Background

The primary justification for including research provisions in the HIPAA Privacy Rule was to remedy perceived shortcomings of federal privacy protections in health research under the Common Rule, but the HIPAA Privacy Rule has numerous limitations of its own. In proposing the Privacy Rule, HHS acknowledged that, ideally, it would have preferred to regulate health researchers directly by extending the protections of the Common Rule to research that is not federally supported and by imposing additional criteria for the waiver of patient authorization for the use of personally identifiable health information in research.¹⁷ But HHS recognized that it did not have the authority to do this. For that reason, HHS attempted to protect the health information released to researchers indirectly (but within the scope of its limited authority) by imposing restrictions on information disclosures by covered entities. The National Committee on Vital and Health Statistics (NCVHS) and others have noted the limitations of the HIPAA Privacy Rule and have called for stronger protections of health privacy—notably, by expanding the purview of the Privacy Rule beyond the current covered entities.

The IOM committee believes an even bolder change is needed. The number of studies using medical records to address important questions about health and disease is likely to increase with the growing availability of electronic records. As the volume and importance of digital personal health data increase exponentially, the public can be expected to heighten demands for a legal framework that provides meaningful safeguards to protect personally identifiable health information in the health research setting. Thus, the IOM committee recommends developing a new framework to both protect individuals’ privacy and facilitate responsible and beneficial health research.

Recommendation I: Congress should authorize HHS and other relevant federal agencies to develop a new approach to protecting privacy in health research that would apply uniformly to all health research. When this new approach is implemented, HHS should exempt health research from the HIPAA Privacy Rule. The new approach should enhance privacy protections through improved data security, increased transparency of activities and policies, and greater accountability while also allowing important health research to be undertaken with appropriate oversight. The new approach should do all of the following:

• Apply to any person, institution, or organization conducting health research in the United States, regardless of the source of data or funding.
• Entail clear, goal-oriented, rather than prescriptive, regulations.
• Require researchers, institutions, and organizations that store health data to establish strong data security safeguards.
• Make a clear distinction between the privacy considerations that apply to interventional research and research that is exclusively information based.
• Facilitate greater use of data with direct identifiers removed in health research, and implement legal sanctions to prohibit unauthor ized reidentification of information that has had direct identifiers removed.
• Require ethical oversight of research when personally identifiable health information is used without informed consent. HHS should develop best practices for oversight that should consider:
  • Measures taken to protect the privacy, security, and confiden tiality of the data;
  • Potential harms that could result from disclosure of the data; and
  • Potential public benefits of the research.
• Certify institutions that have policies and practices in place to pro tect data privacy and security in order to facilitate important large- scale information-based research for clearly defined and approved purposes, without individual consent.
• Include federal oversight and enforcement to ensure regulatory compliance.

Rationale

The committee concluded that the HIPAA Privacy Rule impedes important health research and does not protect privacy as well as it should. Rather than offering an effective and comprehensive approach to solving the real problems of protecting privacy while ensuring the vitality of the national research agenda, the Privacy Rule often focuses on formalistic issues. A new approach to protecting the privacy of personally identifiable information used in health research should both provide strong and effective protection for often-sensitive personally identifiable health information and facilitate scientific discovery and medical innovation necessary to save lives and enhance the quality of the public’s health. It should do so in a way that does not burden individuals with a flurry of health privacy notices and consent forms, or burden our health care system with a new level of bureaucracy and expense.

A new framework developed by HHS and other relevant agencies that emphasizes privacy, security, accountability, and transparency and is applicable to all health research in the United States would eliminate confusion, reduce variability, facilitate responsible research, and enhance trust in the research enterprise. Clear and simple regulations that are less subject to varying interpretation by ethical oversight boards, as well as federal oversight and enforcement of regulatory compliance, will be important to consistently and efficiently ensure privacy and instill trust while enabling important research.

The committee favors an approach in which both ethical health research and privacy protections are supported. Informative examples for such an approach include Ontario’s Personal Health Information Protection Act (PHIPA)¹⁸ and a similar model recently proposed in the United Kingdom.¹⁹ Ontario’s PHIPA shares a number of similarities with the HIPAA Privacy Rule. In general, both rules require the holder of personally identifiable health data to obtain informed consent (referred to as authorization in the Privacy Rule) before using those data for a purpose other than providing services directly related to the health care of the patient. If a researcher wishes to use personally identifiable health data without obtaining informed consent, both rules require the researcher to obtain a waiver of informed consent approved by an independent ethics board before the study begins.

However, the HIPAA Privacy Rule and PHIPA do have some key differences. One major difference is that unlike the HIPAA Privacy Rule, which applies privacy obligations unevenly across the health care sector, PHIPA applies to health information custodians (HICs; e.g., providers, hospitals, and pharmacies) that collect, use, and disclose personally identifiable health information, as well as to non-HICs that receive personally identifiable health information from a HIC. Thus, the privacy protections follow the data.

Another important difference is that PHIPA permits HICs to disclose personally identifiable health information without consent to “prescribed persons or entities,” who must have in place practices, policies, and procedures approved by Ontario’s Information and Privacy Commissioner to protect the privacy and confidentiality of personally identifiable health information it receives and maintains. The prescribed persons or entities may then disclose information to researchers either in deidentified form, or in identifiable form with approval of a Research Ethics Board (Canadian equivalent of an IRB or Privacy Board). Consistent with the principle of transparency, a prescribed entity must also make public a description of its functions and a summary of its practices, policies, and procedures. A similar approach to prescribed entities was recommended in a report commissioned by the United Kingdom’s Prime Minister on secondary uses of personal information. This report suggested the creation of “safe harbors,” which have three defining characteristics: (1) they provide a secure environment for processing personally identifiable health data, (2) they are restricted to “approved researchers” who meet relevant criteria, and (3) they implement penalties and allow for criminal sanctions against researchers who abuse their access to personally identifiable data. The committee believes that such an approach, combined with strong security measures, offers adequate privacy protections for personally identifiable health information in information-based health research, while greatly expanding research opportunities.

Health research increasingly relies on the review of information about patients’ actual experiences with treatments to determine the risks and benefits of drugs and other therapies, in addition to traditional interventional and comparative clinical trials with patients. Regulations under a new approach to ensuring privacy in health should acknowledge the fact that research based exclusively on information (e.g., using medical records or stored biological samples) is not the same as direct, interventional human subjects research. For that reason, applying the same human subjects protections in these two different scenarios is neither appropriate nor justifiable. Promoting individual autonomy is essential when a person’s health care or participation in clinical research is considered. The purpose of informed consent in this type of research is mainly to protect research participants from physical harm by providing a description of the potential risks and benefits of the study. In contrast, in information-based research that relies solely on medical records and stored biospecimens, the research participant faces no risk of direct physical harm. In this context, informed consent (authorization) is intended to ensure that individuals are able to exercise control over their personal information that is held by third parties, and to give individuals the right to determine whether their personal information can be used in a particular research project (or a series of such projects, if consent for future research is permitted).

Because of these fundamental differences between information-based research and direct, interventional human subjects research, the committee suggests a two-part practical approach to protecting health information privacy. First, all interventional research, regardless of funding source and support, should be required to comply with the Common Rule and all researchers who gain access to personally identifiable health information as part of the interventional research should be required to protect that information with strong security measures. Research participants should be allowed to provide consent for future research uses of data and biological materials collected as part of the interventional study as long as an IRB reviews and approves the future uses, ensuring that the new study is not incompatible with the original consent.

