Beyond the HIPAA Privacy Rule Enhancing Privacy, Improving Health Through Research (2009) / Chapter Skim
Currently Skimming:
5 Effect of the HIPAA Privacy Rule on Health Research
5 Effect of the HIPAA Privacy Rule on Health Research
Pages 199-244
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 199... ...
Many issues identified by survey respondents were also the focus of other types of studies, so the remainder of the chapter consists of a topical review of the available evidence regarding the effect of the Privacy Rule, and its interpretation, on health research. The following issues are reviewed in detail: (1)
|
From page 200... ...
. Surveys to gauge the impact of the HIPAA Privacy Rule on health research have been undertaken by numerous agencies and organizations with various constituencies, including the Association of American Medical Colleges (NCVHS, 2003)
|
From page 201... ...
• The Privacy Rule has made recruitment of research participants more dif ficult and has increased the likelihood of selection bias (AAMC, AHRQ, Ness, AcademyHealth, AHA/ACC, AAHC) • The Privacy Rule has increased research participants' confusion regarding their rights and protections (NCAB, Ness, HMORN)
|
From page 202... ...
Advisory Board center directors, clinical cooperative group chairs, and principal investigators of Special Programs of Research Excellence Agency for Healthcare 2004 16 health services researchers, and 17 77% (33/43) Research and Quality privacy officers, research compliance officers, and IRB directors National Survey of 2007 Professional members of 13 1,527 respondentsc Epidemiologists epidemiological societies HMO Research 2008 Scientists working in the 15 43% (89/235)
|
From page 203... ...
interviewed 33 senior health care researchers, privacy officers, research compliance officers, and IRB directors representing a variety of health settings in 18 states that covered all regions of the United States. With a 77 percent response rate, 92 percent of respondents reported an impact of the Privacy Rule on health research.
|
From page 204... ...
many government agencies are confused about the demarcation between public health surveillance, which is exempt from the Privacy Rule, and health research. Finally, the survey found that many respondents believed the Privacy Rule added to research costs, caused delays to research projects, and made recruitment of research participants much more difficult (Ness, 2007)
|
From page 205... ...
Respondents reported numerous difficulties with conducting health research since the implementation of the Privacy Rule, including increased time required to conduct research, problems with gaining IRB approval for studies, impediments to multicenter research, confusion over the autho rization process, and problems with the use of deidentified data. Of the investigators who responded, 74 percent reported having a study affected by the Privacy Rule.
|
From page 206... ...
A majority -- 63 percent -- of the respondents reported that the Privacy Rule provides protection to individuals at the expense of access to research data; 28 percent reported that the Privacy Rule strikes the right balance between these two goods; and only 1 percent reported that the Privacy Rule provides access to research data at the expense of privacy protection for individuals (Figure 5-2) (Helms, 2008)
|
From page 207... ...
Only 22 percent of respondents reported that the Privacy Rule increased public trust in research, 44 percent reported that it increased confidentiality, 9 percent reported that it decreased privacy breaches, and 14 percent reported that patients' privacy was better protected than before the Privacy Rule. Respondents also indicated that the Privacy Rule had a negative impact on research recruitment, the IRB approval process, the cost and time to conduct research, multicenter research, and the use of deidentified information (Ring, 2007)
|
From page 208... ...
organized focus groups in fall 2007 at five institutions to examine researchers' experiences operating under the HIPAA Privacy Rule. Each focus group included both
|
From page 209... ...
Respondents indicated that the complicated and lengthy authorization forms required by the Privacy Rule create an impediment to subject recruitment. Also, 42 percent of respondents reported that many small health care entities and other entities serving disadvantaged populations are not participating in research because of an inability to meet all of the Privacy Rule requirements.
|
From page 210... ...
at Virginia Commonwealth University studied the effect of requiring patients to give consent on the demographics of research participants at an urban family practice center. Patients were recruited to complete the Health Assessment Survey (HAS)
|
From page 211... ...
studied a Minnesota law that required patient-informed consent before medical records were permitted to be used by researchers. In this pharmacoepidemiologic study, 73 of 140 potential research participants responded to a request for informed consent, with 26 of the potential research participants authorizing the use of their medical records for the study, and 47 declining.
|
From page 212... ...
