (using the term “epidemiologic research”); Brian L. Strom, Study Designs Available for Pharmacoepidemiology Studies, in PHARMACOEPIDEMIOLOGY, supra, at 17, 21-26 (discussing the array of scientific methodologies—including observational studies—for studying how people react to drugs); Agency for Healthcare Research & Quality, Outcomes Research Fact Sheet, U.S. DEP't OF HEALTH & HUMAN SERVS. (Mar. 2000), http://www.ahrq.gov/clinic/outfact.htm [hereinafter AHRQ, Fact Sheet] (using the term “outcomes research” to refer to observational studies that follow groups of patients over time to observe their health outcomes or analyze (prospectively or retrospectively) factors that may contribute to those outcomes).

7 FDA, April 2011 GUIDANCE, supra note 1, at 4.

8 See FURBERG & FURBERG, supra note 6, at 29 (listing major types of observational studies, ranging from case reports of how an individual patient responded to a particular treatment to larger cross-sectional studies, case-control studies, and cohort and registry studies that require data for larger groups of people).

9 See, e.g., U.S. PREVENTIVE SERVS. TASK FORCE, GUIDE TO CLINICAL PREVENTIVE SERVICES xlviii-l (2d ed. 1996) (comparing the quality of evidence produced by various types of study design and according the highest ranking to randomized, controlled clinical trials and according lower rankings to various types of observational studies); Evidence-Based Med. Working Grp., Evidence-Based Medicine: A New Approach to Teaching the Practice of Medicine, 268 JAMA 2420 (1992)CrossRefGoogle Scholar; Green, Sylvan B. & Byar, David P., Using Observational Data from Registries to Compare Treatments: The Fallacy of Omnimetrics, 3 STAT. MED. 361, 361 (1984).CrossRefGoogle ScholarPubMed

10 See FDA, April 2011 GUIDANCE, supra note 1, at 7-8 (describing various types of 505(o)(3) studies and including some that have this degree of simplicity).

11 See FURBERG & FURBERG, supra note 6, at 29 (stating, “Cohort studies follow a group of individuals forward in time (i.e., prospectively), and compare the risk of disease or disease complications among users and non-users of a drug”).

12 Id. (noting that “[r]egistry studies typically make use of electronic medical records of patients from large healthcare providers”).

13 See, e.g., Brenneman, Fred D. et al., Outcomes Research in Surgery, 23 WORLD J. SURGERY 1220, 1220 (1999)CrossRefGoogle ScholarPubMed (discussing sources of data used in observational studies of surgical outcomes); see also PANEL ON PERFORMANCE MEASURES & DATA FOR PUB. HEALTH PERFORMANCE P’SHIP GRANTS, NAT’L RESEARCH COUNCIL, HEALTH PERFORMANCE MEASUREMENT IN THE PUBLIC SECTOR 83-94 (Edward B. Perrin et al. eds., 1999), available at http://www.nap.edu/openbook.php?isbn=0309064368 (discussing administrative databases and their use in observational research); Weissberg, Jed, Use of Large System Databases, in THE LEARNING HEALTHCARE SYSTEM: WORKSHOP SUMMARY 46 (Olsen, LeighAnne et al. eds., 2007)Google Scholar, available at http://books.nap.edu/openbook.php?record_id=11903 (describing observational research that used a large HMO clinical database).

14 See FDA, April 2011 GUIDANCE, supra note 1, at 7 (envisioning the use of “administrative health care claims data, electronic medical records, registries,” and other sources in section 505(o)(3) observational studies).

15 Id.

16 See 45 C.F.R. § 164.512(i) (2010) (acknowledging, in the HIPAA Privacy Rule's waiver provision, that it may be impracticable to obtain individual permission to use data in certain circumstances and providing a mechanism for approving nonconsensual use of data); id. § 46.116(d) (similarly providing for nonconsensual access to data under the Common Rule when consent is impracticable); see also Evans, Barbara J., Much Ado About Data Ownership, 25 HARV. J.L. & TECH. 69, 95-96 (2011)Google Scholar (reviewing the literature and discussing the phenomenon of consent bias).

17 Casarett et al., supra note 6, at 597 (“The central ethical issue in pharmacoepidemiologic research is deciding what kinds of projects will generate generalizable knowledge that is widely available and highly valued, and do this in a manner that protects individuals’ right to privacy and confidentiality.”); see also 1 NAT’L BIOETHICS ADVISORY COMM’N, ETHICAL AND POLICY ISSUES IN RESEARCH INVOLVING HUMAN PARTICIPANTS 103-04 (2001), available at http://bioethics.georgetown.edu/nbac/human/overvol1.pdf (recognizing the need for nonconsensual data use in some circumstances and including, as a necessary criterion, that an IRB determine that “the benefits from the knowledge to be gained from the research study outweigh any dignitary harm associated with not seeking informed consent”); Jacobson, Peter D., Medical Records and HIPAA: Is It Too Late to Protect Privacy?, 86 MINN. L. REV. 1497, 1497-99 (2002)Google ScholarPubMed (arguing that the most important issue to resolve is which public health objectives are sufficiently important to override the individual's interest in nondisclosure).