Second, a new approach to uniform, goal-oriented oversight of information-based research should be developed by HHS and other relevant federal agencies, with a focus on best practices in privacy, security, and transparency as in PHIPA and the proposed United Kingdom model. This new approach should include a mechanism by which some programs or institutions could be certified by HHS or another accrediting body, similar to a prescribed entity as in PHIPA or a safe harbor as in the United Kingdom model. Such entities could then collect and analyze personally identifiable health information for clearly defined and approved purposes, without individual consent. Because of the administrative requirements in becoming certified, this option is most appropriate for disease registries and other very large scale research databases. Certified entities could also aggregate personally identifiable data from multiple sources, and then provide data to researchers with direct identifiers removed, under strict security requirements. This would facilitate greater use of data with direct identifiers removed in research because the aggregated datasets would be more complete and thus would lead to more accurate conclusions. To further protect privacy, unauthorized reidentification of information that has had direct identifiers removed should be prohibited by law, and violators should face legal sanctions.

In cases where researchers cannot use data with direct identifiers removed, and personally identifiable health information is needed for research, approval and oversight by an ethics oversight board should be required, partially analogous to what is now done under the HIPAA Privacy Rule and PHIPA. This oversight board could perhaps entail a new body specifically formulated to review medical records research, rather than relying on traditional IRBs that were created to review interventional research. If researchers seek a waiver of patient consent, an ethics oversight board should consider the measures to be taken to protect the privacy and confidentiality of the data, the potential harms that could result from disclosure of the data, and the potential public benefits of the proposed research study. In order to facilitate consistent application of this option, HHS will need to develop clear guidance and best practices on how to assess the potential harm, the proposed measures to protect privacy and confidentiality, and the potential public benefits of a research study, as has been done under PHIPA.

There is a great deal of variability in whether and how IRBs and other ethical oversight boards consider the public benefit and scientific merit of research proposals. But the first rule of ethical research is that the research must have scientific value—meaning that it addresses an important question of human health and is designed and conducted using methodology that is appropriate and rigorous. The scientific merit of research varies by project, just as the potential risk to privacy of research varies across different protocols. The committee believes that when making decisions about whether a research protocol that entails the disclosure of personally identifiable information should go forward, ethical oversight boards should take all of these factors—potential risks/harms to research participants’ privacy as well as scientific merit and potential public benefit of the research proposal—into consideration.

A previous IOM committee on Assessing the System for Protecting Human Research Subjects recommended that “human research participant protection programs” use distinct mechanisms for initial reviews of scientific merit and that these reviews should precede and inform the comprehensive ethical review of research studies. Ethical oversight board members themselves may not have the expertise to assess the merit of diverse research studies, but they should have access to evaluations by scientific review committees or funder peer review panels, which would help them assess the anticipated benefits of a proposed research project.

Although expectations regarding privacy vary among different demographic groups, public opinion polls suggest that a significant portion of the American public would like to control all access to their medical records for research via an individual consent mechanism. However, obligations to implement comprehensive privacy protections—such as security, transparency, and accountability—are independent of patient consent. Moreover, the committee concluded, based on considerable testimony and other evidence, that a universal requirement for informed consent can lead to invalid results because of significant differences between patients who do or do not grant consent, and to missed opportunities to advance medical science because it can be prohibitively costly and difficult to obtain consent for studies that require analysis of very large datasets. As a result, the committee’s new framework includes two alternatives to consent that can be used in certain circumstances (e.g., disclosure to a certified entity and waiver of informed consent by an ethics review board), which are intended to facilitate research that is socially beneficial and to protect privacy through increased security, transparency, and accountability.

If society seeks to derive the benefits of medical research in the form of improved health and health care, information should be shared to achieve that greater good, and governing regulations should support the use of such information, with appropriate oversight. In the committee’s proposed new framework, the greater emphasis on ensuring the security protections of personally identifiable health information, facilitating research using data with direct identifiers removed, and ensuring the scientific merits of any proposed research in the new framework should help to foster its acceptability. Nonetheless, effective communication with the public about how health research is done and the value it provides (the committee’s Recommendation III.C below) will be important to address concerns and gain acceptance.

The committee’s proposal for a new approach to ensuring privacy in health research that is uniformly applicable to all health research in the United States is especially timely because Congress has shown considerable interest in producing new legislation to facilitate the implementation of a nationwide health information technology system. Such a system has been hailed as a means of addressing rising health care costs and improving the quality and efficiency of health care, but privacy concerns are emerging as a primary obstacle to the implementation of such a nationwide system. Some legislative proposals would follow the HIPAA model of privacy protections, while others would require different or additional approaches to ensure the privacy of electronic health records. A nationwide health information technology system has the potential to accelerate health research by making large amounts of health data available to study and thus could lead to major advances in medicine. Nevertheless, caution is warranted in developing new regulations because the adoption of new, restrictive regulations might actually impede health research, to the great detriment of patients and society.

If Recommendation I is not implemented and the nation continues to rely on the HIPAA Privacy Rule for protecting privacy in health research, the committee proposes an alternative set of recommendations (Recommendations II.A–C) that could address some of the problems uncovered during the course of this study, by improving the HIPAA Privacy Rule and associated guidance.

Background

One of the weaknesses in the current privacy protection system is that there is extreme variability in the regulatory interpretations and approval decisions among IRBs and Privacy Boards. Regulatory language often is not easily understandable and is subject to wide interpretation. Thus local IRBs and Privacy Boards interpret state and federal regulations independently, resulting in a great deal of variation in how the regulations are implemented. For example, projects that are similar in design and intent may be granted a waiver of individual authorization by some IRBs and Privacy Boards, but not others, on the basis of differing interpretations of the Privacy Rule’s waiver criteria. In addition, some IRBs and Privacy Boards may conflate the Common Rule and Privacy Rule, or apply the research provisions of the Privacy Rule to activities for which they are not applicable, such as public health practice or the operation of cancer registries.

Furthermore, in the case of the HIPAA Privacy Rule, covered entities that disclose PHI are regulated, not the health researchers who receive the information. As a result, covered entities, as well as IRBs and Privacy Boards, may be reluctant to permit disclosures of PHI that would allow health research to go forward, even in situations where it is ethically and legally justified. Lacking sufficient guidance from HHS, IRBs and Privacy Boards sometimes interpret the HIPAA Privacy Rule too conservatively out of concern that a particular health research activity might result in institutional noncompliance with the Privacy Rule.

HHS intended to allow IRBs and Privacy Boards to have some local control in implementing and interpreting the HIPAA Privacy Rule as it applies to the use and disclosure of PHI for research. The committee’s recommendations below are intended not to reduce the decision-making powers and flexibility of local IRBs and Privacy Boards, but rather to make it easier for IRBs and Privacy Boards to review research proposals fairly and quickly. Additional guidance and clarification from HHS on the specific points listed below, along with specific case examples to help delineate what is or is not permissible under the Privacy Rule, would make it easier for IRBs and Privacy Boards to make the appropriate review decisions.

Recommendation II.A.1: HHS should develop a dynamic, ongoing process to increase empirical knowledge about current “best practices” for privacy protection in responsible research using PHI, and promote use of those best practices.

• HHS should regularly convene consensus development conferences in collaboration with health research stakeholders to collect and evaluate current practices in privacy protection in order to identify and disseminate best practices.
• Stakeholders can then enable and encourage researchers to use these best practices in designing and conducting research involving the use of PHI.

Rationale

There are many diverse approaches to health research. The broad array of methods and data sources for such research presents a challenge to IRBs and Privacy Boards that must determine how various state and federal regulations apply to each research protocol. Uncertainty about how the various regulations apply to a given protocol can lead to overly conservative decisions by these boards, making it more difficult for some important health research to go forward. For example, some covered entities misinterpret the Privacy Rule by requiring researchers to obtain authorization from next of kin in order to access the PHI of decedents, which is not required under the provisions. Such factors contribute to the tremendous variability in the decisions made by IRBs and Privacy Boards.

