Next year, federal regulations aimed at protecting health care information will for the first time give Americans a say in how their private medical information is used, supplementing a patchwork of state and local laws that now govern medical privacy.
These regulations will have an impact on the medical research communityperhaps with a chilling effect or simply as another administrative hurdle. But all agree that, compared to earlier versions, the final rule streamlines the process and simplifies the requirements that affect medical research.
"Medical centers whose mission includes teaching and research will find a way to create the structures necessary to comply with the [privacy] rule," said David Korn, M.D., senior vice president of the division of biomedical and health sciences research at the Association of American Medical Colleges. However, he said, because of the civil and criminal penalties associated with improper disclosure of privileged health care information, "if research is not a primary mission [of the group requesting the data], a lot of organizations will probably not allow medical researchers to have access to their data at all."
But William R. Braithwaite, M.D., Ph.D., countered that health care research has always been done with a view towards privacy and confidentiality. "Granted, its an additional step for an institutional research board to pay attention to, but in the overall scheme of trying to protect individuals privacy, I dont think its a big deal," said Braithwaite, who is the director of the Health Insurance Portability and Accountability Act (HIPAA) advisory services branch at PricewaterhouseCoopers in Washington, D.C.
The privacy regulations stem from HIPAA, orginally passed in 1996. The law set a 3-year deadline for Congress to address the issue of medical privacy, and then directed the Department of Health and Human Services to develop regulations regarding protected health care information. The proposed HIPAA privacy regulations were first published in 1999 and have since undergone several revisions. Final regulations will become officially effective in April 14, 2003.
The new rules set forth procedures for the acquisition, use, storage, and disclosure of individually identifiable health information in paper or electronic form. That includes information relating to diagnoses, tests, and treatments. With some exceptions, disclosure of such protected health information requires the written informed consent of the patient. In addition, patients now have the right to request access to their health records and to make changes if there are any inaccuracies. They can also find out if their medical records have been accessed for any non-routine uses.
"We do need to pay more attention to the needs of patient privacy," said Donald Steinwachs, Ph.D., professor and chair of health policy and management at Johns Hopkins University in Baltimore. "Intervention studies generally rely on informed consent, so the new regulations should not pose a problem if you use the appropriate consent forms. Where there has been more of a concern, especially before the revisions, was in whether there would be a chilling effect on the willingness of providers to give researchers access to administrative data."
|
Under the regulations, medical information can also be used for research purposes without consent if subjects are deceased, if the information is being used to develop research protocols, if most or all of the identifying information has been stripped from the record, or if a review board has approved a waiver for the research. Under current research guidelinesthe so-called Common Ruleinstitutional review boards have the authority to waive the requirement of informed consent if the research involves no more than minimal risk, will not adversely affect research subjects, and could not be practicably carried out without a waiver.
With HIPAA, IRBs and new entities called privacy review boards can still grant waivers of informed consent if the disclosure of protected information involves a minimal risk to the privacy of individuals and includes an adequate plan to destroy the identifiers as soon as possible; the research could not be conducted without the waiver; and the research could not be conducted without access to and use of the protected information.
Protected health information can also be disclosed to state or federal cancer registries, made available to the FDA or agencies regulated by the FDA for such purposes as regulating adverse events, and used to communicate with other physicians and organizations about eligibility for clinical trials.
One of the more controversial regulations is the so-called minimum necessary rule. The concept is that covered entities and their associates should not disclose protected health information beyond what is reasonably necessary for the purpose of the disclosure. The preamble to the HIPAA regulations emphasizes that a covered entity may rely on a researchers documentation or IRB approval regarding the minimum necessary information needed for research purposes.
There is no distinction in the final rules between medical research that provides treatment, such as a clinical trial, and research that does not, except that the provision of treatment may be conditional on a subjects signing an authorization. Authorizations for research may be combined with informed consent forms, streamlining the process compared to the initial proposed regulations, which required separate disclosure sheets for each use of private health information.
The authorization must specify the information that will be used, who may receive it, and how it may be used. One of the most unusual provisions is that the authorization must specify an expiration date; a change from the proposed regulations allows researchers to disclose that there is no point at which private health information will cease to be available for use. Many cancer patients are tracked for years to determine relapse and survival rates. Thus, such open-ended authorizations will be needed for registries and some research repositories and databases, for example.
Originally, the HIPAA regulations required that data be stripped of 18 possible identifiers, including names, photos, phone numbers, internet contact information, and zip codes. Limited data sets exclude specific, identifiable information but may include data such as full birthdate and zip codes. That kind of information is important for researchers attempting to link cancer incidence to particular environmental exposures, and represents a significant improvement in the final regulations, said Tanita. Even so, she added, this represents a burden for researchers and may not provide all the information needed.
"Nothing in here prevents you from doing the research you want to do," said George Annas, J.D., chair of the health law department at the Boston University School of Public Health. The problem is that the HIPAA regulations and commentary are so detailed and complex that an entire industry has grown up around implementing the rules, he said. The challenge of complying with regulations will be more of a burden for organizations that are not primarily committed to research, he said.
Ultimately, the effects of the HIPAA privacy rules on medical research remain to be seen. "We wanted to make sure that the rule did not impede legitimate health research," said Rick Campanelli, J.D., director of the Office for Civil Rights at HHS. "We paid significant attention to the comments we got from the research community, and we believe this final rule permits research to go forward while balancing the rights of patients to protect their health information."
![]() |
||||
|
Oxford University Press Privacy Policy and Legal Statement |