Patient Privacy Rule Hobbles Health Research, Survey Reveals
By Judith Groch, Senior Writer, MedPage Today
Reviewed by Zalman S. Agus, MD; Emeritus Professor
University of Pennsylvania School of Medicine.
November 15, 2007
PITTSBURGH, Nov. 15 -- The Health Insurance Portability and Accountability Act (HIPAA), designed to protect patient privacy, has hampered research, adding uncertainty, cost, and delay, according to a national survey of epidemiologists.
Action Points
a.. Explain to interested patients that this study suggests that legislation designed to protect patient privacy may be hindering medical research.
Only a quarter of respondents believed that the privacy rule has enhanced the confidentiality of patient data, and nearly 70% said it has made research more difficult, Roberta B. Ness, M.D., M.P.H., of the University of Pittsburgh, and colleagues reported in the Nov. 14 issue of the Journal of the American Medical Association.
HIPAA, enacted in 1996 and implemented in 2003, was intended to strike a balance between protecting patients' medical information and preserving access to relevant data for legitimate use.
In January 2007, the researchers wrote, the Institute of Medicine commissioned a survey to examine the effect of the HIPAA privacy rule on epidemiological research.
An anonymous, web-based survey formulated by the Joint Policy Committee of the Societies of Epidemiology was distributed to members of 13 epidemiology societies.
Responses from 1,527 professionals were analyzed for influences on research delays, added cost, frequency and type of institutional review board modifications to fulfill privacy rule mandates, level of difficulty obtaining de-identified data and waivers, experiences with multisite studies, and perceived participant privacy benefits under the rule.
Respondents ranked their perceptions of the influence of the privacy rule on 5-point Likert scales.
A total of 875 (67.8%) respondents reported that the privacy rule has made research more difficult at a level of four to five on a Likert scale, in which five indicated a great deal of added cost and time to study completion.
Almost 40% indicated that HIPAA requirements increased research costs in the high range of Likert four to five, and half indicated that the additional time added to complete research projects was high.
Almost half indicated that the privacy rule had affected research related to public health surveillance at a high Likert level.
The perceived benefit of HIPAA with respect to strengthening public trust was reported as high by only 10.5% of respondents, and only 25.9% believed that the privacy rule had enhanced patient confidentiality in the high Likert range.
Respondents also indicated that the proportion of institutional review board applications in which the privacy rule had a negative influence on protection for participants was significantly greater than the proportion in which it had a positive influence (P0.001).
As many as 11.5% of the respondents said they had conceived of a study but had not submitted it for institutional review board approval because they thought they could not obtain approval under the privacy rule.
Among several weaknesses of the survey, the investigators cited the likely bias of researchers, especially those who require access to large volumes of medical records. Also, they said, it was not possible to determine whether the effects reported here resulted from the privacy rule regulations or local review board interpretation of those regulations.
They also acknowledged that survey respondents may have been more biased than epidemiologists in general in that they may have been those who had or perceived themselves to have had difficulties with the privacy rule.
In an accompanying editorial, Norman Fost, M.D. M.P.H., of the University of Wisconsin, and Robert J. Levine, M.D., of Yale, wrote that the regulatory rule for protecting patients in research is increasingly dysfunctional, but said that HIPAA is not "the only or even the most important cause of concern."
The major source of the threat to the system's proper functioning, they wrote, is the increasing pressure to perform tasks that either do not require doing, could be done better by others, or could be done more efficiently using expedited review procedures.
The sources of these problems include the Office for Human Research Protection and the FDA because they appear to threaten institutions with draconian penalties for minor infractions; institutional administrators who act out of fear that their institution could have its entire research operation suspended by "getting caught" in one of these minor infractions; and credentialing and certifying agencies for supporting these excesses by including them in their accreditation criteria.
Resolution will necessarily require participation by federal oversight agencies, institutional officials, representatives of credentialing and certifying agencies, researchers, and research participants, they concluded.
The researchers reported no financial conflicts. The study was supported by a contract from the Institute of Medicine, National Academies.
Drs. Fost and Levine, the editorial writers, reported no financial conflicts. They report that they have each received lifetime achievement awards in recognition of their work in protecting human subjects, including awards from the Office for Human Research Protection. They have a combined experience of 61 years as chairs of IRBs in major academic medical centers.