Current guidance from HHS addresses only what is permissible under the HIPAA Privacy Rule; the guidance does not identify best practices. A dynamic, ongoing process for the identification and dissemination of best practices in privacy protection for various types of health research by HHS would facilitate reviews by IRBs and Privacy Boards and lead to more consistent and appropriate decisions. HHS guidance materials with best practices and models or templates for things such as the patient authorization form, waiver of authorization form, data use agreements, and business associate agreements would make it easier for investigators to appropriately design research projects and put institutions at ease about decisions their IRBs and Privacy Boards make with regard to privacy concerns. Such guidance materials should be written as clearly and simply as possible, using an inclusive, dynamic, and transparent development process, and should override all prior guidance documents.

The committee believes that a proactive role by HHS in disseminating guidance changes to IRBs and Privacy Boards is essential. This endeavor could perhaps be accomplished as an activity of the National Institutes of Health Roadmap for Medical Research under the direction of the HHS Office for Civil Rights. An informative precedent for the dissemination efforts might be the Health Resources and Services Administration’s development of the National Practitioner Data Bank (NPDB) Guidebook,²⁰ an activity established through Title IV of the Healthcare Quality Improvement Act of 1986. The NPDB Guidebook, which is frequently updated, provides many case examples of what should be done in various situations.

Stakeholders—including researchers; research institutions, IRBs, and Privacy Boards; sponsors of research; public health practitioners and agencies; patient and consumer organizations; and privacy experts—could have considerable influence on the adoption of best practices once they have been identified, so they could help to make privacy protections and IRB/Privacy Board decisions more uniform. For example, Requests for Proposals and other funding mechanisms could be more instructive on the requirements for the protection of privacy.

Many academic researchers depend on their ability to procure funding from a source external to their institutions, and research sponsors have obligations to protect research participants. Thus, major nonfederal funders of health research could be a powerful force for adherence to ethical guidelines even in the absence of strong federal regulations and enforcement. Organizations whose primary missions are focused on promoting responsible and ethical research—such as PRIM&R (Public Responsibility in Medicine and Research) and the Association for the Accreditation of Human Research Protection Programs, Inc., which serve as primary educational vehicles for IRB professionals and offer certification programs—could also contribute much to this dynamic and ongoing process. Increased participation in these organizations by research investigators in particular could extend understanding of regulatory requirements and foster national discourse about issues of interpretation and application of the HIPAA Privacy Rule.

Recommendation II.A.2: HHS should encourage greater use of partially deidentified data called “limited datasets” and develop clear guidance on how to set up and comply with the associated data use agreements more efficiently and effectively, in order to enhance privacy in research by expanding use and usability of data with direct identifiers removed.

Rationale

The HIPAA Privacy Rule and the Common Rule both exempt from their provisions research using health data from which personal identifiers have been removed. Because the two rules define personally identifiable information and deidentification differently, however, there is a discrepancy between what research involving existing data is exempt from the Common Rule and what research is exempt from the Privacy Rule.

The standard for deidentification as defined in the Common Rule is that the identity of the subject may not be readily ascertained by the health researcher (e.g., “anonymized” datasets with no direct identifiers included).²¹ Thus, health research using information recorded in such a manner that subjects cannot be readily identified is exempt from the Common Rule.²²

Under the HIPAA Privacy Rule, there are two ways to deidentify health information so that it is exempt from the Privacy Rule. One is to remove 18 specified identifiers that identify or could provide a reasonable basis to identify an individual, including both direct identifiers (e.g., name, address, medical records number, Social Security number, health plan beneficiary number) and indirect identifiers (e.g., dates of service and geographic subdivisions smaller than a state).²³ The second way is to have a qualified statistician determine that the risk is very small that any identifiers present on a given data file could be used alone, or in combination with other available information, to identify an individual.²⁴

This discrepancy between deidentification standards under the two rules can give rise to situations in which research with anonymized data that is exempt from IRB oversight under the Common Rule may still require a decision by an IRB or a Privacy Board to determine if a waiver of individuals’ authorization of disclosure for the use of their information for research purposes is appropriate under the Privacy Rule. However, IRBs have not had to review these protocols in the past, and they may have difficulty in making appropriate decisions about waivers.

The HIPAA Privacy Rule’s restrictions put greater emphasis on the possibility that deidentified health data could be reidentified using publicly available databases. Record linkage technology has advanced rapidly in the past 10 years, making reidentification of data easier now than when the Common Rule was implemented. Yet many researchers maintain that removing all 18 data categories required by the HIPAA Privacy Rule can render a dataset unusable for research. Several organizations—including the Secretary’s Advisory Committee on Human Research Protections (SACHRP), NCVHS, and the Association of American Medical Colleges—have recommended changing the HIPAA Privacy Rule to reduce the number of identifiers that must be removed for a dataset to be considered deidentified and thus exempt from IRB and Privacy Board oversight if used in health research. Some elements of the 18 identifiers (e.g., ZIP Codes, geographic subdivisions, and dates of service or tissue collection) do not directly identify individuals, and are essential for some types of health research, such as epidemiology or studies of disease incidence.

In 2002, in response to the concerns that had been raised, HHS modified the HIPAA Privacy Rule to create a category of partially deidentified data called the “limited dataset,” in which health information that is stripped of the 16 most direct identifiers can be used and disclosed for research without obtaining individuals’ authorization or an IRB/Privacy Board waiver if the covered entity enters into a data use agreement (DUA) with the recipient of the data.²⁵ Geographic subdivisions (other than street addresses) and dates and other numbers, characteristics, or codes not listed as direct identifiers in the regulation can be included in a limited dataset, making it more useful for research.

Currently, however, there is pervasive confusion regarding the conditions of DUAs and how recipients may meet those conditions. As a result, in some health care settings, the burden of establishing a DUA prevents research from going forward. However, at the other extreme, some covered entities sign DUAs as a matter of course, providing little meaningful privacy protection to the patient. The committee recommends that HHS ameliorate this situation by issuing clear guidance on how to set up and comply with data use agreements more efficiently and effectively, with a goal-oriented focus on the safeguards that researchers should use to protect individuals’ privacy.

Recommendation II.A.3: HHS should clarify the distinctions between “research” and “practice” to ensure appropriate IRB and Privacy Board oversight of PHI disclosures for these activities.

• HHS should consult with relevant stakeholders to develop standard criteria for IRBs and Privacy Boards to use when making distinctions between health research and related endeavors such as public health practice and quality improvement practices. These criteria should be evaluated regularly by HHS to ensure that the criteria are helpful and producing the desired outcomes.

Rationale

The HIPAA Privacy Rule makes a somewhat artificial distinction between health research and some closely related activities, such as public health and quality improvement activities, which also may involve collection and analysis of PHI. Under the Privacy Rule (as well as the Common Rule), these activities, which aim to protect the public’s health and improve the quality of patient care, are considered health care “practice” rather than health research.

HHS considered public health and quality improvement activities important enough to give them special status under federal regulations by permitting them to be undertaken without authorization or an IRB/Privacy Board waiver of authorization. Yet it can be a challenge for IRBs and Privacy Boards, researchers, health care practitioners, and research participants to distinguish among activities that are or are not subject to the various provisions of the Privacy Rule (and the Common Rule). Inappropriate decisions may prevent important activities from being undertaken or could potentially allow disclosures of PHI that are not permitted under the regulations.

