How research will adapt to HIPAA: a view from within the healthcare delivery system.

How Research Will Adapt to HIPAA: A View from Within the Healthcare Delivery System^ ^ A version of these remarks was given as the Fourth Annual Justice Louis Brandeis Lecture, delivered at the 24th Annual Meeting of the Massachusetts Health Data Consortium, Boston, Mass., April 12, 2002; sponsored by Nutter, McClennen & Fish, LLP. I. INTRODUCTION While the new Health Insurance Privacy and Accountability Act (HIPAA)1 research rules governing privacy, confidentiality and personal health information will challenge the research and medical communities, history teaches us that the difficulty of this challenge pales in comparison to the potential harms that such regulations are designed to avoid. Although revised following broad commentary from researchers and healthcare providers around the country, the HIPAA privacy requirements will dramatically change the way healthcare researchers do their jobs in the United States.2 Given our reluctance to change, we risk overlooking potentially valid reasons why access to personal health information is restricted and regulated. In an environment of electronic information, public concern, genetic information and decline of public trust, regulations are ever-changing. Six categories of HIPAA requirements stand out as transformative: disclosure accounting/tracking, business associations, institutional review board (IRB) changes, minimum necessary requirements, data de-identification, and criminal and civil penalties. However, the silver lining is that these requirements will push research organizations to improve data policies, processes and technology, and these improvements may lead to enhanced trust on the part of the American public. It is time to find constructive ways to implement HIPAA-ways that will accommodate the interests of science while protecting the privacy of medical records. II. HIPAA PRIVACY STANDARDS "[It is] the most dangerous attack on academic freedom in this land in modern times."3 Discussions around the academic water cooler would certainly lead one to believe this quote came from a modern scientist's discussion of HIPAA. It might refer to HIPAA's privacy standards, as today's researchers are wary and indignant about its limitations: much research will have to be "delayed or perhaps forgone";4 the rule "[burdens] biomedical and behavioral research with onerous procedural requirements, ambiguous regulatory standards, and extensive new liability concerns";5 "access to medical information may become more burdensome and costly, and some [medical research] may not happen."6 In a letter to the Secretary of Health and Human Services, the Association of American Medical Colleges (AAMC) complained that "[these] limits . . . will seriously impair our ability to conduct clinical trials, clinico-pathological studies of the natural history and therapeutic responsiveness to disease, epidemiological and health outcome studies, and genetic research."7 The above quotation,8 however, is not a comment on the HIPAA privacy standards. Instead, it was the reaction of a political scientist testifying before Congress in the late 1970s as he described the institutional review of ethics in scientific research. This reaction represents a valuable historical lesson that, although our society's attitude toward scientific research and the resulting limitations placed on research are ever-changing, this does not precipitate a dramatic end to research. Indeed, this is not the first time we have changed research as we know it. It is also not the first time that researchers have bewailed such regulations. In 1978, a document known as the Belmont Report declared that certain ethical principles and guidelines should be used to resolve the problems that "underlie the conduct of research involving human subjects."9 This report culminated years of intense and often caustic debate-a debate that began in earnest with the opening of the Nuremberg Trial in 1946-about "the medical ethics applicable to experimentation on human beings. …