Appendix B: Copyright Law

Copyright Law Copyright law confers exclusive legal rights on the owner of the copyright.¹ The exclusive rights of copyright may be sold, assigned (transferred), or licensed (limited transfer of rights for use on specific terms or conditions) to others; these rights may also be waived (quit claim). Licensing ordinarily consists of a private agreement governed by contract rather than copyright law.²

However, the exclusive rights conferred by copyright to prepare derivative works and distribute copies of a health information registry may be limited by regulatory requirements. Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule restrictions may limit data use, reuse, and disclosures or may require additional patient authorizations for subsequent research use. The conditions of institutional review board (IRB) approval under the Common Rule may also limit reuse and further disclosure of registry data. The terms of patient authorization and consent, a data use agreement, or a business associate agreement may modify the scope and nature of rights protected by copyright law. These limitations can be avoided by the use of deidentified health information, as defined by the Privacy Rule, plus information that is not subject to the Common Rule, if they suffice for the scientific or other purposes of the registry. Without resort to copyright protections, State laws may directly restrict access to registry data, as well as the use and disclosure of data from registries developed by public health agencies.

Formal copyright registration³ with the U.S. Copyright Office is not necessary but may be desirable for registries anticipated to have commercial value. The owner of a copyright is generally the author⁴ or author's employer; ownership of the copyright for a compilation is not ownership of the underlying facts or data.⁵ Copyright law presumes that an employer owns the copyright in materials created by an employee within the scope of his or her employment as a "work made for hire."⁶ Institutional policies and procedures frequently prescribe whether the registry developer, his or her employer, or a funding agency owns the copyright. Employee manuals often contain an employer's position on the intellectual property created by employees. Research institutions frequently reserve the right to the intellectual property produced by their employees. Intellectual property issues are explicitly negotiated in most sponsored research contracts. Authors of a joint work are co-owners of copyright in the work.⁴

Several factors determine whether the use of a registry protected by copyright for scholarship, research, or certain other purposes is within the statutory fair use limitation on copyright.⁷ In general, these factors will support subsequent uses of registry data for research, even though it may be protected by copyright. In any given set of circumstances, a specific analysis of the statutory factors is necessary to determine whether use is likely to be viewed within the fair use limitation on copyright.¹

Copyright law may provide some legal protections for compilations such as health information registries. The extent of this protection depends on the specific characteristics of the registry. In general, the concept of ownership does not comfortably apply to health information, even when limited to copyright. Nevertheless, some registry developers may want to consider adding the legal protections of copyright to reinforce controls on access to and use of registry data. Registry developers may also encounter copyright protections on health information held by healthcare providers. Use of health information protected by copyright for research purposes may constitute fair use under copyright law.

References for Appendix B

U.S. Department of Health and Human Services

Agency for Healthcare Research and Quality 5600 Fishers Lane Rockville, MD 20857

AHRQ Pub. No. 19(20)-EHC020 August 2020 ISBN: 978-1-58763-028-6