This study found that a smaller percentage of potential research participants participated under the opt-in methodology (47 percent) compared to the opt-out methodology (67 percent)
|
From page 213... ...
Simplifying the authorization form likely minimized the effect of requiring patient authorization on potential research participants' willingness to participate in a study. However, as will be discussed below in the chapter section on the authorization process, a majority of covered entities require lengthy and highly legalistic authorization forms.
|
From page 214... ...
. The researchers recorded the reasons that potential research participants gave for declining to participate in the study.
|
From page 215... ...
The national survey of epidemiologists found that most respondents believe the Privacy Rule increased the cost and time of conducting health research. In this survey, 90 percent of the respondents reported an increase in resource expenditure, with 40 percent indicating that the Privacy Rule increased research costs a great deal (i.e., 4–5 on the Likert scale)
|
From page 216... ...
. In the NAACCR survey of cancer registries, 68 percent of respondents reported that the Privacy Rule delayed a research project or caused it to take longer than it would have
|
From page 217... ...
It is important to note that these studies are site specific and depend on how institutions interpret and implement the Privacy Rule. A recent letter to the editor of Anesthesiology reported on the amount of research staff hours spent per month on recruitment and follow-up activities in a randomized clinical trial at the University of Pittsburgh, before and after the Privacy Rule went into effect.
|
From page 218... ...
Several recruitment methods were used throughout this clinical trial, depending on the phase of HIPAA implementation. Before the Privacy Rule was implemented, potential research participants were directly approached by research assistants for informed consent.
|
From page 219... ...
No authorization 55.0% of potential research subjects participated Authorization 39.8% of potential research subjects participated Dunlop and Colleagues: HIPAA Authorization and Willingness to Participate (2007) No authorization 39% of potential research subjects participated Authorization 27% of potential research subjects participated SOURCES: Beebe et al.
|
From page 220... ...
The Beebe study found that the percentage of potential research participants willing to participate declined when HIPAA authorization was required at the Mayo Clinic College of Medicine. More than half -- 55 percent -- of potential research participants participated in the study when authorization was not required, but only 39.8 percent of potential research participants took part if they were required to complete an authorization form (Beebe et al., 2007)
|
From page 221... ...
IRB Approval Recent surveys provide evidence that the Privacy Rule, or its interpretation, has reduced the efficiency of health research by affecting researchers' ability to move a study through the IRB approval process. In the AHRQ survey, 94 percent of respondents stated that the Privacy Rule impacted the design and conduct of health services research.
|
From page 222... ...
. The AHA/ACC survey also found that 67 percent of respondents reported that the IRB submission process was made more complex by the Privacy Rule (Ring, 2007)
|
From page 223... ...
In the national survey of epidemiologists, 40 percent of respondents reported that they had attempted to obtain a waiver of authorization under the Privacy Rule. Of these researchers, 31 percent reported a high level of difficulty in obtaining a waiver (4–5 on the Likert scale)
|
From page 224... ...
. Only a small portion of respondents reported doing health research studies that involved direct human contact; 9 percent reported conducting research that required the collection of specimens, and 5 percent reported conducting research on existing specimens.
|
From page 225... ...
Only 9 percent of the respondents reported that the same waiver was used at all sites, and 6 percent reported the waivers were required from more than one, but not all, sites. Three percent of the respondents reported that they were unable to proceed with a multisite study because they were unable to resolve disagreement among sites (Helms, 2008)
|
From page 226... ...
10 0 Don't No Yes know FIGURE 5-5 HMO Research Network Survey of Researchers: Multisite research. NOTE: HIPAA = Health Insurance Portability and Accountability Act; IRB = Insti Figure 5-5.eps tutional Review Board.
|
From page 227... ...
Significant differences in approval times were seen across the different covered entities. The researchers recognized they could not conclusively attribute the hospitals' refusals to participate in the study and the long IRB review processes to the Privacy Rule itself.
|
From page 228... ...
