Cancer Research and Privacy: The Problem With Being Joined at the Hip

The Health Information Portability and Accountability Act (HIPAA) passed in 1996 had three objectives: to make insurance portable between jobs, to provide tax provisions to make insurance portable, and to simplify administration of electronic health information. Because of concerns that access to electronic health information could endanger privacy, confidentiality standards were created under the HIPAA Privacy Rule. Only after prolonged debate and consideration did the US Department of Health and Human Services elect to subject health research to the final Privacy Rule passed in August 2002. The decision to bond research and privacy has affected the cancer research enterprise broadly but unevenly, as evidenced in the report by Goss et al, which describes variations in attitudes toward and application of the regulation, in this issue of Journal of Clinical Oncology. What does the HIPAA Privacy Rule actually say, and why is the interpretation so varied and sometimes overly conservative? HIPAA establishes conditions under which protected health information, consisting of any of 18 identifiers including dates other than year and geographic regions smaller than state, may be disclosed for research purposes. Individuals may provide authorization or institutional review or privacy boards may issue waivers of authorization for use of such protected health information for research purposes. The interpretation of “specific and meaningful” authorization by individuals under HIPAA is a major source of inconsistent oversight and often results in prohibition of future use of data or biospecimens. The extensive but imprecise criteria for waivers of authorization are another major cause of inconsistent application. Despite issued guidance, some institutions have interpreted the vagaries of “minimal risk,” “adequate,” and “practicably” terminology in the rule so conservatively that even low-risk research has not been able to proceed. In the ASCO-sponsored study presented by Goss et al, structured interviews with compliance officers and investigators were conducted across a range of sites to provide diversity in geography, size, and nature of institution conducting research. Leading research institutions in this country were represented in the study, yet the inconsistencies in future-use language and application of authorization waivers were striking. The practical result of this variance in setting compliance standards is that multisite research may be complicated, slow, and more costly; it may even be abandoned. How applicable are these data to real-life scenarios and high-impact cancer research? The December 2008 Oncologic Drugs Advisory Committee evaluated the impact of KRAS mutation status on the efficacy of epidermal growth factor receptor (EGFR) –directed therapy in metastatic colorectal cancer. A total of 5,500 patients were accrued to seven multicentric, multinational randomized clinical trials conducted with standard treatment with and without EGFR-directed monoclonal antibodies (cetuximab or panitumumab). Despite the fact that 100% of patients had tissue assessed for EGFR expression, tissue availability for KRAS testing ranged from 23% to 92% in individual studies. Among the most frequent reasons for lack of tissue availability and release of additional material was the determination by the institutional review boards and pathology departments of participating institutions that KRAS testing was not explicitly covered by the informed consent in the original studies. Although the retrospective KRAS observations in colorectal cancer are to be applauded as an advance toward personalized medicine and an example of wiser use of health care resources, a restrictive interpretation of authorization might have disallowed KRAS evaluation in a sizeable proportion of participating patients. Of note, ascertainment in a large portion of randomly selected patients is one of five conditions cited by the US Food and Drug Administration that should be met for retrospective biomarker analyses. The KRAS example confirms the variation reported in the ASCO study and bodes ominously for future studies that could take advantage of valuable data and biospecimen repositories. The Institute of Medicine (IOM) recently concluded that the HIPAA Privacy Rule is significantly flawed, because it fails to protect privacy, and it impedes health research. To provide current, systematic data for deliberation on the impact of the Privacy Rule on research, the IOM commissioned several new surveys and focus groups, as well as the ASCO structured interviews summarized by Goss et al. These studies and others demonstrated that a reliance on consent impedes valuable research by reducing recruitment, creates selection bias, produces research obstacles involving repositories and genetic data, and sometimes causes physicians and entire hospitals to opt out of research. In truth, patients often do not read or understand complex informed consent documents or privacy forms, and ill and distressed patients may not be capable of handling complex decision making. Perhaps most importantly, consent does not protect against security breaches, a major concern with electronic health information. The ASCO study demonstrates the complexities of interpreting and applying the HIPAA Privacy Rule in scenarios ranging from survivorship research to recruitment for genetic studies to establishment and use of data and biospecimen repositories. As a result, Goss et al call for additional institutional training and the development of best practice guidelines for interpretation of the Privacy Rule. The IOM JOURNAL OF CLINICAL ONCOLOGY E D I T O R I A L VOLUME 27 NUMBER 24 AUGUST 2