18 Concato, John et al., Randomized, Controlled Trials, Observational Studies, and the Hierarchy of Research Designs, 342 NEW ENG. J. MED. 1887, 1888 (2000)CrossRefGoogle ScholarPubMed (citing U.S. PREVENTIVE SERVS. TASK FORCE, supra note 9) (ranking these methodologies just below controlled clinical trials that lack randomization).

19 Sacks, Henry et al., Randomized Versus Historical Controls for Clinical Trials, 72 AM. J. MED. 233, 233-34 (1982).CrossRefGoogle ScholarPubMed

20 Concato et al., supra note 18, at 1887.

21 Id.

22 Id. at 1887, 1890, 1892 (basing its conclusion on ninety-nine studies in five treatment areas).

23 Id. at 1887 (“Randomized, controlled trials … have become the gold standard for assessing the effectiveness of therapeutic agents.”).

24 See, e.g., Perlin, Jonathan B. & Kupersmith, Joel, Information Technology and the Inferential Gap, 26 HEALTH AFF. 192, 192 (2007)CrossRefGoogle ScholarPubMed (discussing limits to the generalizability of RCTs to real-world patient care); Pincus, T., Limitations of Randomized Controlled Clinical Trials to Depict Accurately Long-Term Outcomes in Rheumatoid Arthritis, 57 ZEITSCHRIFT FÜR RHEUMATOLOGIE 46, 46 (1998)CrossRefGoogle ScholarPubMed (criticizing the use of RCTs to evaluate long-term impacts); Sackett, David L. et al., Evidence Based Medicine: What It Is and What It Isn’t, 312 BRIT. MED. J. 71, 72 (1996)CrossRefGoogle ScholarPubMed (noting that some questions about therapy can be answered by other methods or may be too time-sensitive to await trial results).

25 Drug Amendments of 1962, Pub. L. No. 87-781, 76 Stat. 780.

26 See, e.g., Evans, Barbara J., Seven Pillars of a New Evidentiary Paradigm: The Food, Drug, and Cosmetic Act Enters the Genomic Era, 85 NOTRE DAME L. REV. 419, 476-525 (2010)Google Scholar (discussing various aspects of postmarketing evidence generation and regulation under Title IX of FDAAA); Parasidis, Efthimios, Patients Over Politics: Addressing Legislative Failure in the Regulation of Medical Products, 2011 WIS. L. REV. 929, 948-53.Google Scholar

27 Evans, supra note 26, at 477.

28 Evans, supra note 26, at 444-50.

29 Food and Drug Administration Amendments Act of 2007 § 901(a), 21 U.S.C.A. § 355(o)(3) (West 2012) (empowering the FDA to require postmarketing studies and clinical trials of drugs with known or suspected safety problems); see 21 U.S.C.A. § 352(z) (letting drugs be regarded as misbranded if the manufacturer fails to carry out required postmarket studies).

30 Food and Drug Administration Amendments Act of 2007 § 905, 21 U.S.C.A. § 355(k)(3)-(4).

31 21 U.S.C.A. § 355(k)(3).

32 Behrman, Rachel E. et al., Developing the Sentinel System—A National Resource for Evidence Development, 364 NEW ENG. J. MED. 498, 498 (2011)CrossRefGoogle ScholarPubMed; see also OFFICE OF CRITICAL PATH PROGRAMS, DEP't OF HEALTH & HUMAN SERVS., THE SENTINEL INITIATIVE (2008), available at http://www.fda.gov/downloads/Safety/FDAsSentinelInitiative/UCM124701.pdf (discussing the goals and structure of the Sentinel data network); FDA's Sentinel Initiative, FDA, http://www.fda.gov/Safety/FDAsSentinelInitiative/default.htm (last updated Aug. 16, 2012) (discussing recent progress in implementing the Sentinel System).

33 See Platt, Richard et al., The U.S. Food and Drug Administration's Mini-Sentinel Program: Status and Direction, 21 PHARMACOEPIDEMIOLOGY & DRUG SAFETY 1, 3 (2012)Google ScholarPubMed (discussing the distributed architecture of the Sentinel System's pilot project, Mini-Sentinel); see also Curtis, Lesley et al., Design Considerations, Architecture, and Use of the Mini-Sentinel Distributed Data System, 21 PHARMACOEPIDEMIOLOGY & DRUG SAFETY 23, 28 (2012)CrossRefGoogle ScholarPubMed (discussing the types of data included in the system); Robb, Melissa et al., The U.S. Food and Drug Administration's Sentinel Initiative: Expanding the Horizons of Medical Product Safety, 21 PHARMACOEPIDEMIOLOGY & DRUG SAFETY 9, 9-10CrossRefGoogle Scholar (discussing various applications of the system).

34 Curtis et al., supra note 33, at 28.

35 Platt et al., supra note 33, at 6.

36 See Food and Drug Administration Amendments Act of 2007 § 901(a), 21 U.S.C.A. § 355(o)(4) (letting FDA notify manufacturers of safety information it believes should be included in drug labeling and order the change after a period for response and discussions with the manufacturer).

