HIPAA Regulatory Alert
AAHC: HIPAA deterring biomedical research
Administrative burden, ambiguity also problems
Research vice presidents for academic health centers agree HIPAA has serious and often detrimental effects on biomedical research. The vice presidents met in focus groups sponsored by the Association of Academic Health Centers (AAHC) to share their concern that problems with HIPAA still have not been addressed in the five years of its existence.
The HIPAA privacy rule, the researchers say, continues to hamper a wide array of health research activities, and corrective action is needed to advance biomedical research and science in the United States.
"Five years after HIPAA's implementation, persistent problems are still creating impediments to valuable and important research," AAHC's statement says. "The AAHC's findings provide new insight on HIPAA while affirming past observations about the impact of HIPAA on research, indicating that the problems that first appeared after HIPAA's implementation in 2003 remain serious and widespread."
Focus group participants were asked to describe how HIPAA has affected different aspects and areas of research. They identified major cross-cutting areas of negative impact, as well as particular categories of research suffering setbacks due to HIPAA.
Concerns for researchers nationwide were:
1. ambiguity and misinterpretation of the rule;
2. administrative burden;
3. recruitment of research participants.
The specific areas of research particularly affected by HIPAA include:
1. access to stored tissue and genetic datasets;
2. data warehouses, Clinical and Translational Science Awards, and medical records;
3. community research.
Together, the researchers said, these concerns show that HIPAA is no small obstacle and that it threatens the social good by seriously restricting biomedical research and unnecessarily slowing the path toward life-saving discoveries.
Confusion and inconsistency
The groups discussed many HIPAA-related problems arising from widespread confusion over the rule's unclear language. Confusion over HIPAA's meaning was found to be common among all players, from research participants to privacy boards to institutions and even states. Participants reported that different institutions and states interpret and implement HIPAA inconsistently, making multi-site and interstate research more difficult if not impossible.
In addition, HIPAA overlaps with other existing regulations governing confidentiality and exchange of clinical research information, and conflicts with others. Concern was raised over a lack of understanding of HIPAA and a fear of violating regulations that discourage community partners such as hospitals from joining or collaborating in research with academic health centers.
AAHC says a recurring focus group theme was that fear of liability causes unnecessarily strict organizational decision making, which seriously impedes research. Drawing attention away from patient care and the need to research future treatments, HIPAA is causing decision makers to focus instead on deciphering unduly complex regulations and protecting institutions from liability, the groups say.
Participants in all the focus groups consistently reported the administrative burden HIPAA creates. They said that by generating additional paperwork and causing confusion and misinterpretation, HIPAA has imposed substantial and onerous demands on the time of administrative and research personnel.
Since HIPAA took effect, they say, more time is required to (1) define what does and does not constitute research; (2) complete additional forms and review documents; (3) track unauthorized disclosures of protected health information and requests for amendments; and (4) de-identify data from research participants. HIPAA also has increased the amount of time researchers must spend reviewing legal matters with research participants and decreased the time available for substantive discussions about risk, diagnosis, and clinical treatment issues, the groups say.
The focus groups say the impositions on investigator and research team time and resources are "slowing research unnecessarily" without providing benefit to research or the public. And they say widespread misunderstandings of HIPAA have raised the costs of conducting research because institutions have had to hire additional staff to handle administrative tasks, assist investigators, and conduct training or provide clarification on the rule. Money and resources also are wasted when a study, due to HIPAA complications, cannot conduct follow-up contacts.
Investigators and staff burning out
The research officials say they have seen significant investigator and staff burnout with fewer faculty members willing to participate in clinical research, which further threatens to weaken the clinical research infrastructure not only for academic health centers but for the entire nation.
The negative impact on participant recruitment was cited as one of greatest threats HIPAA poses to research. Researchers say they often have difficulty accessing patient records for initial review or making initial contact with a patient. When a principal investigator is unable to review patient medical records to identify patients who are eligible for a specific study, that task falls to employees of the health care provider's office. But they often don't have the time for this additional work and are unwilling or unable to help out.
Focus group participants also reported that investigators have been unable to contact participants from past studies to assess their interest in new studies. And recruitment of participants for healthy control groups is hampered by time- and effort-intensive procedures, such as waivers or approval from the institutional review board for amendments, which slow research and limit patient numbers.
