IVD Technology
Magazine
IVDT Article Index
Originally Published September 2000
Regulations and Standards
IVDs and the states: The other regulatory system
Jeffrey N. Gibbs
The IVD industry in the United States is heavily regulated. In discussions of the regulations that apply to IVD companies, the focus has been on FDA—and properly so. After all, FDA determines whether new devices can enter the market, regulates product promotion, establishes manufacturing standards, sets rules for product labeling, and takes enforcement action when it believes that a company has violated the Federal Food, Drug, and Cosmetic Act.
Though FDA regulation may be paramount, it is not exclusive. The individual states also regulate the IVD industry. And certain trends that are already perceptible may result in a greater regulatory role for the states, particularly in clinical testing.
Clinical Trials and Informed Consent
FDA often mandates clinical trials to establish the clinical performance of new diagnostic tests. Under FDA regulations, patients who participate in such trials must give their informed consent. However, some of these trials require clinical testing of pediatric populations. Others focus on conditions that diminish the capacity of the test subject to give consent, such as schizophrenia or Alzheimer's disease. These types of clinical trials present issues regarding the capacity of their subjects to consent to them, and the determination of who can give consent if the subjects cannot.
FDA regulations are silent with regard to how consent can be obtained from someone who lacks the capacity to respond meaningfully, such as a minor or a sufferer of dementia. Moreover, FDA specifically says that its informed-consent regulations do not supersede any requirements promulgated by the separate states. And, generally, the states set the standards for determining whether an individual has the capacity to consent; they also outline the procedure for obtaining consent when the subject lacks the requisite capacity.
Different states have different standards for the age at which a person can legally give consent. In many states, that age is 18. Some states, though, permit a 17-year-old to give effective consent. The age may also be lower if the individual in question is "emancipated." An underage person who has become emancipated through marriage or some other means does not need the approval of an adult or guardian to participate in a research study. To demand that an emancipated minor obtain parental consent would be to impose a requirement on the subject and the clinical investigator that is unnecessary—if not inappropriate—under state law. Some states also require, in addition to parental consent, that older minors give their "assent" to participation in clinical studies. Whether assent is needed is governed strictly by state law.
An area of even greater concern, perhaps, is neonatal screening. Obviously, a newborn infant cannot consent to being tested for a new marker. Who, then, can? Generally, of course, the parents can. But what if they are unavailable, or they disclaim parental responsibility? What if the parents are in conflict over the question? Can grandparents consent? Can an authorized guardian? And who would be an authorized guardian? FDA regulations do not answer any of these questions. The answer must lie within the law of the state with jurisdiction over the research.
Unfortunately, there is no good single source for this type of information. While investigators should be aware of the laws regarding patient capacity and third-party consent in their states, sometimes they simply are not familiar with the nuances. Such ignorance can create regulatory issues for the IVD manufacturer as a trial sponsor, because, under FDA regulations, the sponsor is ultimately liable for ensuring that valid informed consent is obtained.
FDA's recent statements encouraging a greater focus on obtaining informed consent before using banked specimens in research underscores the importance of state law. (Whether FDA's position is correct is a separate issue.) To the extent that the informed-consent requirements apply to such specimens, the criteria for determining whether valid consent has been obtained come from the states.
Another area in which state law is crucial involves emergency diagnostic tests employed when patients are unable to consent. For example, a rapid test for a patient who has apparently suffered a heart attack or stroke may need to be conducted so quickly that there is no time to get third-party consent. Under some circumstances, FDA allows emergency research.1 However, not all states have been so accommodating. For instance, a New Jersey regulation provides that every New Jersey hospital patient has the right to participate in experimental treatment, but only when he or she—or a guardian or legal representative—consents to the participation. That statute includes no exception for experimental research involving emergency treatments.2 Therefore, IVD companies conducting trials of emergency diagnostics cannot simply assume that compliance with FDA regulations resolves all issues relating to informed consent.
Genetic Screening
A diagnostic arena that has recently received considerable attention is genetic screening. With the advent of pharmacogenomics, the completion of the first phase of the Human Genome Project, the rush to develop genetic markers, and other related advances, genetic screening is an area of rapidly growing importance.
