Request a Quote

How iSpecimen Ensures Biospecimen Patient Privacy: A Deeper Dive

August 22, 2017

Medical Record Lock

At iSpecimen, getting researchers the specimens they need from the patients they want is accomplished with the utmost attention to patient privacy and federal regulations. By patient, we mean the people whose biofluids, solid tissue, or viable cells make their way into biomedical research for new diagnostics and therapeutics.

Protecting patient privacy requires us to master adherence to several rules covering the use of human biospecimens in research. All of our processes and technology have been designed in accordance with the Department of Health & Human Services (HHS) Common Rule, HIPAA (the Health Insurance Portability and Accountability Act) and institutional review board IRB protocols. Only specimens that meet regulatory requirements and protect patients’ rights ever get into the hands of our researcher customers. Let’s take a closer look:

How we identify specimens
The iSpecimen Marketplace maintains a centralized view across our federated partner network of hospitals, labs, biobanks, and other healthcare organizations. It constantly watches the real-time flow of patients, specimens, and data as they pass through the healthcare system, by interfacing with our partners’ electronic medical records systems, lab information systems, and other data sources. But we only take in this data once it has been securely de-identified at the provider site – no protected health information (PHI) ever leaves our partners’ data centers. Read on for how it’s done.

We remove patient data
Our proprietary cloud-based software removes PHI from patient and specimen data before it is transmitted over iSpecimen’s data center. PHI remains behind the firewall of the institution from which the data came (this process is called de-identification). iSpecimen receives a detailed description of the available specimens and patients without names, birthdays, cities, and other potentially identifying information, and recodes each specimen with our own numeric system.  By removing all PH before storing data in the cloud, the risk of a PHI data breach is removed.

Someone must need to see the PHI though, right?
Yes, but not us at iSpecimen. When a researcher selects a specimen through the iSpecimen Marketplace, a secure message goes to the partner institution where the patient or specimen and associated PHI is held. The same software that de-identified the data on its way out of the partner institution re-identifies it behind the partner firewall on its way back in. Only the provider staff making the patient or specimen selection sees the protected information. Specimens and data are then sent to us or our customers both physically and electronically, de-identified.

We require researchers to agree to never try to re-identify a patient or specimen
As an added level of protection, iSpecimen requires all customers to have executed iSpecimen’s Material & Data Use Agreement, which prohibits the researcher from ever using data provided with a specimen, or any data sets that the researcher may generate from analysis of the specimen, in an attempt to re-identify a sample or patient/donor.

We address consent and IRB protocols
Proper consent is as important as patient privacy. So when iSpecimen’s partners collect specimens from patients specifically for research, each patient is properly consented and the collection follows relevant IRB protocols. If a partner does not have such a protocol in place, iSpecimen either adds them as a site on one of our IRB protocols or provides appropriate compliance materials and assistance to gain approval by the partner’s IRB.  The net effect is that all specimens collected specifically for research purposes are shipped by our partners under an approved IRB protocol with full informed consent.

When we work with de-identified clinical discards, the Common Rule does state that patient consent is not required as long as the sample and associated data sets are de-identified, but many of our partners choose to inform and consent patients even for discards, which we support with consulting and services to help them put this in place.  Our technology also tracks the various types of consent and disclosure (no consent, disclosure, waiver of consent, full informed consent) associated with each specimen and ensures that only specimens that match up to a researcher’s consent requirements are picked and shipped.

HIPAA compliance analyses
While neither iSpecimen employees nor our data center have access to PHI, we still undergo regular HIPAA compliance gap analyses. These third-party “audits” ensure that our technology, policies, and processes comply with all existing HIPAA regulations pertaining to both privacy and security. As part of this assurance, all iSpecimen personnel (employees, interns, and consultants) are HIPAA-trained and certified every year.

iSpecimen also fully supports hospitals and labs (our provider partners) launching their own internal HIPAA compliance and security audits of iSpecimen’s technology, processes, and policies.

Technology security
Even though our cloud-based software does not access or store PHI, we treat our data center as if it does. To ensure that this de-identified data is protected, we do the following to provide an even higher level of confidence in the security of our technology:

  • We implement multiple layers of technology security – administrative, physical, and technical.
  • We perform binary code security testing on all of our software releases.
  • We regularly hire “ethical hackers” to perform manual penetration testing of our application code.
  • We support hospital and laboratory security departments with their own internal security reviews.

Our commitment
As you can see, privacy and security require a lot of work. But the result of providing researchers with the specimens they need to fuel important medical research is well worth it, as is enabling hospitals, labs, and other partner sites to make a contribution to medical research as well as their bottom line.