37 Postmarket Drug Safety Information for Patients and Providers, FDA, http://www.fda.gov/Drugs/DrugSafety/PostmarketDrugSafetyInformationforPatientsandProviders/default.htm (last updated Mar. 8, 2012) (compiling various resources of current drug safety information).

38 Food and Drug Administration Amendments Act of 2007 § 915, 21 U.S.C.A. § 355(r).

39 Food and Drug Administration Amendments Act of 2007 § 901(a)-(b), 21 U.S.C.A. §§ 355(p), 355-1; see also Approved Risk Evaluation and Mitigation Strategies (REMS), FDA, http://www.fda.gov/Drugs/DrugSafety/PostmarketDrugSafetyInformationforPatientsandProviders/ucm111350.htm (last updated Sept. 12, 2012) (listing approved REMS plans).

40 Food and Drug Administration Amendments Act of 2007 § 901(b), 21 U.S.C.A. § 355-1(a)(1).

41 Food and Drug Administration Amendments Act of 2007 § 901(b), 21 U.S.C.A. § 355-1(a)(2)(A).

42 Food and Drug Administration Amendments Act of 2007 § 901(a), 21 U.S.C.A. § 355(p)(1)(B).

43 Food and Drug Administration Amendments Act of 2007 § 901(b), 21 U.S.C.A. § 355-1(d).

44 Food and Drug Administration Amendments Act of 2007 § 901(b), 21 U.S.C.A. § 355-1(e).

45 See Food and Drug Administration Amendments Act of 2007 § 901(b), 21 U.S.C.A. § 355-1(f)(3). This provision describes six elements of safe use: (1) the FDA can limit who can prescribe a drug, for example, limiting it to healthcare providers with special training or experience; (2) the FDA can require special certification of entities that dispense the drug; (3) the FDA can restrict a drug for use in particular healthcare settings, for example, requiring drugs that can have sudden, life-threatening reactions to be administered in hospitals where immediate emergency care would be available; (4) the FDA can require that patients have complied with safe-use conditions such as testing prior to administration of the drug; (5) the FDA can require specific monitoring of patients to detect adverse events quickly while they still can be mitigated; and (6) the FDA can require patients taking the drug to be enrolled in a registry so that their outcomes can be followed. Id.

46 Food and Drug Administration Amendments Act of 2007 § 901(b), 21 U.S.C.A. § 355-1(f) (describing this condition as existing when the known risk would block approval of a new drug or cause approval of an existing drug to be withdrawn).

47 See Protection of Human Subjects, 43 Fed. Reg. 56,174, 56,192 (Nov. 30, 1978) (reporting findings of a commission established under the National Research Act of 1974 to assess the need to afford regulatory protections for human subjects of federally funded biomedical and behavioral research); see also Protection of Human Subjects; Informed Consent, 44 Fed. Reg. 47,713, 47,713 (Aug. 14, 1979) (describing parallel efforts by the FDA to develop regulation for human subjects of clinical investigations carried out by drug manufacturers in connection with the FDA drug approval process).

48 See, e.g., QUAL-RX, INC., EVALUATION OF STATE PRIVACY LAW IN RELATION TO THE SENTINEL INITIATIVE (2010), available at http://www.regulations.gov/#!documentDetail;D=FDA-2009-N-0192-0015 (discussing state privacy laws affecting the FDA's Sentinel Initiative); KRISTEN ROSATI, AN ANALYSIS OF LEGAL ISSUES RELATED TO STRUCTURING FDA SENTINEL INITIATIVE ACTIVITIES 73-74 (2009), available at http://www.elsevierbi.com/~/media/Images/Publications/Archive/The%20Gray%20Sheet/35/020/01350200013/sentinel_legal_issues_03_31_09.pdf (discussing privacy and human-subject protection issues in connection with the FDA's Sentinel Initiative); KRISTEN ROSATI ET AL., HIPAA AND COMMON RULE COMPLIANCE IN THE MINI-SENTINEL PILOT 1, 7 (2010) [hereinafter ROSATI ET AL., HIPAA], available at http://mini-sentinel.org/work_products/About_Us/HIPAA_and_CommonRuleCompliance_in_the_Mini-SentinelPilot.pdf; Evans, Barbara J., Authority of the Food and Drug Administration to Require Data Access and Control Use Rights in the Sentinel Data Network, 65 FOOD & DRUG L.J. 67 (2010)Google ScholarPubMed; Evans, Barbara J., Congress’ New Infrastructural Model of Medical Privacy, 84 NOTRE DAME L. REV. 585 (2009)Google Scholar; McGraw, Deven et al., A Policy Framework for Public Health Uses of Electronic Health Data, 21 PHARMACOEPIDEMIOLOGY & DRUG SAFETY 18, 19 (2012)CrossRefGoogle ScholarPubMed (describing privacy and human-subject protections implemented by the FDA's Mini-Sentinel pilot project).

