HIPAA Privacy Rule: Impeding Research and New Cures

As I write this column, the media pundits (and just about anyone with an opinion) are reading the tea leaves, gazing into crystal balls, and studying the tarot cards to predict how the US Supreme Court will rule on the constitutionality of the Affordable Care Act (ACA). Even the National Health Council and 29 leading patient organizations banded together and released a signed statement to show their solidarity for the law.¹

Medical research is increasingly using aggregated information from patient medical records to make key discoveries about the value of treatments, the positive and negative side effects of existing medicines, and the dangerous interactions of drugs and other substances. By using computers to analyze the medical records of thousands of patients, researchers are able to determine what works best for people with similar conditions and symptoms.

The Health Insurance Portability and Accountability Act (HIPAA) includes a set of federal standards, called the HIPAA Privacy Rule, designed to protect the privacy of individuals’ medical records and other personal health information.¹ However, as the Institute of Medicine (IOM) has pointed out, the Privacy Rule duplicates other research protections, sets burdensome requirements that can delay essential research, and could do more to protect the security or privacy of patient records.²

Clearly it is a complex problem that needs to be brought to the attention of policy makers. The first step in finding a workable solution is engaging the patient community and articulating the issue in such a way as to give it saliency. As the

Figure

shows, successful action occurs when the articulated problem, a pragmatic solution, and salient qualities intersect. Only then will the

public be willing to take time out of their busy schedules to bring about change.

The National Health Council commissioned 9 nationwide telephone focus groups to explore patient and caregiver views on the HIPAA Privacy Rule and its ramifications for medical research.³ The focus group study was funded by a grant from the National Institutes of Health, in partnership with the Indiana University Center for Law, Ethics, and Applied Research in Health Information. The 59 participants included adult patients, family caregivers of children with severe chronic physical conditions, and family caregivers of adults with chronic mental conditions that limit their ability to live independently.

Explaining the Problem

Communicating clearly how the HIPAA Privacy Rule impedes records-based research was a challenge. The rule is too complicated for most patients or family caregivers to understand fully when first exposed to it. Because of the complexity of the educating the participants about records-based research before explaining the HIPAA Privacy Rule and its impact.

Most participants had a limited understanding of the intricacies of records-based research that involves investigators conducting computer analysis rather than handson physical exams. The patients and family caregivers were presented at the start of the study with a multi-page document that described the Privacy Rule and its role in health research.

All participants agreed that medical research is essential to advance the discovery of better treatments and cures and were willing to have their own medical records or those of loved ones used in medical research in at least some circumstances. However, even after studying the materials given to them, the patients and family caregivers often confused the Privacy Rule with the HIPAA papers they routinely sign before being treated, such as the consent to treatment form and financial responsibility agreement.

Saliency for Action

Some participants had benefi tted personally from clinical research or knew of examples where research had benefitted family members or friends. Once the issues revolving around the application of the HIPAA Privacy Rule were fully explained, participants were surprised, disappointed, and angry that the presumably well-intentioned rule was impeding the progress of medical research needed for better treatments and cures.

The focus group members agreed the rule—though not all of HIPAA—needs to be changed. For example, participants saw no need for continual reauthorizations. The HIPAA Privacy Rule requires researchers to get a patient’s signature for each specific study, making it difficult to use the data in multi-faceted, long-term research projects. Many participants favored a one-time approval for ongoing use of their records, but some would limit use of their records to a specifi c health condition or for a limited period of time. Most insisted on the deletion of identifying contact information; however, the patients and family caregivers recognized the need to include enough personal and geographical data to make their medical records of use to researchers.

The participants also were shocked and enraged to learn that while the authorization process for their medical records was impeding research, the HIPAA Privacy Rule allows medical records to be used without patient authorization for other reasons, including use by hospitals and providers for marketing purposes.⁴

Advancing Change

The focus group work was not designed to produce an action plan for revising the HIPAA Privacy Rule. What the study did accomplish was to reveal the difficulty of educating patients and family caregivers about a complicatedtechnical problem and expose the passion this community has for changing whatever is impeding the development of new treatments and cures.

Now that this complex issue is being brought to the attention of the health community, all stakeholders—including patients—need to reach a consensus about how to address it. Often our problems choose us, but we do get to choose the solutions that we hope to achieve. In this case, we can achieve success in advancing research for new treatments and cures if we address the problems in the HIPAA Privacy Rule.