A number of models outlining the criteria IRBs and Privacy Boards should use to distinguish practice and research have been proposed to address these difficulties. One recent model, for example, provides a detailed checklist for IRBs and Privacy Boards to use in determining whether an activity is (1) public health “research” that must comply with the research provisions of the Privacy Rule, or (2) public health “practice” that does not need IRB or Privacy Board review.²⁶

The committee believes that standardizing the criteria is essential to support the conduct of these important health care activities. For that reason, the committee recommends that HHS convene the relevant stakeholders to develop standard criteria for IRBs and Privacy Boards to use when making decisions about whether protocols entail research or prac tice, using the available models above as examples. The regulation should have enough flexibility to allow important activities to go forward with appropriate levels of oversight. In addition, it will be important to evaluate whether these criteria are effective in aiding IRB/Privacy Board reviews of proposed protocols and whether they lead to appropriate IRB/Privacy Board decisions.

Recommendation II.A.4: HHS guidance documents should simplify the HIPAA Privacy Rule’s provisions regarding the use of PHI in activi ties preparatory to research and harmonize those provisions with the Common Rule, in order to facilitate appropriate IRB and Privacy Board oversight of identification and recruitment of potential research participants.

Rationale

Many research studies, especially those focused on rare conditions with limited eligible patient populations, rely on large-scale medical chart reviews and searches of patient databases to identify patients who might be eligible for and might benefit from a particular study. Sufficient patient enrollment in a timely fashion is essential to ensure the meaningfulness and reliability of the research results. Researchers may also need to examine medical records in order to develop useful and appropriate research designs and protocols.

The HIPAA Privacy Rule has some specific provisions that allow a covered entity to use or disclose PHI without an individual’s authorization if the information is to be used for research. One provision allows a covered entity to use and disclose PHI without an individual’s authorization if the covered entity obtains the following representations from the researcher: (1) the use or disclosure of the information is solely to prepare a research protocol or is otherwise preparatory to research; (2) the researcher will not remove any PHI from the covered entity; and (3) the PHI for which access is sought is necessary for the research.²⁷ However, there is widespread confusion regarding what is permitted under this provision of the Privacy Rule. Surveys and studies also indicate that recruiting patients for research has become more difficult and costly under the HIPAA Privacy Rule.

HHS has issued multiple guidance statements to help address this confusion, but these guidance statements, some of which have been contradictory, have failed to solve the problem.

According to current HHS guidance on the Privacy Rule, researchers (both internal and external to a covered entity) may conduct a review of medical records under the Privacy Rule’s exception that allows the use and disclosure of PHI without an individual’s authorization if the information is being used by a researcher for activities preparatory to research. However, HHS guidance also specifies that only internal researchers (an employee or member of the covered entity’s workforce) may contact potential research participants about the possibility of enrolling in a study under this provision of the Privacy Rule. External researchers are not allowed to record or remove patient contact information from a covered entity. They must get a partial waiver from an IRB or Privacy Board to perform any recruitment activities. This interpretation of the Privacy Rule creates an artificial distinction between internal and external researchers that actually provides less privacy protection than that afforded by the Common Rule, which requires that any activities preparatory to research involving human subjects, or related to initial recruitment of subjects for research studies, be reviewed and approved by an IRB. Thus, the HIPAA Privacy Rule permits conduct that is prohibited by the Common Rule.

According to SACHRP, HHS statements regarding these provisions for activities preparatory to research have led to “enormous confusion,” and many “institutions are hesitant to permit many recruitment activities critical to the continuation of the research enterprise, out of fear that they are in some way misinterpreting the government’s current positions on research recruitment.” In 2004 SACHRP indicated that it was “very concerned that the bureaucratic complexities here undermine, rather than enhance, the attention that needs to be paid to the welfare and interests of subjects in the research recruitment process.”

To address these issues, the committee recommends that all researchers (including those internal to the covered entity) be required to obtain IRB approval (as required under the Common Rule) prior to contacting potential research participants. When making a decision about whether to approve research projects, the IRB should review and consider the investigator’s plans for contacting patients, and ensure that the information will be used only for research projects approved by the IRB and will not be disclosed elsewhere. The committee believes that IRBs can protect research participants, including their privacy and confidentiality interests, but as noted in Recommendation II.A.1, educational outreach by HHS is needed to address misunderstandings of these provisions.

Recommendation II.B: HHS should develop guidance materials to facilitate effective use of existing data and materials for health research and public health purposes.

Background

Many institutions create and maintain databases with patient health information or repositories with biological materials collected from patients. These databases and biospecimen banks are used for many types of health research, including studies to understand diseases or to compare patient outcomes following different treatments.

Current interpretations of provisions of the HIPAA Privacy Rule sometimes make it difficult to effectively use these valuable resources for health research. Currently, for example, HHS interprets the Privacy Rule as prohibiting patient authorization for future research use of PHI associated with the individuals’ biospecimens collected in the course of a clinical trial or treatment by covered entities.

Such interpretations of the HIPAA Privacy Rule create confusion and unnecessary burdens for patients and researchers alike and lead to lost opportunity by impeding important health research. Furthermore, because such interpretations are inconsistent with the Common Rule, they lead to inequities between covered entities and non-covered entities that hold databases and biospecimen banks.

The committee’s four specific recommendations below are intended to facilitate important health research by maximizing the usefulness of patient data associated with biospecimen banks and in research databases, thereby allowing novel hypotheses to be tested with existing data and materials as knowledge and technology improve. The recommendations would align interpretation of the HIPAA Privacy Rule with the Common Rule on several points, simplify or clarify the relevant processes in research, and develop new tools for data aggregation.

Recommendation II.B.1: HHS should develop guidance that clearly states that individuals can authorize use of PHI stored in databases or associated with biospecimen banks for specified future research under the HIPAA Privacy Rule with IRB oversight, as is allowed under the Common Rule, to facilitate use of repositories for health research.

• Future uses should be described in sufficient detail to allow individuals to give informed consent.
• IRBs should determine that the new research is not incompatible with the initial consent.

Rationale

Databases and biospecimen banks, once created, offer a cost-effective resource of information for rapidly addressing new health research ques tions as technologies and knowledge advance. Collecting the data and biospecimens necessary to address each new research question as it arises would take years, or even decades, at great expense. Thus, the pace and efficiency of medical progress is enhanced significantly by using established resources whenever feasible. When new potential prognostic markers of disease are identified, for example, they must be validated by studying the markers in many patients over the course of the disease. Examining samples stored in biobanks, where disease progression has already been recorded over many years, is a fast and relatively inexpensive way of determining whether the marker has promise for clinical use and warrants further investigation.

The provisions of the HIPAA Privacy Rule, as interpreted by HHS, may impede research with established biospecimen banks and databases. The Privacy Rule requires an individual’s authorization for the use or disclosure of protected information to describe, with specificity, the purpose of the proposed use or disclosure of such information.²⁸ HHS regards all future uses of PHI as nonspecific—and therefore ineligible for inclusion in an authorization for the collection and storage of biological materials and data. In contrast, the Common Rule makes it possible to obtain individuals’ consent to future use or disclosure of their health information for health research, with IRB oversight, as long as any intended future use is described in sufficient detail to allow informed consent.

HHS has maintained that allowing individuals to authorize future uses of their PHI could leave decisions about future research projects at the discretion of covered entities, because the HIPAA Privacy Rule, unlike the Common Rule, does not require IRB or Privacy Board review of research uses and disclosures made with individual authorization.²⁹ For that reason, HHS requires that individuals be recontacted to obtain their authorization for the use or disclosure of their existing data and biospecimens for any additional research studies undertaken unless the researchers obtain a waiver or alteration of individual authorization. Recontacting individuals to obtain their additional authorization is very impractical. Even when another contact is possible, the process can be intrusive and burdensome for patients and their families.