49 But see COMM. ON ETHICAL & SCIENTIFIC ISSUES IN STUDYING THE SAFETY OF APPROVED DRUGS, INST. OF MED., ETHICAL AND SCIENTIFIC ISSUES IN STUDYING THE SAFETY OF APPROVED DRUGS (2012) [hereinafter IOM, ETHICAL ISSUES], available at http://www.nap.edu/catalog.php?record_id=13219 (addressing postmarket drug safety studies in a recent report issued in August 2012).

50 Evans, supra note 26, at 489.

51 Id. at 485, 488-91.

52 See discussion infra Parts III.A, III.B, VI.

53 See discussion infra Parts III.A, III.B.

54 21 U.S.C.A. § 355(o)(3)(C) (West 2012).

55 Id. § 355(o)(3)(B).

56 Id.

57 Id. § 355(o)(1); see also FDA, April 2011 GUIDANCE, supra note 1, at 14-15.

58 21 U.S.C.A. § 355(o)(3); see also FDA, April 2011 GUIDANCE, supra note 1, at 4.

59 FDA, April 2011 GUIDANCE, supra note 1, at 4.

60 Id.

61 Id. at 1-2.

62 21 U.S.C.A. § 355(o)(3)(D)(i)-(ii).

63 Id.

64 Id.

65 Id.

66 Id. § 355(o)(3)(D)(i).

67 Id.

68 Id. § 355(k)(1).

69 See supra notes 30-35 and accompanying text.

70 21 U.S.C.A. § 355(o)(3)(D)(i).

71 Id. § 355(o)(3)(D)(ii).

72 Evans, supra note 26, at 490.

73 See 21 U.S.C.A. § 355(o)(3)(D)(i)-(ii) (calling for determinations about whether a given methodology is “sufficient” but not specifying factors to use in this determination and thus leaving the meaning of this term to the agency's discretion).

74 See id. § 355(o)(3)(B) (listing the allowed purposes).

75 See id. § 355(o)(3)(E)(ii) (requiring progress reports on studies and clinical trials, including reports on difficulties the sponsors have encountered in completing them).

76 Id.

77 Id.

78 Id.

79 NAT’L CANCER POLICY FORUM, INST. OF MED., DEVELOPING BIOMARKER-BASED TOOLS FOR CANCER SCREENING, DIAGNOSIS, AND TREATMENT 71 (2006), available at http://books.nap.edu/openbook.php?record_id=11768 (reporting presentation of Dr. Scott Ramsey); see also FRIEDMAN ET AL., supra note 5, at 8-10 (discussing logistical and ethical problems of recruiting subjects for trials of drugs that already are clinically available); Evans, supra note 26, at 454-55 (discussing ethical issues with RCTs of drug safety).

80 Weisman, Harlan et al., Broader Post-Marketing Surveillance for Insights on Risk and Effectiveness, in THE LEARNING HEALTHCARE SYSTEM: WORKSHOP SUMMARY 128, 132 (Olsen, LeighAnne et al. eds., 2007), available at http://books.nap.edu/openbook.php?record_id=11903.Google Scholar

81 See FDA, April 2011 GUIDANCE, supra note 1, at 7.

82 Id.

83 Id.

84 Id.

85 Id.

86 See 45 C.F.R. § 160.103 (2011) (defining covered entity as “a health plan,” “a health care clearing house,” or “a health care provider who transmits health information in electronic form” in connection with covered transactions, for example, in connection with billing for health care services); id. § 160.102(a) (stating that the HIPAA Privacy Rule applies to covered entities).

87 Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 18, 26, 29 and 42 U.S.C.).

88 45 C.F.R. pts. 160, 164.

89 See id. § 164.508 (describing the HIPAA Privacy Rule's authorization requirement).

90 See id. § 164.512 (listing various exceptions to the HIPAA Privacy Rule's authorization requirement).

91 Id. § 164.512(b)(1)(iii).

92 Id.

93 See supra Part VI.

94 See ROSATI ET AL., HIPAA, supra note 48, at 6; McGraw et al., supra note 48, at 19.

95 See discussion infra Part VI.

96 45 C.F.R. § 164.512(b)(1)(i); see also id. § 164.501 (defining public health authorities to include public agencies as well as entities acting under a contract with an agency).

97 Id. § 164.514(h)(2)(ii).

98 Id. § 164.512(i).

99 See Evans, supra note 16, at 107 (explaining that “waivers only permit data holders to disclose data but do not require them to do so”).

100 Id. at 107 n.247.

101 See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,695 (Dec. 28, 2000) (to be codified as amended at 45 C.F.R. pts. 160, 164) (rejecting, in the preamble to the HIPAA Privacy Rule, suggestions that HHS should require waivers to be approved by an IRB that has no connection to the institution that wishes to receive data for use in research).

102 See IOM, PRIVACY REPORT, supra note 6, at 66; see also Burman, William & Daum, Robert, Infectious Diseases Soc’y of Am., Grinding to a Halt: The Effects of the Increasing Regulatory Burden on Research and Quality Improvement Efforts, 49 CLINICAL INFECTIOUS DISEASES 328, 328 (2009)Google Scholar (arguing that “the application of the Health Insurance Portability and Accountability Act to research has overburdened institutional review boards (IRBs), confused prospective research participants, and slowed research and increased its cost”).

