HIPAA Regulatory Alert: Are HIPAA privacy changes coming?
HIPAA Regulatory Alert
Are HIPAA privacy changes coming?
Many contend privacy rule has had negative impact on human subject research
With studies indicating researchers and the general public have concerns about HIPAA privacy provisions (although not necessarily the same concerns), the Institute of Medicine has convened a committee to look into the issue. That group is expected to make recommendations for possible changes in the law and for greater guidance from the U.S. Department of Health and Human Services to institutional review boards (IRB) or other groups by this summer.
The committee has been meeting for six months, according to University of Pittsburgh School of Public Health epidemiologist Roberta Ness, who made a presentation on her survey of epidemiologists at the committee's October meeting. "We hope that after a thorough consideration of all the issues, the committee will make some recommendations about the legislation, guidance, or both," Ness tells HIPAA Regulatory Alert.
In her presentation to the committee, Ness said the vast majority of clinical scientists surveyed said the HIPAA Privacy Rule has had a substantial, negative influence on conducting human subject research, often adding uncertainty, cost, and delay.
Some 13 epidemiology societies distributed a national web-based survey, which was answered anonymously by 1,527 professionals. Results were published in the Nov. 14, 2007, Journal of the American Medical Association.
Ness says the HIPAA Privacy Rule was intended to strike a balance between protecting the privacy of individually identifiable health information and preserving the legitimate use and disclosure of that information for important social goals. But many researchers have expressed concerns that since its April 2003 implementation, the Privacy Rule has adversely affected the progress of biomedical research.
Survey respondents were asked questions about both positive and negative potential influences of the HIPAA Privacy Rule, including the rule's influence on participant privacy, confidentiality, and public trust, as well as on research procedures.
In giving general perceptions, a majority of respondents reported that the degree to which the rule made research easier was low (84%) and the degree to which it made research more difficult was high (67.8%). Nearly 40% indicated that the Privacy Rule increased research costs in the high range and half said that the additional time added by the rule to complete research projects was high. Almost half said the Privacy Rule had affected research related to public health surveillance at the high level. The perceived benefit of the rule strengthening public trust was reported as high by only 10.5% of respondents and only 25.9% believed the rule had enhanced participant confidentiality/privacy in the high range.
Negative impact on protecting subjects
When asked about the proportion of IRB applications in which the HIPAA Privacy Rule had a positive effect on protecting human subjects and the proportion in which the rule had a negative effect on human subject protection, more respondents indicated that the rule had a negative rather than a positive human subject influence.
Nearly half the respondents reported accessing deidentified data without authorization, and 40.2% indicated they experienced a high level of difficulty. About 40% had attempted to obtain a waiver, and 30.6% reported a high level of difficulty in doing so. Of epidemiologists involved in multi-institutional studies, 76.8% reported the protocols elicited Privacy Rule concerns, and among these protocols, rule concerns resulted in site-specific variability in 39.6%. A minority of respondents (17.3%) knew of covered entities unwilling to do clinical research, and 15% reported an IRB-approved protocol had not been honored by an IRB because of Privacy Rule concerns. Some 11.5% of the responding epidemiologists had conceived of a study but not submitted it to an IRB because they thought they could not obtain approval under the HIPAA Privacy Rule.
Just more than half of respondents identified a particular protocol most affected by the Privacy Rule and were asked to assess specific logistic hurdles and benefits. Ness says the frequency of "most affected" protocols was relatively constant each year from 2003 through 2006. Modifications were necessary in 84.8% of protocols because of Privacy Rule considerations and 37.6% of respondents reported the modifications strengthened confidentiality. At the same time, 67.5% indicated the modifications caused a high increase in recruitment difficulties.
Ness says several themes were evident in the comments. First, researchers expressed frustration and concern that implementing the Privacy Rule had added patient burden without substantially enhancing privacy protection. Second, respondents documented substantial variability among institutions' interpretations of Privacy Rule requirements. Third, respondents voiced concerns that HIPAA slows research progress. Finally, some respondents indicated confusion within governmental agencies about the demarcation between public health surveillance, which is often exempt from the Privacy Rule, and research.
Systemic problems
While questions have been raised about whether adverse effects of the Privacy Rule on human health research represent growing pains associated with implementation rather than a continuing effect, Ness says the survey documented that the frequency of most affected applications has been stable since the rule's implementation. Respondents reported it was often difficult to obtain waivers and deidentified data sets intended to allow access to health information in human subjects research without patient authorization. But, she says, case reports show some better understanding of Privacy Rule restrictions over time. Thus, Privacy Rule implementation triggered several California hospitals to restrict research access to the longstanding rapid case reporting system provided by the California State Cancer Registry. More than a year later, the University of California reversed its stance.
Ness says that inconsistencies among academic institutions in interpreting the Privacy Rule are an important challenge. Survey respondents provided responses widely distributed from "no" to "yes, conditionally" to "yes with no conditions" when asked whether particular case studies would be approved by their IRB. Also, she says, many specific instances of perceived institutional variability were documented in the open response section of the survey, suggesting either that IRBs differ in their responses given to a given protocol or that investigators vary in their perceptions of IRB responses.
She says two concerns not raised in previous research were found in this study. First, only 25% of respondents indicated that the rule enhanced privacy/confidentiality in the high range of the five-point scale used. More globally, respondents perceived that the rule's influence on overall research participant protection is more negative than positive.
Commenting on the role of institutional review boards, Ness says she believes that the fact that this complex law is so often interpreted locally is a problem. "We reported substantial variation in what is and is not acceptable to local IRBs," she says. "That suggests there isn't a uniform interpretation."
However, she adds, some portions of the law are onerous to researchers on their own without being interpreted by an IRB, and thus there is a need for changes to the law as well as for more guidance for IRBs.
Most researchers see negative impacts
When researchers were asked for their "HIPAA stories," some 90% gave negative responses, while only 5% had a neutral story and 5% had a positive story. Among the anecdotal comments, one researcher said that "an already cumbersome patient consent form now has an additional page and a half explaining HIPAA restrictions. This detracts from the informed consent process pertaining to the more critical issue: the actual medical risks and benefits of participating."
Another researcher said that no one argues with the merits of patient protection, but the guidelines "lend considerable variance in interpretation by IRB and other governing boards that may preclude a patient from participating in beneficial research."
And a third clinician said that while research has not been prevented, what the privacy requirement has done is to "slow the research enterprise through its training and compliance elements. I and my staff spend more and more time doing compliance-related things and less and less time doing actual research."
Although the Privacy Rule is intended to protect patients, another presentation at the Institute of Medicine committee's meeting suggested it has not succeeded with that audience either. Columbia University professor of public law and government emeritus Alan Westin, who now is director of the Privacy Consulting Group's health privacy program, reported on his survey of the public regarding health privacy and health research. He said that large majorities of the public continue to hold and apply very strong privacy perspectives in the health area. But the majority also does not believe current law and organizational policies provide enough privacy protection.
Some 40% of consumers said they would want to be notified that researchers want to access their health information and would want to give their consent. And that percentage is significantly higher in some key demographic groups.
[You can contact Roberta Ness at [email protected] or (412) 624-3056. Contact Alan Westin at afwestin@ gmail.com or (201) 836-9152.]
With studies indicating researchers and the general public have concerns about HIPAA privacy provisions (although not necessarily the same concerns), the Institute of Medicine has convened a committee to look into the issue. That group is expected to make recommendations for possible changes in the law and for greater guidance from the U.S. Department of Health and Human Services to institutional review boards (IRB) or other groups by this summer.Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.