As long as an IRB is overseeing the research, obtaining individuals’ authorization for future use of their information in existing databases and biospecimen banks in health research should be adequate for protecting privacy. One way to overcome the discordance between the Privacy Rule and the Common Rule would be for HHS to issue guidance explicitly stating that future research may go forward if the following conditions are met: (1) the individual’s authorization describes the types or categories of research that may be conducted with the PHI stored in the database or biobank; and (2) an IRB determines that the proposed new research is not incompatible with the initial consent and authorization, and poses no more than a minimal risk.

Because science is evolving quickly, one cannot adequately anticipate what knowledge will be gained in the future. Significant opportunities for beneficial research could be lost without some revisions in the current interpretation of this portion of the HIPAA Privacy Rule. Databases and biospecimen banks created and maintained with federal funds, in particular, should be used for multiple studies as often as feasible, especially given the high cost of developing such repositories and the high value of investigating and comparing multiple scientific questions from the same pool of data.

Recommendation II.B.2: HHS should develop clear guidance for use of a single form that permits individuals to authorize use and disclosure of health information in a clinical trial and to authorize the storage of their biospecimens collected in conjunction with the clinical trial, in order to simplify authorization for interrelated research activities.

Rationale

Informed consent and authorization are essential for the protection of individuals who volunteer to participate in clinical trials. Thus, it is imperative that the informed consent and authorization documents are easily understood and meaningful to the individuals involved. Ideally, all relevant information should be integrated into one simple document.

The HIPAA Privacy Rule’s complex provisions have generated misperceptions about restrictions on individuals’ ability to provide compound authorization for the related activities of clinical trial participation and biospecimen donation. Such misperceptions can diminish the informed nature of consent and authorization because they can lead to patient confusion and misunderstanding. HHS has stated that if a covered entity plans to collect and store biospecimens in a research repository in conjunction with a clinical trial, individuals’ authorization for storage of the PHI associated with the repository must be separate from authorization for disclosure of the PHI associated with participation in the clinical trial.

HHS arrived at this interpretation through a series of steps. First, it is generally not permissible to condition treatment on an individual’s authorization for the use of PHI, although the HIPAA Privacy Rule does permit a covered entity to condition treatment in a clinical trial on sign ing an authorization.³⁰ Second, although the HIPAA Privacy Rule generally permits researchers to combine an authorization form with any other type of written permission (including another authorization), it prohibits researchers from combining authorizations where the covered entity conditions the provision of treatment on signing only one of the authorizations, but not the other.³¹ Because HHS has concluded that collection of PHI for a clinical trial and for a repository are separate research activities, researchers cannot condition participation in the clinical trial on signing authorization to include PHI in a repository.³²

Currently, therefore, the two authorizations cannot be combined in one form unless (1) the form has separate signature lines for each authorization, and (2) the text clearly delineates the two activities and states that the participant is not required to sign the portion authorizing the contribution of PHI to the repository in order to receive treatment in a clinical trial.

There is much confusion about these provisions of the HIPAA Privacy Rule, and some institutions require two complete authorization forms with all the attendant language rather than two signature lines on the same form. The excess paperwork that results is burdensome for patients; can reduce the informed nature of authorization by confusing patients; and may reduce patient participation in research. Guidance from HHS to clearly indicate that a single authorization form with two signature lines is permissible in such circumstances would reduce variability and increase the informed nature of authorization.

Recommendation II.B.3: HHS should clarify the circumstances under which DNA samples or sequences are considered PHI, in order to facilitate appropriate use of DNA in health research.

Rationale

With recent technological advances in biomedical research, it is now possible to learn a great deal about disease processes and individual variations in treatment effectiveness or susceptibility to disease from genetic analyses because the DNA sequences that make up a person’s genome strongly influence a person’s health. In this genomic age of health research, patient blood and tissue samples stored in biospecimen banks can provide a wealth of information for addressing long-standing questions about health and disease.

But HHS has not yet issued clear guidance on how the HIPAA Privacy Rule applies to DNA samples or sequences. HHS guidance documents indicate that blood or tissue samples themselves are not protected under HIPAA unless they contain or are associated with the 18 personal identifiers specified by the HIPAA Privacy Rule. In addition, HHS has stated that the results of an analysis of blood or tissue, if containing or associated with individually identifiable information, would be PHI. Yet the research community remains uncertain about whether genetic information accompanying biospecimens is protected under the HIPAA Privacy Rule because the list of HIPAA identifiers includes vague terms such as “biometric identifiers” and “unique identifying characteristics.”³³

Genetic information does not itself identify an individual in the absence of other identifying information. Even the European Union, which has a more restrictive privacy regime than the United States, does not consider DNA in and of itself to be a direct identifier.³⁴ In some circumstances, however, a person’s genetic code could be construed as a unique identifier in that it could be used to match sequence in another biospecimen bank or databank that does include identifiers. As genetic information becomes more prevalent in research and health care, the latter scenario is more likely to occur. As health care enters the era of personalized medicine, for example, genetic information is more likely to be included in a person’s health records. But at the same time, realization of the promises of personalized medicine will require research on DNA from a great many diverse individuals whose medical history is well documented.

The committee believes that establishing consistent standards for the use and protection of genetic information is important. The committee advocates a focus on strong security measures and recommends the adoption of strict prohibitions on the unauthorized reidentification of individuals from DNA sequences, by anyone.

Regardless of how genetic information is regulated under the HIPAA Privacy Rule, a federal prohibition of genetic discrimination is necessary to allay privacy concerns and diminish potential negative consequences of unintended disclosure of genetic information. Many people are concerned about genetic discrimination—the misuse of genetic information by insurance companies, employers, and others to make decisions based on a person’s DNA. Thus, in addition to protecting the privacy of individuals’ genetic information, it is important to protect people against genetic discrimination. The hope is that the Genetic Information Nondiscrimination Act of 2008, recently signed into law, will begin to address some of these concerns.

Recommendation II.B.4: HHS should develop a mechanism for linking data from multiple sources so that more useful datasets can be made available for research in a manner that protects privacy, confidentiality, and security.

Rationale

Because a single database may not provide a complete picture of a patient’s condition or health history, it is often necessary to combine information about a patient from multiple sources. However, the way in which the HIPAA Privacy Rule has been interpreted and implemented has made linking data from diverse sources for research purposes more difficult. Thus, the Privacy Rule impedes health research and compromises the value and reliability of research that is undertaken.

Under the HIPAA Privacy Rule, it is possible in principle for a researcher to aggregate PHI from multiple covered entities with individual authorization or with an IRB or Privacy Board’s waiver of such authorization. Obtaining individuals’ authorization for research that entails the review of thousands of medical records is unrealistic, though, and even with a waiver of authorization, covered entities with large datasets are now often reluctant to allow researchers access to PHI. More commonly, covered entities provide data to researchers with direct identifiers removed. Because datasets from multiple sources cannot be linked to generate a more complete record of a patient’s health history without a unique identifier, though, datasets with direct identifiers removed are often of minimal value to researchers and are not frequently used. A third party may collect PHI from covered entities and aggregate the data for research by establishing business associate agreements with the various data sources, but in practice, such agreements are used infrequently for this purpose because they are complicated and impractical to set up for individual research projects.

The committee believes a better approach would be to establish secure, trusted intermediaries that could develop a protocol, or key, for routinely linking health data from different sources, and then provide more complete and useful datasets with the identifiers removed to researchers. One way this could be accomplished, for example, might be through data warehouses that are certified for the purpose of linking data from different sources. The organizations responsible for such linking would be required to use strong security measures and would maintain the details about how the linkage was done, should another research team need to recreate the linked dataset. Using such intermediaries would facilitate greater use of health data with direct identifiers removed for research and lead to more meaningful study results while also increasing patient privacy protections and allaying concerns of covered entities.

