Author: admin

Cardiac arrest can strike without warning. Do you suspect someone is experiencing cardiac arrest? The signs are:

• Sudden loss of responsiveness – The person doesn’t respond, even if you tap them hard on the shoulders or ask loudly if they’re OK. The person doesn’t move, speak, blink or otherwise react.
• No normal breathing – The person isn’t breathing or is only gasping for air.

What to do

If you think the person may be suffering cardiac arrest and you’re a trained lay rescuer:

• Ensure scene safety.
• Check for responsiveness.
• Shout for help. Tell someone nearby to call 911 or your emergency response number. Ask that person or another lay responder to bring you an AED (automated external defibrillator) if there’s one on hand. Tell them to hurry. Time is critical. If you’re alone with an adult who has signs of cardiac arrest, call 911 and get an AED (if one is available).
• Check for no breathing or only gasping. If the person isn’t breathing or is only gasping, begin CPR with compressions.
• Administer CPR. Push down at least two inches in the center of the chest at a rate of 100 to 120 pushes a minute. Allow the chest to return to its normal position after each push.
• Use an AED. As soon as it arrives, turn it on and follow the prompts.
• Continue CPR. Administer it until the person starts to breathe or move, or until someone with more advanced training, such as an EMS team member, takes over.

What treatment will I receive in the hospital?

Tests will be done to assess your condition. The test results can help the health care team decide on a treatment plan to reduce your risk of long-term health problems and death.

Your health care team will closely monitor your heart. They will also focus on preventing organ damage, especially to your brain.

You may receive one or more of the following treatments:

• Targeted temperature management (TTM) is a treatment to lower the body temperature to help protect the brain. Cooling blankets, cooling helmets, ice packs or other cooling methods may be used.
• Oxygen therapy helps you get enough oxygen so your organs continue to work as you are recovering.
• Extracorporeal membrane oxygenation (ECMO) treatment pumps your blood through an artificial lung. It adds oxygen and removes carbon dioxide from your blood before returning it to your body. The ECMO takes the stress off your lungs and heart to promote healing.

What other tests and treatments may I receive?

Your health care team will try to find out what caused your cardiac arrest. Some tests you may have include:

If you are diagnosed with coronary heart disease, treatment may include:

These treatments help restore blood flow through narrowed or blocked coronary arteries.

Genetic testing may be recommended for you and your blood relatives. This testing is done because some conditions that can increase the risk of cardiac arrest run in families.

It’s important to find out what caused your cardiac arrest. It’s also important for your family members to find out if they may be at risk of cardiac arrest due to an inherited condition or a gene that puts them at greater risk for one.

Am I at risk of another cardiac arrest?

If you’ve had one cardiac arrest, you may be at risk of another.

Your health care team may advise that you get an implantable cardioverter defibrillator (ICD). This may happen during your hospital stay or shortly after. Or you may be asked to wear an external cardiac defibrillator. Either can save your life by providing a low-energy shock to your heart to restore a normal heart rhythm if ventricular fibrillation or tachycardia occurs.

People with an ICD have some restrictions, though many can resume their normal activities.

How do I live with an ICD?

ICD batteries usually last four to seven years. Your health care professional should check them every three to six months.

Talk to your health care team about your activities. Ask them what you can and can’t do. Also ask which types of machines or equipment you should avoid. Those with magnets and strong electrical fields may interfere with your ICD’s operation.

You should also:

• Tell airport security guards that you have an ICD. Ask them not to use handheld metal detectors on you.
• Tell your other health care professionals, including your dentist, that you have an ICD.
• Tell the doctors and nurses that you have one anytime you go to the hospital.
• Always carry a card with the details about your ICD and emergency contact information so others know that you have one in case of a medical emergency.

What if I’m anxious about living with my ICD?

It’s common for people to feel anxious or depressed, especially in the first months or year after they get their ICD. You need to know that you are not alone or without support. If you have these feelings, talk with your health care team and get help.

45 CFR 164.501, 164.508, 164.512(i) (See also 45 CFR 164.514(e), 164.528, 164.532)  (Download a copy in PDF)

Background

The HIPAA Privacy Rule establishes the conditions under which protected health information may be used or disclosed by covered entities for research purposes. Research is defined in the Privacy Rule as, “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.” See 45 CFR 164.501.  A covered entity may always use or disclose for research purposes health information which has been de-identified (in accordance with 45 CFR 164.502(d), and 164.514(a)-(c) of the Rule) without regard to the provisions below.

