IOM committee finds Privacy Rule causing problems for research
Changes to regulations, HHS guidance urged
An Institute of Medicine (IOM) committee studying the effects of the HIPAA Privacy Rule has painstakingly documented the strain it is putting on research.
It commissioned surveys of investigators who complain that HIPAA regulations stymie important research and are interpreted inconsistently from one institution to the next.
A survey of IRBs showed concerns about the complexity of patient forms and the lack of guidance in interpreting the rule.
Even privacy advocates made their case to the committee that the Privacy Rule is not protective enough of patient privacy.
"It seems like nobody is very satisfied with what's going on," says Sharyl Nass, PhD, study director for the IOM HIPAA project. "It's a little disquieting, because it's a fairly substantial set of recommendations and it probably costs a fair bit of money to adhere to them, and if no one's happy with them, it's a problem."
Nass says the IOM launched the committee last spring, in response to a forum that aired anecdotal stories about HIPAA's stunting effect on research. The committee's goal is to craft a set of recommendations to address the problems posed by the Privacy Rule.
To do that, however, committee members realized they would need more than anecdotes describing individual problems with HIPAA, Nass says.
"We wanted to try and get a more national systematic examination of the issue and that's a difficult thing to do," she says. "It's not something that the IOM normally takes on. We usually look at the available evidence that's already out. But in this case, because we knew there was relatively little out there, we actually took the unusual step of commissioning several surveys to try and provide some additional input to the committee."
The committee heard presentations on these surveys at meetings in October 2007 and February 2008, and has begun deliberations on a final report.
Nass says a draft report of the recommendations, which could include new guidance, proposed changes to the Privacy Rule, or both, likely will be completed later this year, with final publication sometime in early 2009.
While proposed legislation or changes to the federal regulations are under consideration, Nass says committee members are aware that would be a much more difficult route than suggesting new guidance from the U.S. Department of Health and Human Services (DHHS).
"Whenever they can, they'll probably try to make recommendations that don't require changing legislation or regulations, but would help people deal with what they have."
Researchers, IRBs surveyed
The surveys presented to the IOM HIPAA committee have confirmed what the research community has been saying for years: The Privacy Rule has made recruiting subjects more difficult and costly for investigators.
A web-based survey was distributed by 13 epidemiological societies, drawing responses from more than 1,500 investigators who have submitted IRB applications since the Privacy Rule was enacted. A majority reported that the degree to which the rule had made research harder was more than 60%. Both added costs and delays to research also were reported in the high range.
"Epidemiologists need to use very large data sets in order to examine the questions that they pose," Nass says. "So it had potentially big impact on the work they're doing."
A web-based survey of investigators within the National Cancer Institute's Cancer Research Network (CRN) found that more than 70% of the 89 respondents reported having at least one study directly affected by the Privacy Rule changing the study's timeline, design, or both. At least half the affected studies were multi-site.
The CRN survey and an accompanying survey of IRB administrators in the NCI-funded HMO Research Network (HMORN), added data to a growing belief that a large part of the HIPAA problem is its inconsistent interpretation by different IRBs.
More than a third of the CRN investigators who have participated in multi-site studies since 2003 reported that different HIPAA concerns raised by different IRBs have led to protocol variability in their multi-site studies.
"This variability is, of course, a big concern," says Sarah M. Greene, MPH, a research associate with the Group Health Center for Health Studies in Seattle, WA, which conducted the CRN and HMORN surveys. "The validity of the study, the quality of the data, could all be potentially compromised depending on what degree of variability you see."
Greene says the survey of 10 IRB administrators in the HMORN also pointed to varying interpretations of HIPAA.
When presented with scenarios related to privacy breaches, and given choices about how their IRB would handle them, responses were "all over the place," she says.
"I don't think that there can be or should be a one-size-fits-all interpretation of HIPAA at all local levels, but I guess I was anticipating a little more consistency across these particular responses," Greene says.
While more than half the IRB respondents reported that they found it easy to work with the Privacy Rule, Greene says a majority did believe that study participants are unduly burdened by the complexity of HIPAA authorization forms.
When asked what improvements they'd like to see, many administrators asked for guidance in creating less complex authorization language, Greene says.
"I think that's something where we'd be able to make some inroads — it's a very concrete and attainable goal over the short run," she says, noting that the Group Health Center itself recently overhauled its HIPAA authorization form to a seventh-grade reading level.
"If we can do something somewhere in the process to develop easier-to-comprehend versions of the forms or strategies to explain HIPAA to people, I think promulgating resources like that will help."
Other items on the IRB administrators' "wish list" from DHHS included:
- a well-organized, comprehensive document for guidance on HIPAA;
- help in reconciling differences between the Privacy Rule and human subjects protection regulations; and
- further clarification on waivers and HIPAA agreements.
Balancing needs
Greene noted that a small but noteworthy percentage of CRN investigators (22%) did not believe that their local IRB was balancing the needs of all stakeholders the patients, the investigators, and the institution.
"That's something that IRBs can be perpetually vigilant about," she says. "I think that's the toughest thing that IRBs deal with, maintaining that balance. To the extent that that can be attended to in this very HIPAA-complex world we live in, and help restore the investigators' confidence, I think that would help."
Greene says her participation in the work of the IOM HIPAA committee has left her much more optimistic that the problems associated with the Privacy Rule can be worked out.
"Before, everybody was throwing up their hands, basically," she says. "At the committee's very first meeting, the folks around the table were saying it would literally take an act of Congress to change this. But now I think there's a lot we can do without having to do that.
"The IOM has done a tremendous job amassing different points of view, and ensuring that every stakeholder is represented," Greene says. "It's so comprehensive, and I think the totality will result in a thoughtful look at not only the regulations and their impact, but where we can go from here."
An Institute of Medicine (IOM) committee studying the effects of the HIPAA Privacy Rule has painstakingly documented the strain it is putting on research.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content