Ethical, Legal, and Policy Best Practices

Biospecimen research depends on protecting the privacy of individuals who contribute biospecimens and on maintaining the confidentiality of associated clinical data and information (Eiseman et al. 2003) . Applying the highest possible ethical standards is necessary to ensure the support and participation of human research participants, physicians, researchers, and others in biospecimen resource activities (Friede et al. 2003) . With the recent advances in genomic and proteomic technology, the sequencing of the human genome, and the increasing reliance of biospecimen resources on electronic and Web-based databases for data tracking, it is even more crucial to address the risk of breaches in privacy. The unintended release or disclosure of sensitive information can place individuals at risk for discrimination and related groups at risk for stigmatization although the frequency of these types of harms is unknown.

C.3.1. Federal Regulations Pertaining to Privacy

The DHHS-issued regulation titled "Standards for Privacy of Individually Identifiable Health Information, " commonly known as the HIPAA Privacy Rule (see 45 CFR Part 160 and Subparts A and E of Part 164) , was created to protect the privacy of health information that identifies an individual while still allowing other activities of benefit to society, such as research. While the HIPAA Privacy Rule does not apply to biospecimens directly, it may affect biospecimen resources that are considered covered entities in that human specimens often are accompanied by identifiable protected health information.

If the biospecimen resource is considered a covered entity under HIPAA, compliance with the regulation titled "Security Standards for the Protection of Electronic Protected Health Information, " commonly known as the Security Rule, is required to ensure appropriate security of electronic protected health information (PHI) (see 45 CFR Part 160 and Part 164 Subparts A and C) . Detailed information on the HIPAA Security Rule is available at http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/index.html.

The Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted on February 17, 2009, as Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009. Portions of the HITECH Act will impact the provisions and implementation of the HIPAA Privacy Rule and Security Rule. For current information about the HITECH Act as well as detailed information on the HIPAA Privacy Rule, see http://www.hhs.gov/ocr/privacy.