HPII Regulatory Alert: Researchers: HIPAA may hurt outcomes studies

Rules affect ability to follow patients post-discharge

University of Michigan (UM) researchers said at the annual scientific session of the American College of Cardiology held March 7-10 in New Orleans that HIPAA has significantly affected their ability to study heart attack patients after they are discharged from the hospital.

Long-term outcome studies are crucial for evaluating medical care, such as the number of patients who die or have complications after surgery or hospitalization. But HIPAA requires written authorization from a patient before he or she can be contacted to gather personal health information for a research study. Before HIPAA, UM researchers used a verbal privacy authorization they obtained when they called patients at home months after they left the hospital.

They reported that when they switched from the verbal OK to a HIPAA-compliant written authorization that had to be mailed to patients and mailed back, there was a significant reduction in the percentage of patients consenting to be called, down from 96.1% to 38.5%. As a result, they said, the consented population was not representative of the entire population of patients the researchers wanted to study, and that could bias the study results.

"On top of the impact on the quality of the data, the costs involved in asking for the written authorization were substantially larger than those for the verbal system," said researcher Eva Kline-Rogers. "To get consent from one patient, we calculated we’d spend $14.50 per patient in the first year of the study for computer, training, staff, administrative, and mailing costs, and $7.50 each year afterward." She says that asking patients for consent while they still are in the hospital to avoid the mailing costs would be labor-intensive and cost-prohibitive.

"The balance between protecting patient privacy, while at the same time we strive to learn about the best methods by which to treat patients after certain types of conditions and/or treatments is delicate," said study senior author Kim Eagle, MD, clinical director of the UM cardiovascular center. "If long-term patient outcomes are to be used to inform’ current care, we must develop better ways of working with patients and regulatory agencies to define the proper balance."

Kline-Rogers said she and her colleagues set out to obtain written consent from heart patients six months after they left the university hospital after being treated for acute coronary syndrome — either a heart attack or unstable angina episode. They got the list of patients retrospectively by reviewing discharge diagnoses for each patient, which is allowed under HIPAA as part of a research study.

Between Sept. 1, 2001, and March 31, 2003, the researchers sent letters and consent forms to the patients, and followed up with phone calls to those who responded to ask questions about their health.

Because the HIPAA compliance mandate was not fully operational at the time of the study, they also were able to call patients who did mail back an authorization form to try to obtain verbal consent.

In addition to the drop in authorizations, researchers found that those who returned the HIPAA-compliant written consent were more likely to be older, married, or to have high blood cholesterol than those who didn’t. They also were less likely to be widowed.

There also was a significant difference in the ability to receive consent from a spouse or authorized relative to obtain information on patients who had died. Some 10% of the patients in the group where contact was made verbally or records were searched had died, vs. 3.3% of the group contacted for written consent.

"HIPAA compliance will challenge researchers, institutions, and ultimately patients as we try to learn about the outcomes of health care while trying to maintain patient privacy," Eagle said.