103 IOM, PRIVACY REPORT, supra note 6, at 66, 70-71.

104 Id. at 83.

105 Id.

106 45 C.F.R. § 164.512(i)(2)(ii) (2011) (listing criteria for approving a waiver).

107 Id. § 164.512(i)(2)(ii)(A).

108 See Federal Policy for the Protection of Human Subjects (“Common Rule”), U.S. DEP't OF HEALTH & HUMAN SERVS., http://www.hhs.gov/ohrp/humansubjects/commonrule/index.html (last visited Oct. 21, 2012).

109 45 C.F.R. §§ 46.101-46.124.

110 Id. § 46.101(a).

111 21 C.F.R. pts. 50, 56 (2011).

112 Id. § 50.1(a).

113 Id.

114 Id.; see also id. § 50.3(c) (defining clinical investigations).

115 Id. § 50.3(g).

116 Id.

117 See 45 C.F.R. § 46.102(f) (2011) (defining human subject for purposes of the Common Rule).

118 21 C.F.R. § 50.3(g).

119 See Evans, supra note 16, at 93-94; see also FDA, U.S. DEP't OF HEALTH & HUMAN SERVS., REPORT TO CONGRESS: THE SENTINEL INITIATIVE — A NATIONAL STRATEGY FOR MONITORING MEDICAL PRODUCT SAFETY 12 (2011), available at http://www.fda.gov/downloads/Safety/FDAsSentinelInitiative/UCM274548.pdf (noting, “As we have begun to grapple with the realities of conducting active medical product surveillance, however, we have come to understand that there may be infrequent occurrences when de-identified datasets may be insufficient to meet the needs of medical product surveillance”); Letter from Stanley H. Weiss, Chair, Joint Policy Comm. of the Soc’ys of Epidemiology, to Jerry Menikoff, Dir., Office for Human Subject Prots. 4-5 (Oct. 26, 2011), available at http://www.regulations.gov/#!documentDetail;D=HHS-OPHS-2011-0005-1066 (noting that in “[r]esearch on adverse drug events using computer-stored prescription data linked with hospital data … it is necessary to have information on identifiers in order to link the data that permits the research to be done”).

120 See FDA, SENTINEL NETWORK PUBLIC MEETING 51–59 (Mar. 7, 2007) [hereinafter FDA, MARCH 7 PROCEEDINGS] (statement of Dr. Marc Overhage), available at http://www.fda.gov/ohrms/dockets/dockets/07n0016/07n-0016-tr00001.pdf (discussing the importance of linking data longitudinally for use in observational studies of drug safety and noting that achieving longitudinal linkage requires at least some sharing of identifiable information); FDA, SENTINEL NETWORK PUBLIC MEETING 73–74 (Mar. 8, 2007) (statement of Dr. Clement McDonald), available at http://www.fda.gov/ohrms/dockets/dockets/07n0016/07n-0016-tr00002.pdf (discussing the importance of longitudinal population health data in drug safety research and noting the need to share identifiable information to link records from various data sources).

121 See generally FDA, MARCH 7 PROCEEDINGS, supra note 120.

122 See Letter from Stanley H. Weiss to Jerry Menikoff, supra note 119; see also FDA, MARCH 7 PROCEEDINGS, supra note 120.

123 IOM, PRIVACY REPORT, supra note 6, at 82.

124 See FED. TRADE COMM’N, PROTECTING CONSUMER PRIVACY IN AN ERA OF RAPID CHANGE: A PROPOSED FRAMEWORK FOR BUSINESSES AND POLICYMAKERS 35-38 (2010), available at www.ftc.gov/os/2010/12/101201privacyreport.pdf (discussing the potential for de-identified data to be re-identified); Ohm, Paul, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 UCLA L. REV. 1701, 1706 (2010)Google Scholar (expressing concern about the risk of re-identification); Rothstein, Mark A., Is Deidentification Sufficient to Protect Health Privacy in Research?, 10 AM. J. BIOETHICS 3, 5 (2010)CrossRefGoogle ScholarPubMed (“Despite using various measures to de-identify health records, it is possible to re-identify them in a surprisingly large number of cases … .”). But see McGraw, Deven, Data Identifiability and Privacy, 10 AM. J. BIOETHICS 30, 30 (2010)CrossRefGoogle ScholarPubMed (“Using information in less identifiable form greatly reduces risks to privacy … .”); Moros, Daniel A. & Rhodes, Rosamond, Privacy Overkill, 10 AM. J. BIOETHICS 12, 13 (2010)CrossRefGoogle ScholarPubMed (“There is no evidence to suggest, and no obvious reason to suppose … that the current protections of de-identified research information are inadequate.”).

125 Evans, supra note 16, at 83-84.

126 See IOM, PRIVACY REPORT, supra note 6, at 82 (reporting results of multiple surveys that found “[p]atients were much more comfortable with the use of anonymized data (e.g., where obvious identifiers have been removed) than fully identifiable data for research”).

127 See 45 C.F.R. § 164.512(i)(2)(ii)(A) (2011) (requiring IRBs, when approving a waiver, to determine that the use or disclosure “involves no more than a minimal risk to the privacy of individuals”).