Some federal agencies are already developing mechanisms for linking information from different sources. The Centers for Medicare & Medicaid Services (CMS), for example, provides a linking service for Medicare and Medicaid data via contractors that create standardized data files tailored for research. CMS also has begun pilot projects to aggregate Medicare claims data with data from commercial health plans and, in some cases, Medicaid, in order to calculate and report quality measures for physician groups.

A broader effort to link data from diverse sources, called the National Health Data Stewardship Entity, has been initiated by the federal Agency for Healthcare Research and Quality (AHRQ). AHRQ is also involved in implementing the Patient Safety and Quality Improvement Act of 2005, which encourages creation of Patient Safety Organizations to receive information from hospitals, doctors, and health care providers on a privileged and confidential basis, for analysis and aggregation. Even though the purpose of these two AHRQ initiatives is to monitor health care quality,^{35 , 36} they could provide a model for data aggregation that is potentially applicable to health research.

The administrative simplification provisions of HIPAA specifically provided for the creation of a unique individual identifier that would permit the linking of data from different sources, but work on developing such an identifier has been halted because there is a great deal of controversy regarding how it could be implemented without compromising individual privacy. In addition, federal agencies are under pressure from the Office of Budget and Management to reduce the use of Social Security numbers as unique identifiers. Nevertheless, it is clear that the development of some type of linking key (not based on Social Security numbers) would make linkages among databases more efficient, standardized, and reliable, and less costly. Moreover, this type of linkage could greatly facilitate many types of information research and improve quality of care.

Recommendation II.C. HHS should revise provisions of the HIPAA Privacy Rule that entail heavy burdens for covered entities and impede research without providing substantive improvements in patient privacy.

Background

For some provisions of the HIPAA Privacy Rule, the burdens are heavy and the privacy protections are small. Such provisions may need to be reconsidered if society is to derive maximal benefits from health research. The committee recommends revising two components of the HIPAA Privacy Rule that are very burdensome with respect to the level of privacy protection they afford.

Recommendation II.C.1: HHS should reform the requirements for the accounting of disclosures (AOD) of PHI for research.

• The HIPAA Privacy Rule should permit covered entities to inform patients in advance that PHI might be used for health research with IRB/Privacy Board oversight or for public health purposes. Accordingly, the Privacy Rule should be revised to exempt disclosures of PHI made for research and public health purposes from the Privacy Rule’s accounting of disclosures requirements. As an alternative to AOD, to ensure transparency, institutions should maintain a list, accessible to the public, of all studies approved by an IRB/Privacy Board.

Rationale

Under the HIPAA Privacy Rule, individuals have a right to receive an accounting of disclosures, a list of all disclosures of their PHI by a covered entity or the covered entity’s business associates in the past 6 years. According to HHS, the AOD provision of the HIPAA Privacy Rule was intended “as a means for the individual to find out the nonroutine purposes for which his or her PHI was disclosed by the covered entity, so as to increase the individual’s awareness of persons or entities other than the individual’s health care provider or health plan in possession of this information.” The AOD requirement does not constitute an audit trail, though, because the provision has numerous exceptions—including disclosures of PHI for health care operations, pursuant to an authorization, as part of a limited dataset, for national security or intelligence purposes, and to correctional institutions or law enforcement officials.

Disclosures of PHI by covered entities for research purposes under a waiver of individual authorization approved by an IRB or a Privacy Board, or for public health purposes as required by law, must be included in an AOD report. Furthermore, HHS has noted that “making a set of records available for review by a third party constitutes a disclosure of the PHI in the entire set of records, regardless of whether the third party actually reviews any particular record.” The AOD provision of the HIPAA Privacy Rule provides an exception for research involving groups of 50 or more subjects by allowing the covered entity to develop a general list of all protocols for which a person’s PHI may have been disclosed. Even then, however, there is a considerable administrative obligation to generate such a list. Furthermore, in many medical facilities, a general list of protocols is extensive and thus relatively meaningless to a particular patient.

The AOD provision of the HIPAA Privacy Rule places a heavy administrative burden on health systems and health services research that achieves little in terms of protecting privacy. Moreover, HHS has provided no guidance to covered entities about practical ways to fulfill this requirement in an efficient manner. On the basis of testimony in 2004, the Secretary’s Advisory Committee on Human Research Protections concluded that the cost and burden of compliance with the HIPAA Privacy Rule’s AOD requirements were so high that institutions were likely to accept the risk of noncompliance rather than incur the cost of compliance.

Annual surveys of health care privacy officers undertaken by the American Health Information Management Association (AHIMA) since 2004 have similarly found that many facilities report difficulties with the AOD requirement. Such surveys have also found that the demand for AOD reports by individuals is extremely low. Two thirds of health care privacy officers participating in the survey reported receiving no requests at all. Nearly one third of respondents indicated that they would like to see a change to the AOD provision of the HIPAA Privacy Rule—the most frequently cited provision among all respondents and the most frequently cited provision by far among respondents with more than 20,000 admissions/discharges per year. On the basis of these results, AHIMA concluded that “for many, this [AOD] provision is not only burdensome but also significantly inefficient.”³⁷

Robust safeguards are already in place to protect the privacy of PHI disclosures in health research via IRBs and Privacy Boards. As the health care system moves toward broader implementation of electronic health records, however, automatic tracking of audit trails will be important to incorporate. Technology advances will likely make automatic AOD tracking feasible, affordable, and widely available in the future. Until then, the committee recommends that disclosures of PHI made for health research and public health purposes be exempted from the HIPAA Privacy Rule’s AOD requirement.

Recommendation II.C.2: HHS should simplify the criteria that IRBs and Privacy Boards use in making determinations for when they can waive the requirements to obtain authorization from each patient whose PHI will be used for a research study, in order to facilitate appropriate authorization requirements for responsible research.

• If HHS decides to retain the current waiver criteria, HHS should provide clear and reasonable definitions of terms used in those criteria, such as “minimal risk” to the privacy of individuals (in the first criterion) and “impracticable” (in the second and third criteria). HHS should also provide specific case examples of what should or should not be considered impracticable or of minimal risk.

Rationale

Under the HIPAA Privacy Rule, researchers seeking to use PHI in medical records for research must obtain authorization from each patient unless an IRB or a Privacy Board makes a determination that a waiver of individual authorization is warranted. For many types of research with medical records, making that determination is a challenge for IRBs and Privacy Boards. Many studies involve thousands of records, making individual authorization unrealistic. But the criteria in the HIPAA Privacy Rule that IRBs and Privacy Boards apply in making these decisions are complex and very subjective.

Currently, IRBs and Privacy Boards must use three criteria in considering whether to approve a waiver of individual authorization for the use of PHI in research.³⁸ The first criterion is that the use or disclosure of PHI in the research involves no more than a “minimal risk” to the privacy of individuals. The Privacy Rule lists three elements that must be present in making this determination: (1) “an adequate plan to protect the identifiers from improper use and disclosure;” (2) “an adequate plan to destroy the identifiers;” and (3) “adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research project, or for other research for which the use or disclosure of PHI is otherwise permissible.” However, the decision about what is “adequate” is highly subjective, and thus different institutions are likely to set varying thresholds for “minimal risk.”