The Privacy Rule also defines the means by which individuals will be informed of uses and disclosures of their medical information for research purposes, and their rights to access information about them held by covered entities. Where research is concerned, the Privacy Rule protects the privacy of individually identifiable health information, while at the same time ensuring that researchers continue to have access to medical information necessary to conduct vital research. Currently, most research involving human subjects operates under the Common Rule (45 CFR Part 46, Subpart A) and/or the Food and Drug Administration’s (FDA) human subject protection regulations (21 CFR Parts 50 and 56), which have some provisions that are similar to, but separate from, the Privacy Rule’s provisions for research. These human subject protection regulations, which apply to most Federally-funded and to some privately funded research, include protections to help ensure the privacy of subjects and the confidentiality of information. The Privacy Rule builds upon these existing Federal protections. More importantly, the Privacy Rule creates equal standards of privacy protection for research governed by the existing Federal human subject regulations and research that is not. 

How the Rule Works 

In the course of conducting research, researchers may obtain, create, use, and/or disclose individually identifiable health information. Under the Privacy Rule, covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule. Research Use/Disclosure Without Authorization. To use or disclose protected health information without authorization by the research participant, a covered entity must obtain one of the following: 

• Documented Institutional Review Board (IRB) or Privacy Board Approval. Documentation that an alteration or waiver of research participants’ authorization for use/disclosure of information about them for research purposes has been approved by an IRB or a Privacy Board. See 45 CFR 164.512(i)(1)(i). This provision of the Privacy Rule might be used, for example, to conduct records research, when researchers are unable to use de-identified information, and the research could not practicably be conducted if research participants’ authorization were required. A covered entity may use or disclose protected health information for research purposes pursuant to a waiver of authorization by an IRB or Privacy Board, provided it has obtained documentation of all of the following:
  • Identification of the IRB or Privacy Board and the date on which the alteration or waiver of authorization was approved; 
  • A statement that the IRB or Privacy Board has determined that the alteration or waiver of authorization, in whole or in part, satisfies the three criteria in the Rule; 
  • A brief description of the protected health information for which use or access has been determined to be necessary by the IRB or Privacy Board;
  • A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures; and 
  • The signature of the chair or other member, as designated by the chair, of the IRB or the Privacy Board, as applicable. 

The following three criteria must be satisfied for an IRB or Privacy Board to approve a waiver of authorization under the Privacy Rule: 

1. The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
   • an adequate plan to protect the identifiers from improper use and disclosure; 
   • an adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and 
   • adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of protected health information would be permitted by this subpart; 
2. The research could not practicably be conducted without the waiver or alteration; and 
3. The research could not practicably be conducted without access to and use of the protected health information. 

