HIPAA privacy rule making waves in research circles

Researchers are frustrated by the need to take overly cautious measures to comply with the new federal requirements.

By Joel B. Finkelstein, AMNews staff. July 28, 2003.

Washington -- Medical institutions are finding that federal privacy regulations can be an obstacle to conducting research, not because of what is in the rule, but what is not.

Officials at Johns Hopkins Medical School in Baltimore learned that lesson recently after testing the boundaries of the privacy rule's research provisions. At issue was a letter sent by the school asking the Dept. of Health and Human Services to clarify whether the school could ask patients' permission to review their medical records for research screening.

That letter landed the university in the Baltimore Sun and in a minor entanglement on patient protections. The headline read, "Hopkins seeks patient waiver to privacy rule."

Two days later the Sun published a letter to the editor and a correction to clarify that Hopkins was not asking patients to give up their newfound rights.

But the letter also demonstrates how there is still some confusion about interpreting the privacy rule.

Part of the Health Insurance Portability and Accountability Act, the rule allows researchers within an institution to look at protected health information once the study has been approved by an institutional review board.

The rule does not require patients to be informed, explained Hopkins' general counsel, Joanne Pollack. "We didn't even really need to do this," she said of asking patients' permission.

But required notices on new privacy procedures seem to have increased patient awareness and sensitivity about personal medical information.