No comprehensive federal law or policy now exists to govern genetic screening. States have begun to fill this void. A number of them have enacted laws to regulate genetic screening, but the statutes vary widely in nature. For example, Colorado law provides that "information derived from genetic testing shall be confidential and privileged."3 Disclosure of information gained from genetic testing for any use other than diagnosis, treatment, or therapy, in a manner that identifies the individual, requires the specific written consent of the individual. By contrast, New York state law is far more restrictive. The New York law provides that, except within the context of a very limited exemption, "no person shall perform a genetic test on a biological sample taken from an individual without the prior written informed consent of such individual."4
Thus, companies involved in testing genetic-screening assays need to determine the applicable state law, and comply with it. This may be easier said than done. State genetic-testing laws make a patchwork quilt of differing requirements. Identifying and monitoring these laws presents a challenge. Moreover, it is not always clear which state's law applies. If a patient residing in New York has blood drawn in New Jersey by his physician, and the blood is tested by an Ohio laboratory, which state law controls? The state statutes do not specify how a situation like this is to be handled, and FDA regulations are silent about such matters. This does not mean the question is unanswerable. It does mean, however, that companies or investigators will need to assess these issues and devise reasonable solutions. These genetic-screening laws will affect both clinical trials and the commercial viability of tests once they have been cleared for marketing.
Patient Privacy
Another increasingly important area of regulation in which states have taken the lead is patient privacy. In November 1999, the U.S. Department of Health and Human Services proposed regulations to implement the privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA).5 These regulations are expected to become effective for most healthcare providers in 2002. They will control important privacy issues, such as the disclosure of personal medical information by healthcare providers. The HIPAA regulations establish a basic level of protection for medical records containing personally identifiable information that are—or were at any time—in an electronic format. They will not preempt stricter state laws that provide greater levels of protection.
Many states have adopted rules of their own that are designed to protect the privacy of medical information. These statutes tend to be very specific, protecting the privacy of patient records in particular settings, such as hospitals and mental-health institutions, or protecting specific types of information, such as the results of HIV testing. Consequently, one state may have multiple statutes whose focus is the protection of medical records. For example, Florida has more than 60 separate laws that address issues of medical privacy.6
States have taken different approaches in writing statutes regarding the use of medical records for research purposes. Minnesota law requires that patients be given a chance either to consent to or to reject review of their charts in connection with research.7 Laws in the state of Washington permit the disclosure of medical information for research purposes without authorization from the patient only upon the approval of an institutional review board (IRB). But that law also requires that, in the event of such disclosure, personal identifiers be destroyed at the earliest opportunity unless the IRB has authorized the researcher to retain them.8
These rules assume greater significance as IVD companies use new tests to generate genetic data that are stored, transmitted, and transferred electronically. For instance, as IVD companies conduct clinical studies involving genetic tests, various state laws may impose requirements on sponsors respecting the protection of subject privacy. Indeed, the rapid increase in genetic testing—combined with the exponential increase in the flow of data over the Internet—is likely to spur the states to enact even more legislation to protect individual privacy. Some IRBs now closely review proposed protocols to determine whether privacy rights are being upheld. Diagnostic studies involving genetic markers may need to satisfy not only state informed-consent laws but also state laws regulating privacy and genetic tests.
States may play yet other roles in the regulation of commercially available IVDs. For example, FDA recently rejected a request by a large IVD manufacturer seeking to preempt state laws preventing direct patient contact with laboratories.9 The agency's decision could make it more difficult for companies to commercialize certain types of over-the-counter test kits that are designed to be sent directly to laboratories. Similarly, other state regulations regarding the role of clinical laboratories can make it more difficult to use FDA-cleared point-of-care tests.
Conclusion
FDA's status as the predominant regulatory body for IVD companies is not in jeopardy, but the agency does not play an exclusive role. The states are coming to be a more significant factor in regulating areas as diverse as informed consent, genetic testing, and privacy. Because noncompliance with state law can have civil, criminal, and regulatory liability implications, IVD companies need to be alert to these trends. They must assess, at an early stage, the likely impact of state laws on their testing, marketing, and commercialization plans.
Jeffrey N. Gibbs is a partner in the law firm of Hyman, Phelps & McNamara (Washington, DC).
References
1. Code of Federal Regulations, 21 CFR 50.23 and 50.24.
2. New Jersey Administrative Code Title 8, sect. 43G-4.1 (2000).
3. Colorado Revised Statutes, sect. 10-3-1104.7 (1999).
4. New York Consolidated Law Services, Civil Rights Section 79-1(2)(a) (1999).
5. Federal Register, 64 FR:59918, November 3, 1999.
6. Health Privacy Project, "The State of Health Privacy: An Uneven Terrain, 1" [on-line.
7. Minnesota Statutes, sect. 144.335, subdiv. 3a(d)(2) (1999).
8. Washington Revised Code Ann., sect. 70.02.050(1) (2000).
9. "FDA Advisory Opinion in BD Case Upholds 1996 Medtronic v. Lohr Ruling," The Gray Sheet, 26, no. 18 (2000):10.
Back to the September table of contents | Back to the IVDT home page