128 See discussion supra pp. 595-96.

129 See 21 C.F.R. § 50.24 (2011) (allowing waiver of consent only in limited instances, such as in clinical studies to test products intended for use in emergency care, that are not relevant to the problem of obtaining access to data for use in observational studies).

130 FDA, April 2011 GUIDANCE, supra note 1, at 7.

131 See 45 C.F.R. § 46.101(f) (stating that “[t]his policy does not affect any state or local laws or regulations which may otherwise be applicable and which provide additional protections for human subjects”).

132 See id. § 160.203 (stating a general rule that HIPAA preempts contrary state laws in subsection (a), but including a saving clause for state privacy laws that are “more stringent” than the Privacy Rule in subsection (b)); see also id. § 160.202 (defining “more stringent” in a way that lets states restrict use and disclosure of data to a greater extent than the Privacy Rule does).

133 Standards for Privacy of Individually Identifiable Health Information, 64 Fed. Reg. 59,918, 60,010 (proposed Nov. 3, 1999) (to be codified at 45 C.F.R. pts. 160-164) (recognizing that the “states themselves have a patch quilt of laws that fail to provide a consistent or comprehensive policy, and there is considerable variation among the states in the scope of the protections provided”).

134 See generally JOY PRITTS ET AL., THE STATE OF HEALTH PRIVACY, A SURVEY OF STATE HEALTH PRIVACY STATUTES (2d ed. 2003), available at http://hpi.georgetown.edu/privacy/publications.html (summarizing in two volumes state privacy-related statutes in place as of 2003).

135 See generally QUAL-RX, INC., supra note 48 (summarizing the diversity of state privacy laws including common law tort causes of action).

136 Hill, John W. et al., A Proposed National Health Information Network Architecture and Complementary Federal Preemption of State Health Information Privacy Laws, 48 AM. BUS. L.J. 503, 514 (2011).CrossRefGoogle Scholar

137 See, e.g., id. at 555-95 (calling for broader preemption of state privacy laws and arguing that such action would withstand constitutional challenges); see also Health Insurance Reform: Standards of Electronic Transactions 65 Fed. Reg. 50,312, 50,318 (Aug. 17, 2000) (to be codified at 45 C.F.R. pts. 160, 162) (reporting, in the preamble to the HIPAA Transactions Rule, that “[m]any commenters stated that exceptions [to federal preemption of state standards] in general should not be granted, saying that this is contrary to the idea of national standards”).

138 42 U.S.C.A. §§ 17931-17940 (West 2012).

139 Evans, Barbara J., Institutional Competence to Balance Privacy and Competing Values: The Forgotten Third Prong of HIPAA Preemption Analysis, 46 U.C. DAVIS L. REV. (forthcoming 2013), available at http://ssrn.com/abstract=2141566.Google Scholar

140 Joy L. Pitts, Testimony Before the National Committee on Vital and Health Statistics, Subcommittee on Privacy & Confidentiality, Implementation of the Federal Standards for Privacy of Individually Identifiable Health Information, NAT’L COMMITTEE ON VITAL & HEALTH STAT. (Oct. 30, 2002), http://www.ncvhs.hhs.gov/021030p6.htm; see Ayres, Martha Tucker, Confidentiality and Disclosure of Health Information in Arkansas, 64 ARK. L. REV. 969, 1015 (2011)Google Scholar (stating that “HIPAA preempts any state law which is contrary to it, unless state law is more stringent in its individual privacy protections” (internal citations omitted)); see also Does the HIPAA Privacy Rule Preempt State Laws?, U.S. DEP't OF HEALTH & HUMAN SERVS., http://www.hhs.gov/ocr/privacy/hipaa/faq/preemption_of_state_law/399.html (last updated Dec. 11, 2006) (stating that “[t]he HIPAA Privacy Rule provides a Federal floor of privacy protections for individuals’ individually identifiable health information where that information is held by a [HIPAA-]covered entity or by a business associate of the covered entity”).

141 42 U.S.C.A. § 1320d-7.

142 See generally Evans, supra note 139 (discussing the preemptive impact of 42 U.S.C. § 1320d-7(b) and analyzing the interaction of the preemption provisions in the Privacy Rule and in the HIPAA statute).

143 Id. (manuscript at 25-33) (providing a textual analysis of 42 U.S.C. § 1320d-7(b) and discussing relevant legislative history); see id. (manuscript at 34-46) (demonstrating that the HIPAA Privacy Rule's weaker preemption provisions do not alter the stronger preemptive impact of the HIPAA statutory preemption provisions).

144 Id. (manuscript at 56-57).

145 See Robb et al., supra note 33, at 10 (noting that the FDA determined that a distributed data system model with voluntary participants would be the preferred approach for organizing an active medical product safety surveillance system such as Sentinel).

146 See supra note 98 and accompanying text.

147 See Evans, supra note 26, at 442, 453-55 (discussing practical and ethical problems with RCTs that test a safety hypothesis).