The researchers say HIPAA's confusing and legalistic terminology in documents undermines participant recruitment. Since patients are easily overwhelmed by the length and complexity of HIPAA documents, the rule actually appears to make potential participants less likely to agree to join studies. It was pointed out that the length of documentation may discourage potential participants from reading the forms carefully before signing them, thus undermining the notion of "informed consent." It was generally agreed that HIPAA impedes participants' ability to obtain clear, concise, intelligible information about a research study.
In terms of specific research areas, the focus groups reported that de-identified data have diminished value for genetic datasets. Also, several concerns involve future use of data. Because HIPAA presents obstacles in locating patients for follow-up in the months and years after a study, biobanks lose the ability to obtain crucial follow-up data. And researchers may be unable to notify patients in "duty to warn" situations, such as if an adverse mutation is found and a treatment becomes available.
HIPAA also affects data warehouses, Clinical and Translational Science Awards (CTSA), and/or medical records. While CTSAs are a new opportunity for interdisciplinary research at academic health centers, there can be problems with the ability to move data among different sites.
One institution reported that HIPAA regulations stymied efforts to create an integrated electronic medical record system mandated by the CTSA. Another said collaboration in statewide CTSA networks is hampered by institutional policies that preclude direct periodic follow-up with patients to define future medical conditions. Follow-up is only permitted if research participants give permission at the time of sampling to be contacted.
Focus group participants said HIPAA regulations have generally hindered researchers' ability to access electronic medical records and, thus, have generated burdensome requirements for printing, organizing, filing, and securing paper copies of records.
Another development AAHC officials said they find troubling is that hospitals and community physicians are often reluctant to become engaged in research due mostly to HIPAA requirements. AAHC says provider reluctance "often stems from misinterpretation and confusion over the meaning of HIPAA. Many fear liability and punishment for potential privacy violations and misunderstand HIPAA regulations as they pertain to research, which can lead to overly cautious and unduly restrictive interpretation of the rule. Such unnecessarily and excessively strict interpretation has been impeding and significantly delaying research progress."
Recommendations for improvement
AAHC suggests three steps to address HIPAA-related barriers that are impeding research:
1. The Department of Health and Human Services should revise the HIPAA privacy rule to allow it to defer to the Common Rule (the Office of Human Research Protections' Federal Policy for the Protection of Human Subjects) in matters of protecting the privacy of protected health information of research participants. Common Rule guidelines already protect health information, and if an institutional review board thinks that extra protection is warranted, it can require a Certificate of Confidentiality.
2. The Office of Human Research Protections should provide updated guidance to emphasize the importance of preserving the privacy of protected health information.
3. Congress should implement a national genetic privacy act or include such a provision in a HIPAA revision to help resolve the current conflicts and confusion over differences in state genetic privacy acts and HIPAA that hamper genetic dataset research.
Oregon Health and Science University's chief integrity officer, Gary Chiodo, tells HIPAA Regulatory Alert that the HIPAA privacy rule is distracting from protecting human subjects, rather than facilitating that effort. "There are layers of non-understandable legal language that people don't care about," he says. "It interferes with the normal informed consent process."
Why no progress in five years?
Chiodo says there is no good answer as to why these problems remain after five years of experience with HIPAA. From the time of implementation, he says, investigators have expressed concerns about the rule. While the Department of Health and Human Services asked for time in which to implement the rule and evaluate its impact, Chiodo says that while some early fears were not on point, there is substantial evidence that other problems do exist as outlined by the AAHC focus groups.
AAHC policy and program vice president Elaine Rubin tells HRA the group produced its report because it was aware that problems with HIPAA have not been resolved. "HIPAA is synonymous with patient protection so people have been afraid to evaluate it," she says. "Another problem is that not that many people in Congress or some federal agencies really understand the intricacies of research. And they also are not aware of the other regulations and mechanisms that are out there to achieve the patient protection that they want."
Rubin says bureaucracies have been built without assessing the full landscape of existing regulatory agencies and there is a need to harmonize regulations.
[Editor's note: Download a copy of the report at www.aahcdc.org. Contact Gary Chiodo at [email protected]. Contact Elaine Rubin at (202) 265-9600.]
Research vice presidents for academic health centers agree HIPAA has serious and often detrimental effects on biomedical research.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content