HIPAA Compliance for Reporters to FDA MedWatch
You can continue to make adverse event reports under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The HIPAA Privacy Rule is not intended to disrupt or discourage adverse event reporting in any way. In fact, the Privacy Rule specifically permits covered entities (such as pharmacists, physicians or hospitals) to report adverse events and other information related to the quality, effectiveness and safety of FDA-regulated products both to the manufacturers and directly to FDA.
"The HIPAA Privacy Rule recognizes the legitimate need for public health authorities and others responsible for ensuring public health and safety to have access to protected health information to carry out their public health mission. The Rule also recognizes that public health reports made by covered entities are an important means of identifying threats to the health and safety of the public at large, as well as individuals. Accordingly, the Rule permits covered entities to disclose protected health information without authorization for specified public health purposes."
(From OCR Guidance Explaining Significant Aspects of the Privacy Rule - DISCLOSURES FOR PUBLIC HEALTH ACTIVITIES, page 28. See also 45 CFR 164.512(b)(1)(i) and (iii))
In order to keep effective drugs and devices available on the market for use by you and your patients, FDA relies on the voluntary reporting of serious adverse events or product problems that you suspect are associated with a drug or medical device you have used, prescribed or dispensed. FDA uses these data to maintain our safety surveillance of all FDA-regulated products. Your report may be the critical action that prompts a modification in use or design of the product, improves the understanding of the safety profile of the drug or device and leads to increased patient safety.
You should bear in mind that the Privacy Rule requires that you make a reasonable effort to submit the minimum protected health information necessary to achieve the purpose of your report. See 45 CFR 164.502(b) and 164.514(d).