Inconsistent interpretation of HIPAA creates research recruitment barrier
Researcher says IRB enforcement of privacy rule varies greatly
Researchers are finding the HIPAA to be a significant barrier to recruiting research participants, in part because of the inconsistent way in which IRBs deal with requests for HIPAA waivers.
In a March editorial in the Annals of Epidemiology, Roberta Ness, MD, MPH, a researcher at the University of Pittsburgh, wrote of her difficulties in recruiting patients for an ongoing study of preeclampsia in pregnant women.
Ness detailed her experience with recruitment after HIPAA became effective in April 2003, both with and without IRB waivers that allowed researchers to review maternity records at the university’s Magee Women’s Hospital to find potential participants.
The result: "With HIPAA in general, our average enrollment was cut in about half," she reports. "Because of changes in the leadership of the IRB, in part because the IRB at this particular hospital was merged with the main University of Pittsburgh IRB, we kind of gained and lost waivers. [When waivers were lost], the enrollment rate was cut in half again."
Without the waiver, researchers couldn’t comb through maternity records to find participants, and so they relied on health care providers to identify possible subjects and refer them.
Ness and others are calling for the Department of Health and Human Services (HHS) to modify the privacy rule to make recruitment easier. "I’m very hopeful that HHS will produce clearer guidance on how to interpret these rules," Ness says. "I think that would be enormously helpful."
Recruiting for the PEPP Study
The Pregnancy Exposures and Preeclampsia Program project (PEPP) is an ongoing, single-institution study of women followed throughout pregnancy. The goal is to find the cause of preeclampsia, a potentially fatal complication of pregnancy.
The first phase of the PEPP study was conducted from 1997-2001. Recruitment for the second phase was delayed while the hospital tried to figure out how to enforce the pending medical privacy rules, Ness says.
From April to September 2003, the researchers were not allowed a waiver of HIPAA’s authorization and disclosure requirements, and were unable to review any medical records for eligibility in the study except for those of women who had enrolled in a research registry. Ness says that only about 10% of women enrolled in that registry.
In October 2003, the maternity hospital’s IRB granted a waiver, allowing Ness and her colleagues to review records again to look for prospective subjects. However, unlike pre-HIPAA days, she says, a woman’s health provider had to gain assent from the patient before PEPP staff could approach her.
Ness says the study was once again complicated when the hospital’s IRB merged with the main University of Pittsburgh IRB in June 2004; the waiver once again was lost, and researchers again lost access to the records.
"Early on, before the implementation of HIPAA, we were recruiting over 12 women per week into the study," she recalls. "Directly after the implementation and without a waiver, we went down to 2.5 women per week. Then we got a waiver and we went up to about six women per week. And then lost it again and went back down to three."
In the editorial in Annals of Epidemiology, Ness’ assessment is blunt: "We cannot identify other systematic explanations for these trends other than the obvious: Local interpretation of the HIPAA regulations had a negative effect on the pace of our research."
Ness says the waiver recently has been regained. While she contends that the situation at research institutions in general has improved with time, she says there are institutions that still interpret HIPAA too restrictively.
"I don’t think that HHS meant to have so much variability in local interpretation," Ness says. "Of course there’s also an enormous amount of local interpretation in terms of the Common Rule, which we all see whenever we do multicenter studies. The same thing is true with HIPAA — it’s yet another barrier being put in place very variably by institutions."
Not the only one
Ness is not the only researcher who has noted the negative impact of HIPAA on research recruitment. The American Association of Medical Colleges (AAMC) conducted a survey in 2003 of researchers, IRB members, privacy officials, deans, and others involved in the conduct and oversight of research.
Out of 331 responses, 74% reported that HIPAA had affected patient recruitment, says Susan Ehringhaus, JD, AAMC associate general counsel for regulatory affairs. Seventy-six percent reported an effect on data access, and 68% reported an impact on data acquisition.
Among the issues that the AAMC identified with the implementation of HIPAA:
— a longer and more confusing informed consent document that can overwhelm or intimidate potential participants;
— an increase in the time and money required to carry out the requirements of the privacy rule;
— inconsistent interpretation of the rule by IRBs, leading to confusion, particularly in multisite trials.
The issue of privacy and research came to a head in California recently when hospitals closed down access to a process that had allowed epidemiologists to inspect cancer pathology reports very soon after a diagnosis.
The process, called Rapid Case Ascertainment, helps point out cases of very aggressive cancers, such as pancreatic cancer, at a point when subjects are still well enough to contact, says Dennis Deapen, DrPH, director of the Los Angeles Cancer Surveillance Program.
It requires that staff pore through all pathology reports, even those that turn up negative, to find prospective subjects. And post-HIPAA, says, hospitals balked at allowing that type of comprehensive access.
After months of negotiation with the California Department of Health Services, the lead hospital involved in the dispute, the University of California-San Francisco (UCSF), agreed to reinstate the review, with a few minor changes, Deapen says.
"Unfortunately, at this point, while UCSF has been resolved, many of these other hospitals have not yet allowed this to resume," he says.
And Deapen notes that the curtailment of access damages the ongoing studies that rely on the data. "All of those studies that were ongoing over those two years [of the dispute] that require this Rapid Case Ascertainment design, they are forever harmed. You can’t go back and two years later find those cases rapidly."
Looking for solutions
In presenting the findings of the AAMC study to a subcommittee advising HHS on privacy issues, Ehringhaus laid out a number of proposed revisions that could help eliminate HIPAA’s research burdens. Among them:
— Eliminating the accounting of disclosures for research. Currently, providers must stand ready to inform patients of disclosures of their records made to researchers. Deapen says hospitals are interpreting that to include even the mere viewing of a record to see if it qualifies for a study. In her presentation to the subcommittee, Ehringhaus called the requirement "expensive for providers and for their institutions, burdensome for the research enterprise and highly unlikely to provide information that is meaningful or relevant to individuals."
— Eliminating the requirement of authorization or waivers of authorization for disclosure. Ehringhaus testified that human subjects’ privacy is appropriately covered under current federal regulations specific to human subjects research.
— Simplifying the de-identification standard for research purposes. While the AAMC supports the use of de-identified medical information, the standards in the current rule are so high as to render the resulting data useless for many research purposes, Ehringhaus testified.
Ness says proposed modifications to HIPAA that would make a number of these changes, including harmonizing it with the Common Rule, were presented to HHS Secretary Tommy Thompson before he stepped down from his position in December.
She and Ehringhaus say they’re unsure where the recommendations are now, but Ness says she’s hopeful that the new secretary, Mike Leavitt, will make it a priority.
In the meantime, Ness says, IRBs need to better understand the purposes of HIPAA when considering requests for waivers of authorization.
"HIPAA was never meant to cause any slowdown in the progress of research," she says. "There’s all sorts of language in HIPAA that very clearly indicates that researchers who are working under normal IRB guidance, under normal Common Rule guidance, should readily be able to do what they had done previously without a lot of additional barriers from HIPAA.
"IRBs need to understand that these rules were not in fact meant to create barriers," Ness says. "And furthermore, impeding research progress, is really not in anyone’s interest, or to anyone’s benefit."
Reference
1. Ness RB. A year is a terrible thing to waste: Early experience with HIPAA. Ann Epidemiol 2005; 15(2):85-86.
Researchers are finding the HIPAA to be a significant barrier to recruiting research participants, in part because of the inconsistent way in which IRBs deal with requests for HIPAA waivers.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content. TESTING
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content