History of the Privacy Rule: The Health Insurance Portability and Accountability Act (HIPAA) of 1996 (Public Law 104-191) was enacted to improve the portability and continuity of health insurance; combat waste, fraud, and abuse in health insurance and health care delivery; promote medical savings accounts; improve access to long-term care services and coverage; and simplify the administration of health insurance. The Administrative Simplification “Standards for Privacy of Individually Identifiable Health Information” (the Privacy Rule) arise from this last objective. HIPAA’s Administrative Simplification provisions focus on facilitating the electronic exchange of information for financial and administrative functions related to patient care. However, the very advances that make it easier to transmit information also present challenges to preserving the confidentiality of potentially sensitive personal information contained in medical records. Absent further congressional action, the Secretary of Health and Human Services (HHS) was required by the law to develop standards for protecting such information. Within HHS, the Office for Civil Rights (OCR) is responsible for implementing and enforcing the Privacy Rule. The compliance date for most of those affected by the Rule was April 14, 2003.
Provisions of the Privacy Rule: The Privacy Rule addresses the use and disclosure of health information contained in individual
Privacy Rule affected research. The Panel continues to be concerned about these HIPAA-related barriers, she said. On behalf of the Panel, she asked that IOM conduct a study and recommend changes in HIPAA that would resolve some of these issues. She asked, “How can HIPAA be modified to address the problems for research yet retain the protections for privacy?”
After a brisk discussion among the Forum members, it was decided that this was an important subject that deserved a comprehensive initial exploration with a series of invited speakers at the next meeting of the Forum on June 16, 2006. Several Forum members emphasized that such an exploration, while it should include cancer research, should not be focused exclusively on research of one particular type or involving one particular