148 FRIEDMAN ET AL., supra note 5, at 18; FURBERG & FURBERG, supra note 6, at 21.

149 Evans, supra note 26, at 443.

150 See FRIEDMAN ET AL., supra note 5, at 180; FURBERG & FURBERG, supra note 6, at 69; Evans, supra note 20, at 443.

151 See IOM, ETHICAL ISSUES, supra note 49, at 47-49.

152 Evans, supra note 26, at 445, 452-53.

153 FURBERG & FURBERG, supra note 6, at 17; Melmon, Kenneth L., Attitudinal Factors That Influence the Utilization of Modern Evaluative Methods, in MODERN METHODS OF CLINICAL INVESTIGATION 135, 142 (Gelijns, Annetine C. ed., 1990), available at http://www.nap.edu/openbook.php?record_id=1550.Google Scholar

154 21 U.S.C.A. § 355(o)(3)(B)(iii) (West 2012).

155 Id.

156 See FRIEDMAN ET AL., supra note 5, at 18 (commenting that “rigorous, convincing demonstration of serious toxicity is usually not achieved because it is generally thought unethical to continue a study to the point at which a drug has been conclusively shown to be more harmful than beneficial”); FURBERG & FURBERG, supra note 6, at 21 (discussing ethical issues with RCTs to test drug safety). See also 45 C.F.R. § 46.111 (2011), and related FDA regulations at 21 C.F.R. § 56.111 (2011) (requiring minimal risk to subjects and a reasonable relationship between the risks and anticipated benefits of the research).

157 FRIEDMAN ET AL., supra note 5, at 45; see also FURBERG & FURBERG, supra note 6, at 21 (discussing the view that withholding a “proven beneficial” intervention may violate the research ethical standards of the Declaration of Helsinki).

158 Evans, supra note 26, at 442-43 (discussing the requirement for an acceptable balance of benefits and risks).

159 See Robb et al., supra note 33, at 9 (discussing these problems).

160 See COMM. ON THE ASSESSMENT OF THE U.S. DRUG SAFETY SYS., INST. OF MED., THE FUTURE OF DRUG SAFETY: PROMOTING AND PROTECTING THE HEALTH OF THE PUBLIC 54-55 (Alina Baciu et al. eds., 2007), available at http://books.nap.edu/openbook.php?record_id=11750 (discussing limitations of the FDA's AERS).

161 See id. at 122-25, 167-70 (calling for enhanced authorities to assess the risks and benefits of drugs during the postmarketing period).

162 See Robb et al., supra note 33, at 9-11 (discussing ways the Sentinel System will be able to help address the limitations of traditional adverse event reports).

163 Food Drug and Administration Amendments Act of 2007, Pub. L. No. 110-85, §§ 905(d), 908(a), 121 Stat. 823, 949, 950.

164 See Parasidis, supra note 26, at 994 (deriving this estimate partially from the FDA's statement that an active postmarketing framework may require resources similar to those required for the FDA's premarket review, see FDA, DEP't OF HEALTH & HUMAN SERVS., REPORT TO CONGRESS, CHANGING THE FUTURE OF DRUG SAFETY: FDA INITIATIVES TO STRENGTHEN AND TRANSFORM THE DRUG SAFETY SYSTEM, at i (2009), and estimated figures for the annual cost of premarket review, see Hutt, Peter Barton, The State of Science at the Food and Drug Administration, 60 ADMIN. L. REV. 431, 451-52 (2008)).Google Scholar

165 21 U.S.C.A. § 355(o)(4) (West 2012).

166 Id. § 355-1.

167 Id. § 355(k)(4).

168 FDA, April 2011 GUIDANCE, supra note 1.

169 21 U.S.C.A. § 355(k)(4)(A).

170 See supra notes 30-35 and accompanying text.

171 Curtis et al., supra note 33, at 28.

172 Id.

173 Platt et al., supra note 33, at 4.

174 See infra text accompanying notes 175-78 and pp. 600-02.

175 Platt et al., supra note 33, at 1.

176 21 U.S.C.A. § 355(k)(4)(A)(i) (West 2012).

177 Id. § 355(k)(4)(A)(iii).

178 Id. § 355(k)(4)(D)(i).

179 Id.

180 Id. § 355(k)(4)(D)(i)(II).

181 Id. § 355(k)(4)(D)(i)(II)(aa).

182 Id. § 355(k)(4)(D)(i)(II)(bb).

183 Id. § 355(k)(4)(D)(i)(III).

184 Id. § 355(k)(4)(D)(i)(IV).

185 See United States v. Mead Corp., 533 U.S. 218, 235 (2001) (declining to apply Chevron deference when an agency interprets its enabling statute in a setting less formal than notice-and-comment rulemaking and, in such a situation, applying Skidmore deference); see also Chevron, U.S.A., Inc. v. Natural Res. Def. Council, 467 U.S. 837, 842 (1984) (calling for courts, as the first step in cases where Chevron is applicable, to assess whether Congress has “directly spoken to the precise question at issue” and, if so, to be guided by the statute or, if not, to proceed to step two); id. at 843 (calling for courts, in step two, to inquire whether the “agency's answer is based on a permissible [i.e., not necessarily the best] construction of the statute” and, if so, to defer to it); Skidmore v. Swift & Co., 323 U.S. 134, 140 (1944) (according an agency's interpretation “respect proportional to its power to persuade” and considering the “thoroughness, logic, and expertness” of the agency's interpretation when deciding whether to defer to it).

