New Federal Privacy Rules Stump Researchers

A new federal rule designed to protect patients' privacy rights could handicap researchers and prompt legal challenges, according to health policy experts. The privacy rule in the Health Insurance Portability and Accountability Act of 1996 (HIPAA)--for which the Department of Health and Human Services released guidelines in July--requires that researchers who use the nation's tissue banks obtain authorizations when they use patient-specific information, such as medical histories. According to HIPAA, plaintiffs in civil court can use the rule as a standard for privacy protection even before April 2003, when both criminal and civil penalties for violations can be applied. But the rule's effect on medical researchers remains an unanswered question. "The rule will have substantial effects on conduct of medical and health sciences research," says David Korn, senior vice president of biomedical and health sciences research for the Association of Academic Medical Centers. "The effect of some of its provisions will, we fear, be most unfortunate." Korn, a research pathologist and past dean of Stanford Medical School, is particularly concerned that the enormous archives of human-tissue samples in the nation's hospitals and academic medical centers may be at risk. These banked tissues have become an increasingly valuable resource with the introduction of new techniques such as the use of monoclonal antibodies and PCR. Courtesy of Davis Wwright Tremain LLPCarol Pratt Historically, human tissue samples removed for medical reasons are archived with a standard consent form that grants permission to use the tissue for any research in the future. "This is no longer valid," says Carol Pratt, health care attorney who specializes in HIPAA law. "If you have prospective intent to do research, that now becomes a research protocol that has to be reviewed by an IRB [Institutional Review Board]. There is a conspicuous absence of dialogue on the national level about HIPAA's effect on research." Privacy is Key The HIPAA privacy rule represents congressional response to growing public concern for privacy and the increased use of electronic transactions. Under the rule, all medical records and other individually identifiable health information, called Protected Health Information (PHI) in the regulations, will be covered if it is used or disclosed by a covered entity in any form--electronically, on paper, or orally. A covered entity is defined as a health care provider, health plan, or health care clearinghouse. The privacy rule mainly concerns the use and disclosure of patient information for treatment, or payment, or for health care operations such as quality-assurance audits. But the regulations do specifically address the conditions under which these records may be used for research purposes. According to HIPAA, the Office of Civil Rights will be responsible for enforcement of the regulations, and compliance with their conditions and standards brings a new level of administrative oversight for researchers and IRBs. An understanding of the rules' effect on basic research hinges on an understanding of the HIPAA terms "consent" and "authorization." A consent is a general document that gives health care providers, who have a direct treatment relationship with a patient, permission to use and disclose all PHI for treatment, payment, or health care operations. An authorization form is a more customized document that gives the institution permission to use or disclose medical records for specified purposes, or to share them with a third party specified by the patient. The authorization form is more detailed and limiting than a consent form: it covers the specific uses and information to be disclosed, has an expiration date, and a right to revoke. The form requires disclosure of any remuneration in connection with the information; and, in some cases, it also states the purpose for which the information may be used or disclosed. Under the privacy rule, if authorization from the participant is obtained, medical researchers and hospitals are permitted to use and share the subject's health information as specified. To conduct research without authorization, such as might occur in retrospective chart reviews or studies of banked tissues, the researchers must either use de-identified data, which is specifically defined in the rules, or submit their protocols to IRBs or privacy boards for waivers of authorization. The waivers can be issued if a research institute meets eight criteria, which basically demonstrate that the importance of the research outweighs the minimal privacy risk. The researcher must also issue an adequate plan for protecting the information and provide assurances that the identifying information will be destroyed. "The problem is that the details of a research authorization are extremely precise about who is going to have access, what it is going to be used for, and how long it will be around, and expiration of the authorization," Korn says. "Tissue is a long-standing resource--it's like a library--you can't predict what the specific uses may be in the future." Richard Marks, a Washington, D.C., attorney with an expertise in HIPAA law, says it may be possible to create broad-enough authorizations for the prospective use of tissue samples. But his theory remains untested. "All the researchers that I have talked to, clinical and otherwise, are very fearful that the authorization process, the way it is written in the rules, will have a significant impact on research," Marks says. "And, in addition to narrowing the information that people can use, it will have an impact on the cost of administering research, which means less research will get done." According to HIPAA, if tissue samples are stripped of identifiers or are anonymous, then research may be conducted without authorizations. But it is identifiable health information that makes most research valuable. If a disease process is being investigated, the private health records are important to follow outcomes or responses to therapy. "Totally de-identified tissue information isn't worth a whole lot," Korn says. "Most research using tissue needs or wants the follow up." Pratt says pharmaceutical and biotech markets also want identifiable health information. "What I see as a lawyer are businesses trying to develop data mining products, whereby they collect medical information and create a data base of individuals with various clinical profiles," she adds. As Big Pharma continues to develop drugs, particularly pharmacogenomic drugs, streamlining the clinical-trial process takes on added importance. An efficient way to streamline is use of targeted patient populations. But research institutes have not determined how the databases will be developed when state and federal privacy laws protect the information. "We are going to have to create some entities that don't exist now," Pratt says. She envisions that data mining companies will become the "keepers of the code" that could relink de-identified data with protected health information. These companies would have the responsibility for securing information and maintaining standards of privacy. But Pratt adds that this question is still abstract. "In my experience, people are just beginning to really believe that HIPAA is going to happen." The History of HIPAA The HIPAA privacy and security rules arose from an increasing public concern about loss of privacy and the fear of discrimination based on abuse of sensitive health information. A 1995 Harris Poll found that more than 85 percent of those surveyed were either "very concerned" or "somewhat concerned" that insurers and employers might gain access to and use genetic information. In a 1996 Harris survey, only 18 percent of the respondents consider the use of patient records for medical research without prior permission to be very acceptable, and approximately one third felt that identifiable health information used for research was unacceptable without patient consent. These fears are not unfounded. This year, the Equal Employment Opportunity Commission filed the first lawsuit challenging genetic testing by an employer. Burlington Northern Santa Fe Railroad was conducting genetic testing on employees who had filed for workers compensation due to carpal tunnel syndrome. Testing was being done without their consent, and at least one worker was threatened with dismissal unless he agreed to the test, the agency charged. The railroad company has since stopped the genetic testing and settled the suit. Similar privacy breaches have become more common; several are listed in the documentation for the new federal privacy rule. David Kirby, head of information security for Duke University Medical Center, suggests that the privacy rule might encourage more participation in research because potential participants will have assurances that private information will remain private. "People won't participate unless they are convinced that you will do well with this issue of privacy," he says. "It's one of the top ten areas where people are concerned enough about how this operates that it's something that we need to do well." Katherine Uraneck is a physician and writer in New York City.

New Federal Privacy Rules Stump Researchers

Interested in reading more?

Become a Member of