• Preparatory to Research. Representations from the researcher, either in writing or orally, that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purposes preparatory to research, that the researcher will not remove any protected health information from the covered entity, and representation that protected health information for which access is sought is necessary for the research purpose. See 45 CFR 164.512(i)(1)(ii). This provision might be used, for example, to design a research study or to assess the feasibility of conducting a study.  The Privacy Rule does not prohibit a covered entity’s granting remote access to PHI to a researcher for activities that qualify as reviews preparatory to research, provided reasonable and appropriate safeguards are in place, as described in OCR’s guidance, Remote Access to PHI for Activities Preparatory to Research.
• Research on Protected Health Information of Decedents. Representations from the researcher, either in writing or orally, that the use or disclosure being sought is solely for research on the protected health information of decedents, that the protected health information being sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is being sought. See 45 CFR 164.512(i)(1)(iii). 
• Limited Data Sets with a Data Use Agreement. A data use agreement entered into by both the covered entity and the researcher, pursuant to which the covered entity may disclose a limited data set to the researcher for research, public health, or health care operations. See 45 CFR 164.514(e). A limited data set excludes specified direct identifiers of the individual or of relatives, employers, or household members of the individual. The data use agreement must:
  • Establish the permitted uses and disclosures of the limited data set by the recipient, consistent with the purposes of the research, and which may not include any use or disclosure that would violate the Rule if done by the covered entity; 
  • Limit who can use or receive the data; and 
  • Require the recipient to agree to the following:
    • Not to use or disclose the information other than as permitted by the data use agreement or as otherwise required by law; 
    • Use appropriate safeguards to prevent the use or disclosure of the information other than as provided for in the data use agreement; 
    • Report to the covered entity any use or disclosure of the information not provided for by the data use agreement of which the recipient becomes aware; 
    • Ensure that any agents, including a subcontractor, to whom the recipient provides the limited data set agrees to the same restrictions and conditions that apply to the recipient with respect to the limited data set; and
    • Not to identify the information or contact the individual. 
• Research Use/Disclosure With Individual Authorization. The Privacy Rule also permits covered entities to use or disclose protected health information for research purposes when a research participant authorizes the use or disclosure of information about him or herself. Today, for example, a research participant’s authorization will typically be sought for most clinical trials and some records research. In this case, documentation of IRB or Privacy Board approval of a waiver of authorization is not required for the use or disclosure of protected health information. To use or disclose protected health information with authorization by the research participant, the covered entity must obtain an authorization that satisfies the requirements of 45 CFR 164.508. The Privacy Rule has a general set of authorization requirements that apply to all uses and disclosures, including those for research purposes. However, several special provisions apply to research authorizations:
  • Unlike other authorizations, an authorization for a research purpose may state that the authorization does not expire, that there is no expiration date or event, or that the authorization continues until the “end of the research study”.
  • An authorization for the use or disclosure of protected health information for a research study may be combined with a consent to participate in the research, or with any other legal permission related to the research study.
  • An authorization for the use or disclosure of protected health information for a research study may be combined with an authorization for a different research activity, provided that, if research-related treatment is conditioned on the provision of one of the authorizations, such as in the context of a clinical trial, then the compound authorization must clearly differentiate between the conditioned and unconditioned components and provide the individual with an opportunity to opt in to the unconditioned research activity.
  • An authorization may be obtained from an individual for uses and disclosures of protected health information for future research purposes, so long as the authorization adequately describes the future research such that it would be reasonable for the individual to expect that his or her protected health information could be used or disclosed for the future research purposes.
  • New Guidance on HIPAA and individual authorization of uses and disclosures of protected health information for research.  This guidance explains certain requirements for an authorization to use or disclose PHI for future research.  The guidance also clarifies aspects of the individual’s right to revoke an authorization for research uses and disclosures of PHI.
• Accounting for Research Disclosures. In general, the Privacy Rule gives individuals the right to receive an accounting of certain disclosures of protected health information made by a covered entity. See 45 CFR 164.528. This accounting must include disclosures of protected health information that occurred during the six years prior to the individual’s request for an accounting, or since the applicable compliance date (whichever is sooner), and must include specified information regarding each disclosure. A more general accounting is permitted for subsequent multiple disclosures to the same person or entity for a single purpose. See 45 CFR 164.528(b)(3). Among the types of disclosures that are exempt from this accounting requirement are:
  • Research disclosures made pursuant to an individual’s authorization; 
  • Disclosures of the limited data set to researchers with a data use agreement under 45 CFR 164.514(e). 

In addition, for disclosures of protected health information for research purposes without the individual’s authorization pursuant to 45 CFR164.512(i), and that involve at least 50 records, the Privacy Rule allows for a simplified accounting of such disclosures by covered entities. Under this simplified accounting provision, covered entities may provide individuals with a list of all protocols for which the patient’s protected health information may have been disclosed under 45 CFR 164.512(i), as well as the researcher’s name and contact information. Other requirements related to this simplified accounting provision are found in 45 CFR 164.528(b)(4). 

Transition Provisions. Under the Privacy Rule, a covered entity may use and disclose protected health information that was created or received for research, either before or after the applicable compliance date, if the covered entity obtained any one of the following prior to the compliance date

• An authorization or other express legal permission from an individual to use or disclose protected health information for the research; 
• The informed consent of the individual to participate in the research; 
• A waiver of authorization approved by either an IRB or a privacy board (in accordance with 45 CFR  164.512(i)(1)(i)); or
• A waiver of informed consent by an IRB in accordance with the Common Rule or an exception under FDA’s human subject protection regulations at 21 CFR 50.24. However, if a waiver of informed consent was obtained prior to the compliance date, but informed consent is subsequently sought after the compliance date, the covered entity must obtain the individual’s authorization as required at 45 CFR 164.508. For example, if there was a temporary waiver of informed consent for emergency research under the FDA’s human subject protection regulations, and informed consent was later sought after the compliance date, individual authorization would be required before the covered entity could use or disclose protected health information for the research after the waiver of informed consent was no longer valid. The Privacy Rule allows covered entities to rely on such express legal permission, informed consent, or waiver of authorization of informed consent, which they create or receive before the applicable compliance date, to use and disclose protected health information for specific research studies, as well as for future unspecified research that may be included in such permission.

OCR HIPAA Privacy
December 3, 2002 Revised December 18, 2017

Back to Top

Other HIPAA and Research Resources