The Health Insurance Portability and Accountability Act's privacy rule has stymied clinical research by making it more expensive and time consuming, according to data from a national survey of more than 1,500 epidemiologists.
The Institute of Medicine commissioned this first-ever, large-scale survey to assess the effect of the privacy rule, which was implemented in 2003 to protect research subjects' privacy while still preserving the legitimate use and disclosure of their health information. The findings confirm those of case reports and smaller or single-institution studies: The privacy rule's overall effect on research has been more negative than positive, said Dr. Roberta B. Ness of the University of Pittsburgh and her associates.
The rule requires researchers to obtain written authorization to access medical records or to obtain a waiver from an institutional review board (IRB). In practice, compliance entails following and documenting complex bureaucratic procedures—particularly patient consent—that complicate the research process.
A total of 1,527 epidemiologists from academia, industry, government, and nongovernment organizations completed the anonymous Web-based survey, which elicited both positive and negative feedback on the privacy rule.
Three major themes emerged from the responses.
First, a solid majority “expressed frustration and concern that the implementation of the privacy rule had added patient burden without substantially enhancing privacy protection.” In the words of one respondent, an “already cumbersome patient consent form now has an additional [page and a half] explaining HIPAA restrictions. This detracts from the informed consent process pertaining to the more critical issue: the actual medical risks and benefits of participating.”
Nearly 70% of respondents said that complying with the rule made their work much more difficult; an additional 16% said it made their work more difficult. In all, 40% said the rule greatly increased costs, and another 21% said it raised costs moderately. And half said it added considerably to the time needed to complete studies, while an additional 20% said it required extra time. Only 10% said that the rule strengthened public trust, and only 25% said it enhanced patient confidentiality.
Second, research institutions varied widely in their interpretation of privacy rule regulations. This impeded multicenter projects, and left many researchers confused about what research their IRB might or might not sanction. As many as one in nine epidemiologists (11%) had conceived of a study but did not submit it to an IRB because they thought it would not obtain approval under the HIPAA privacy rule, Dr. Ness and her associates said (JAMA 2007;298:2164–70).
Third, compliance with the privacy rule slowed research to such a degree that half of the respondents felt it is “seriously affecting” public health surveillance, which may threaten the ability to combat epidemics and other dangers. As one respondent noted, “I and my staff spend more and more time doing compliance-related things and less and less time doing actual research.”