The other two criteria that IRBs or Privacy Boards currently must use in considering whether to approve a waiver of individual authorization are (1) that “the research could not practicably be conducted without the waiver;” and (2) that the “research could not practicably be conducted without access to and use of PHI”³⁹ (as opposed to deidentified data or a limited dataset). The concept of practicability is used in both the Common Rule and in the HIPAA authorization criteria, but what is “practicable” or “impracticable” has never been adequately defined by the HHS Office for Human Research Protections or the HHS Office for Civil Rights (e.g., with regard to cost/feasibility). Not surprisingly, therefore, institutions apply varying definitions independently, often too conservatively to allow even low-risk research to proceed. Some institutions interpret the term impracticable to mean not at all possible and even require researchers to demonstrate that a study will fail without a waiver of authorization. The lack of clarity leads to a great deal of variability across institutions and impedes research. Patients have also questioned the meaning of the term.

Simplification or clarification by HHS of the criteria that IRBs or Privacy Boards must use in deciding whether to approve a waiver of individual authorization would be especially helpful for multi-institutional studies, which fall under the jurisdiction of multiple IRBs or Privacy Boards. Covered entities are permitted to rely on a waiver of authorization approved by a single IRB or Privacy Board with jurisdiction. Currently, however, covered entities often decide to require approval from their own IRB or Privacy Board prior to disclosing PHI to the requesting researcher, regardless of whether another IRB or Privacy Board already granted a waiver of authorization. This practice leads to delays and variability in the protocol at different sites.

Simplification of the criteria for approval of waivers by IRBs and Privacy Boards would also be helpful for smaller or community-based institutions that do not have internal counsel or regulatory affairs specialists, and thus are more likely to opt out of research that requires decisions about authorizations. With better guidance, all covered entities would have more confidence in their decisions and might be more willing to rely on a lead IRB or Privacy Board’s decision in the case of multi-institutional studies.

If HHS decides to retain the three criteria that IRBs or Privacy Boards currently use in deciding whether to approve a waiver of individual authorization, however, the committee recommends that HHS provide clear and reasonable definitions of the vague terms used in those criteria. Specifically, HHS should define what constitutes “minimal risk” to the privacy of individuals (in the first criterion) and define what constitutes “impracticable” (in the second and third criteria). HHS should also provide specific case examples of what should or should not be considered impracticable or of minimal risk to reduce variability and overly conservative interpretations.

Rationale

Effective health privacy protections require effective data security measures. Protecting the privacy of research participants and maintaining the confidentiality of their data have always been imperative to most researchers and a fundamental tenet of clinical research. Recently, however, several highly publicized examples of stolen or misplaced computers containing health data have heightened the public’s concerns about privacy. Such events pose problems not only for patient privacy, but also for health research, because public trust is essential for patients to be willing to participate in research. Moreover, data security is a key component of comprehensive privacy protections. Thus, the committee recommends improving the security of personally identifiable health information.

The HIPAA Security Rule (which entails a set of regulatory provisions separate from the Privacy Rule) already sets a floor for data security standards within covered entities, but not all institutions that conduct health research are subject to HIPAA regulations. Moreover, the security protections intended by the HIPAA Security Rule may not be sufficient to prevent breaches.

The committee recommends that all institutions conducting health research undertake measures to strengthen data protections. Given the recent spate of lost or stolen laptops containing patient health information, for example, encryption should be required for all laptops and removable media containing such data. There are differences among the missions and activities of institutions in the health research community, however, so some flexibility in the implementation of specific security measures will be necessary.

Examples of security standards and guidelines already exist in some sectors, but they are not widely applied in academic settings. The National Institute of Standards and Technology (NIST), for example, has developed standards and guidance for the implementation of the Federal Information Security Management Act of 2002, which was meant to bolster computer and network security within the federal government and affiliated parties (e.g., government contractors). The NIST standards include minimum security requirements for information and information systems, as well as guidance for assessing and selecting appropriate security controls for information systems, for determining security control effectiveness, and for certifying and accrediting information systems.⁴⁰

HHS, working through its Office of the National Coordinator for Health Information Technology,⁴¹ could play an important role in developing or adapting standards for health research applications, then encourage and facilitate broader use of such standards in the health research commu nity. The issue of the security of health data will continue to grow in importance as the health care industry moves toward widespread implementation of electronic health records, and Congress has already proposed numerous bills to facilitate and regulate that transition. As noted in the committee’s recommendation about the requirements for the accounting of disclosures of PHI for research above (Recommendation II.C.1), advances in information technology will likely make it easier to implement measures such as audit trails and access controls in the future.

Enhancing security could reduce the risk of data theft and reinforce the public’s trust in the research community by diminishing anxiety about the potential for unintentional disclosure of information. The publication of best practices and outreach to all stakeholders by HHS, combined with a cooperative approach to compliance with security standards such as self-evaluation and audit programs, would promote progress in this area. As noted in Recommendation II.A.1, research sponsors could also play a role in fostering the adoption of best practices in data security.

Recommendation III.B: HHS—or, as necessary, Congress—should provide reasonable protection against civil suits brought pursuant to federal or state law for members of IRBs and Privacy Boards for decisions made within the scope of their responsibilities under the HIPAA Privacy Rule and the Common Rule, in order to encourage service on Institutional Review Boards and Privacy Boards. The limitation on liability for members of IRBs and Privacy Boards should not include protection for willful and wanton misconduct in reviewing the research, but should instead be reserved for good-faith decisions, backed by minutes or other evidence, in responsibly applying the legal requirements under the HIPAA Privacy Rule or the Common Rule.

Rationale

IRBs, Privacy Boards, and institutions have enormous responsibility in determining whether health research projects are planned and conducted in a way that minimizes or eliminates the potential risk to human research participants, including both direct physical harms and nonphysical harms (e.g., breach of privacy). The workload of IRBs and the complexity of their work have been steadily increasing as a result of new and evolving requirements for research regulation and documentation, including the HIPAA Privacy Rule. Surveys and studies indicate that the IRB review process has become more lengthy and difficult since implementation of the Privacy Rule, which may increase opportunity costs due to delayed or undiscovered research findings that might improve health.

Effective oversight of health research depends on the recruitment of qualified and knowledgeable volunteers to serve on IRBs and Privacy Boards. But the increasing workload and complexity of IRB and Privacy Board service have made it difficult to recruit and retain knowledgeable IRB and Privacy Board members and to ensure time for the ethical reflection necessary to make appropriate decisions about human research projects. Moreover, because of the growth over the past decade of lawsuits naming individual IRB members as defendants, fear of penalties and civil suits can be a significant deterrent in recruiting qualified volunteers to serve on IRBs and Privacy Boards. Such fears could also lead IRB and Privacy Board members to be overly conservative in their decisions about research proposals brought before them.

Members of IRBs and Privacy Boards are generally indemnified by their institutions, but they are not immune from being named in a suit. Therefore, they might still have to devote time and resources to defending themselves for decisions made by an IRB or Privacy Board on which they served. Members of IRBs or Privacy Boards who receive limited protection against lawsuits may be less likely to interpret the HIPAA Privacy Rule too conservatively.

Providing this type of limitation on liability for IRB and Privacy Board members would be similar to the precedent of protection for peer review members under state laws and under the Health Care Quality Improvement Act of 1986. A similar provision was incorporated into the Ontario Personal Health Information Protection Act of 2004, under which members of ethical boards are immune for acts done and omissions made in good faith that are reasonable under the circumstances. In addition to reducing over interpretation of the HIPAA Privacy Rule in health research, such protections might also facilitate multi-institutional research by reducing the variability among local IRBs and Privacy Boards, as they should be more willing to accept the decision of a lead IRB or Privacy Board. Indeed, moving in the direction of national IRBs/Privacy Boards, as is encouraged by the National Cancer Institute for cancer clinical trials, might further reduce overly conservative interpretation of the HIPAA Privacy Rule.

