HIPAA privacy rule making waves in research circles

Researchers are frustrated by the need to take overly cautious measures to comply with the new federal requirements.

By Joel B. Finkelstein, amednews staff. July 28, 2003.

Washington -- Medical institutions are finding that federal privacy regulations can be an obstacle to conducting research, not because of what is in the rule, but what is not.

Officials at Johns Hopkins Medical School in Baltimore learned that lesson recently after testing the boundaries of the privacy rule's research provisions. At issue was a letter sent by the school asking the Dept. of Health and Human Services to clarify whether the school could ask patients' permission to review their medical records for research screening.

See related content

That letter landed the university in the Baltimore Sun and in a minor entanglement on patient protections. The headline read, "Hopkins seeks patient waiver to privacy rule."

Two days later the Sun published a letter to the editor and a correction to clarify that Hopkins was not asking patients to give up their newfound rights.

But the letter also demonstrates how there is still some confusion about interpreting the privacy rule.

Part of the Health Insurance Portability and Accountability Act, the rule allows researchers within an institution to look at protected health information once the study has been approved by an institutional review board.

The rule does not require patients to be informed, explained Hopkins' general counsel, Joanne Pollack. "We didn't even really need to do this," she said of asking patients' permission.

But required notices on new privacy procedures seem to have increased patient awareness and sensitivity about personal medical information.

In response to a growing number of complaints from patients who had been called by researchers and asked to participate in a study, Hopkins' administrators thought it would be better to ask patients for authorization up front. Before doing so, they sent their letter to HHS seeking clarification to avoid running afoul of the complicated privacy rule.

Better safe than sorry

The letter and ensuing flap highlight the new types of obstacles research institutions are not only facing, but actively trying to avoid.

Institutional review boards are being used extensively as privacy monitors for research projects, said David Korn, MD, senior vice president for biomedical research with the Assn. of American Medical Colleges. They are tending to be very conservative, and perhaps even overly cautious.

This has made research screening more difficult in the new era of the privacy rule.

"The HIPAA rule has a lot of inherent ambiguities, and there are certainly a number [of provisions] in the research area that foster this kind of defensive overreaction, if you will, because better to be safe than sorry," he said.

But Dr. Korn called Hopkins' proposed solution to the problem commendable. "They're saying, 'Look, here's how we think we can best manage this activity, and we want to be clear that it's compliant with the rule and we want you, the compliance entity, to tell us that.' "

And, just as the privacy rule is still open to interpretation, some experts feared the patient authorization that Hopkins is seeking would be as well.

It is written to broadly, said Katherina Kopp, program manager for the Health Privacy Project. It could potentially allow researchers to screen patient records before IRB review and with less documentation than normally required by the rule.

The requirement to document in detail every disclosure of protected health information is a burdensome one that has drawn complaints from many researchers and institutions, Dr. Korn said. If a patient asks for it, a physician has to account for every instance as far back as six years.

"If there are obstacles to research, they need to be addressed," Kopp said. But she advised patience, as it often takes a while before people really understand what is required under a new law.

Dr. Korn agreed that only time will tell. "It's very difficult right now to get a truly valid insight into how bad this situation will be once the initial shakeout period goes by.

"This rule is very encompassing, very prescriptive and deals with a host of issues," he said. "It's possible that many of the institutions may have gone a bit overboard in developing policies and processes to ensure that they would be compliant."