Of the respondents who reported that they have used an existing dataset to conduct research, 28 percent indicated that they had to develop a business associate relationship with the covered entity to gain access to the dataset. Another 14 percent reported use of an intermediary organization that had a business associate relationship with the covered entity to gain access to an existing dataset (Helms, 2008)
|
From page 229... ...
Documenting something that did not happen (i.e., an abandoned study) is more challenging than measuring something that did happen (e.g., selection bias, increased inefficiency)
|
From page 230... ...
. In the AcademyHealth survey, 13 percent of respondents reported that an IRB or Privacy Board has prevented a study in which they were involved from moving forward due to the IRB or Privacy Board's concern about violating the Privacy Rule.
|
From page 231... ...
In the national survey of epidemiologists, half of the respondents reported accessing deidentified information since the Privacy Rule was implemented. Of this half, 40 percent reported a high level of difficulty in gaining access to this deidentified information (i.e., 4–5 on the Likert scale)
|
From page 232... ...
In this survey, 62 percent of the respondents reported that the use of deidentified data had a negative impact on research, 38 percent reported that the removal of the required
|
From page 233... ...
Researchers report that many IRBs and Privacy Boards require lengthy and complex wording to describe the authorization within consent forms. They claim that the extra language added to consent forms is confusing to research participants, burdens the informed consent process, and undermines research recruitment (AAHC, 2008; Shalowitz and Wendler, 2006)
|
From page 234... ...
adult population reads at or below the eighth-grade level. A large percentage of potential research participants are likely unable to comprehend much of the information contained in authorization forms.
|
From page 235... ...
However, 26 percent of respondents reported that concerns about penalties have impeded access to data -- 16 percent reported that fear of penalties has prevented covered entities from providing data to researchers, and 10 percent reported that covered entities' concerns about data privacy caused them to forego research activities. Nearly 30 percent of respondents were unsure what impact, if any, penalties have had on efforts to obtain data from covered entities (Helms, 2008)
|
From page 236... ...
, waiver of authorization form, data use agreements, and business associate agreements would make it easier for investigators to appropriately design research projects and put institutions at ease about decisions their IRBs and Privacy Boards make with regard to privacy concerns. This endeavor could perhaps be accomplished as an activity of the National Institutes of Health (NIH)
|
From page 237... ...
. Institutions might be less inclined to be overly conservative in interpreting the Privacy Rule if this were stated more clearly BOX 5-2 Public Responsibility in Medicine and Research (PRIM&R)
|
From page 238... ...
In addition, some limited protection against civil suits brought pursuant to federal or state law for members of IRBs and Privacy Boards for decisions made within the scope of their responsibilities under the Privacy Rule and the Common Rule could be beneficial. This limited protection should not include protection for willful and wanton misconduct in reviewing the research.
|
From page 239... ...
Current guidance from HHS addresses only what is permissible under the HIPAA Privacy Rule; the guidance does not identify best practices. A dynamic, ongoing process for the identification and dissemination of best practices in privacy protection for various types of health research by HHS would facilitate reviews by IRBs and Privacy Boards and would lead to more consistent and appropriate decisions.
|
From page 240... ...
Another potential way to reduce inconsistency and overly conservative interpretation would be to provide some limited legal protection for IRB and Privacy Board members, who may be fearful of lawsuits pertaining to IRB/Privacy Board decisions. The committee recommends that HHS -- or, as necessary, Congress -- provide reasonable protection against civil suits brought pursuant to federal or state law for members of IRBs and Privacy Boards for decisions made within the scope of their responsibilities under the HIPAA Privacy Rule and the Common Rule.
|
From page 241... ...
. PowerPoint presentation to the Institute of Medicine Com mittee on Health Research and the Privacy of Health Information: The HIPAA Privacy Rule, on the AcademyHealth survey results.
|
From page 242... ...
. PowerPoint presentation to the Institute of Medicine Committee on Health Research and the Privacy of Health Information: The HIPAA Privacy Rule, on the American Heart Association survey results.
|
From page 243... ...
2005. Impact of the HIPAA Privacy Rule on health services research.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.