186 See 21 U.S.C.A. § 355(o)(3)(D)(i) (allowing the FDA to order a section 505(o)(3) study only if the “Secretary makes a determination that the reports under subsection (k)(1) of this section [AERS] and the active postmarket risk identification and analysis system as available under subsection (k)(3) of this section will not be sufficient”).

187 Id. § 355(k)(3)(C)(i)(V).

188 See FDA, April 2011 GUIDANCE, supra note 1, at 7 (indicating that data sources for section 505(o)(3) observational studies could include registries).

189 See id. at 7-8.

190 45 C.F.R. § 164.514(h)(2)(ii) (2011).

191 Id. § 164.512(b)(1)(i).

192 Id. § 46.101(a).

193 See supra notes 108-19 and accompanying text.

194 21 U.S.C.A. § 355(k)(4)(B), (G) (West 2012).

195 Id. § 355(k)(4)(B).

196 Id. § 355(k)(4)(G)(i)(I).

197 Id.

198 Id. § 355(k)(4)(G)(i)(III).

199 Id. § 355(k)(4)(G)(ii)(I).

200 Id. § 355(k)(4)(G)(ii)(II).

201 Id. § 355(k)(4)(G)(iii).

202 See id. § 355(k)(4)(G) (listing certain required contractual privacy protections but not otherwise limiting the FDA's ability to contract for additional protections); see also McGraw et al., supra note 48, at 21-22 (stating FDA's policies are enforced through contractual agreements with the data partners).

203 See Robb et al., supra note 33, at 10 (noting that FDA determined that a distributed data system model with voluntary participants would be the “preferred approach for organizing an active medical product safety surveillance system” such as Sentinel).

204 See supra note 55 and accompanying text.

205 Platt et al., supra note 33, at 3; see also FDA, supra note 119, at 11-12.

206 McGraw et al., supra note 48, at 19.

207 Id.

208 See id. at 20-22 (summarizing these policies); see also Forrow, Susan et al., The Organizational Structure and Governing Principles of the Food and Drug Administration's Mini-Sentinel Pilot Program, 21 PHARMACOEPIDEMIOLOGY & DRUG SAFETY 12, 14 (2012)CrossRefGoogle ScholarPubMed; Platt et al., supra note 33, at 1.

209 See, e.g., BARBARA J. EVANS, APPROPRIATE HUMAN-SUBJECT PROTECTIONS FOR RESEARCH USE OF SENTINEL SYSTEM DATA 5-6 (2010), available at http://www.brookings.edu/~/media/Files/events/2010/0308_FDA_legal_issues/Panel%203%20Issue%20Brief.pdf (calling for a comprehensive governance framework to protect the interests of persons whose data are in the Sentinel System); Evans, Congress’ New Infrastructural Model of Medical Privacy, supra note 48, at 635-39 (arguing that the FDA's decisions to allow access to the Sentinel System are coercive in nature and calling for additional procedural protections for the people whose data are in the system); Evans, Authority of the Food and Drug Administration to Require Data Access and Control Use Rights in the Sentinel Data Network, supra note 48, at 106-09 (calling on the FDA to insert provisions in its collaborative agreements with data suppliers to limit their ability to use their HIPAA waiver authority to grant access to commercial data users).

210 See Letter from Rachel Behrman, Sentinel Initiative, Exec. Sponsor, to Richard Platt, Professor & Chair of Dep't of Ambulatory Care & Prevention, Harvard Med. Sch. & Harvard Pilgrim Health Care (July 19, 2010), reprinted in ROSATI ET AL., HIPAA, supra note 48, at 12-14 (emphasizing that all planned uses of the Mini-Sentinel System constitute public health activities by the FDA).

211 See supra notes 30-35 and accompanying text.

212 See DANIEL CALLAHAN, WHAT PRICE BETTER HEALTH? (2006) (challenging the notion that medical research is inherently good and should be pursued without regard to the burdens it places on competing values).

213 See Miller, Franklin G., Research on Medical Records Without Informed Consent, 36 J.L. MED. & ETHICS 560, 560 (2008)CrossRefGoogle ScholarPubMed (discussing, but not necessarily endorsing, the view that unconsented access to data may be unjustified, even if the research has high social value, if consent is logistically difficult or impossible to obtain, and if a consent requirement would reduce the scientific validity of results).

214 5 U.S.C.A. §§ 551-559, 701-706 (West 2012).

215 Id. § 553(a)(2) (excluding grants and contracts from notice-and-comment rulemaking procedures); see also Freeman, Jody, Extending Public Law Norms Through Privatization, 116 HARV. L. REV. 1285, 1305 (2003).CrossRefGoogle Scholar

216 See Minow, Martha, Public and Private Partnerships: Accounting for the New Religion, 116 HARV. L. REV. 1229, 1267-68 (2003).CrossRefGoogle Scholar