Finally, it should be noted that HHS policy is to seek compliance with the HIPAA Privacy Rule first, rather than penalties, when a concern is brought to its attention. Institutions might be less inclined to interpret the HIPAA Privacy Rule too conservatively if this policy were stated more clearly in guidance materials provided by HHS. Thus, even without the enactment of a new protective statute for IRB and Privacy Board members, simple clarification and clear communication of the way HHS will enforce the HIPAA Privacy Rule and seek penalties would be helpful.

Recommendation III.C: HHS and researchers should take steps to provide the public with more information about health research.

Background

Surveys indicate that the vast majority of Americans believe health research is important, and are interested in the findings of research studies. The majority of patients also appear to be willing to participate in health research, either by volunteering for a study to test a medical intervention or by allowing access to their medical records or stored biospecimens, under certain conditions. Their willingness to participate in research is dependent on trust in researchers to safeguard the rights and well-being of patients, including assurance of privacy and confidentiality, and the belief that the research is a worthwhile endeavor that warrants their involvement. Yet patients often lack information about how health research is conducted and are rarely informed about research results that may have a direct impact on their health. The committee’s two recommendations below address the public’s desire for more information about health research and are important components in fulfilling two of the committee’s overarching goals of the report: (1) improving the privacy and data security of health information, and (2) improving the effectiveness of health research. Both recommendations could be accomplished by HHS and the health research community without any changes to HIPAA or the Privacy Rule by making them a condition of funding from HHS and other research sponsors and by providing additional funds to cover the cost.

Recommendation III.C.1: Health researchers should make greater efforts to inform study participants and the public about the results of research and the relevance and importance of those results.

• Researchers should inform interested research participants (who granted authorization for a particular study) with a simplified summary of the results at the conclusion of a research study.
• HHS should encourage registration of trials and other studies in public databases, particularly when research is conducted with a waiver of authorization.

Rationale

Empirical evidence indicates that people want to be informed about research results, and ethicists have long recommended this kind of feedback and community involvement. In addition, the IOM committee identified transparency—the responsibility to disclose clearly how and why personally identifiable information is being collected—as an important component of comprehensive privacy protections. An IOM report in 2002 titled Respon sible Research: A Systems Approach to Protecting Research Participants recommended improved communication with the public and research participants to ensure that the protection process is open and accessible to all interested parties, noting that transparency is best achieved by providing graded levels of information and guidance to interested parties.

Effective communication could also build the public’s trust in the research community, which is important because trust is necessary for the public’s continued participation in research under both the HIPAA Privacy Rule and the committee’s new framework. Learning about clinically relevant findings from a study in which a patient has participated could make patients feel more integrated into the process and could encourage more patients to participate in future studies. Moreover, if the study results indicate that an altered course of care is warranted, direct feedback about these results could lead to improved health care for study participants.

Thus, the committee recommends that when patients grant authorization for their medical records to be used in a particular study, health researchers should make greater efforts at the conclusion of the study to inform study participants about the results, and the relevance and importance of those results. Broader adoption of electronic medical records may be helpful in accomplishing this goal, but multiple impediments, beyond cost and technology, may prevent delivery of meaningful feedback to participants. Although some guidelines for providing and explaining study results to research participants have been proposed, they differ in details because limited data are available on this subject, and thus standards are lacking. A summary of the results alone, while necessary and reasonable, can be seen as a token, and also raises questions about issues such as how best to write summaries and how to present research with uninformative outcomes.

HHS should also encourage registration of trials and other studies in public databases, particularly when research is conducted with a waiver of authorization as a way to make information about research studies more broadly available to the public. Numerous clinical trial registries already exist, and registration has increased in recent years. The National Library of Medicine established a clinical trials registry⁴² in 2000, which has expanded to serve as the FDA’s required site for submissions about clinical trials subject to the FDA databank requirement and now also includes information from several other trial registries. The FDA Amendments Act of 2007 expanded the scope of required registrations and provided the first federally funded trials results database. In fall 2005, the International Committee of Medical Journal Editors adopted a policy requiring prospective trial registration as a precondition for publication.

The development of clinical trial registries is an important first step toward providing high-quality clinical trial information to the public. Cur rently, however, there is no centralized system for disseminating information about clinical trials of drugs or other interventions. Thus, patients and their health care providers have difficulty identifying ongoing studies. Moreover, some trials are still exempt from registration and data reporting. An additional limitation of clinical trial databases is that noninterventional studies (including observational studies that play an increasingly critical role in biomedical research) are not generally included. Because many non-interventional studies are conducted with a waiver of authorization, including those studies in a registry could be an important method for increasing public knowledge of those studies.

Recommendation III.C.2: HHS and the health research community should work to educate the public about how health research is done, and what value it provides.

Rationale

Health research provides a community benefit by determining the most effective treatments and by developing new therapies. Interventional clinical trials are the most visible of the various types of health research, but a great deal of informative health research entails analysis of thousands of patient records to better understand human diseases, to determine treatment effectiveness, and to identify adverse side effects of therapies. This form of research is likely to increase in frequency as the availability of electronic health records continues to expand. As medicine moves toward the goal of personalized medicine, research results will be even more likely to be directly relevant to patients, but more study participants will be needed to derive meaningful results.

However, many patients probably are not aware that their medical records are being used in database research. Moreover, surveys show that many patients desire not only notice, but also the opportunity to decide about whether to consent to such research with medical records. As noted in Recommendation III.A, strengthening security protections of health data should reduce the risk of security breaches and their potential negative consequences, and thus should help to alleviate patient concerns in this regard. But educating patients about how health research is conducted, monitored, and reported could also help to increase patients trust in the research community, which is important for the public’s continued participation under both the HIPAA Privacy Rule and the committee’s new framework.

In addition, an educated public could also decrease the potential for biased research samples. A universal requirement to obtain authorization for medical records research can lead to a biased study sample, and thus inaccurate conclusions, because those who decline to participate may be more or less likely than average to have a particular health problem. A study sample may also be biased if certain members are underrepresented or overrepresented relative to others in the population. A biased sample is problematic, because any statistic computed from that sample has the potential to be consistently erroneous, and thus, conclusions drawn from a biased sample are likely to be invalid. Conveying to the public the importance of health care improvements derived from medical records research and stressing the negative impact of incomplete datasets on research findings may increase the public’s participation in research and their willingness to support information-based research that is conducted with IRB or Privacy Board oversight and a waiver of patient authorization.

There are numerous examples of important research findings from medical records research that would not have been possible if direct patient consent and authorization were always required, including the finding that infants exposed to diethylstilbestrol (DES) during the first trimester of pregnancy had an increased risk of breast, vaginal, and cervical cancer and reproductive anomalies as adults. Studies of medical records also led to the discovery that folic acid supplementation during pregnancy can prevent neural tube defects.

Thus, HHS and the health research community should work to educate the public about how research is done, and what value it provides. All stakeholders, including professional organizations, nonprofit funders, and patient organizations, have different interests and responsibilities to make sure their constituencies are well informed, but coordination and identification of best practices by HHS would be helpful. For example, the American Society of Clinical Oncology and the American Heart Association already have some online resources to help patients gather information about research that may be relevant to their conditions. Research is needed to identify which segments of the population would be receptive to and benefit from various types of information about how research is done and its value in order to create and implement an effective education plan.

Greater use of community-based participatory research, in which community-based organizations or groups bring community members into the research process as partners to help design studies and disseminate the knowledge gained,⁴³ would also help achieve this goal. These groups help researchers to design activities that the community is likely to value and to recruit research participants, by using the knowledge of the community to understand health problems. They also inform community members about how the research is done and what comes out of it, with the goal of providing immediate community benefits from the results when possible.