Passive Consent for Clinical Research in the Age of HIPAA

Clinical research requires trade-offs between the rights of subjects and the benefits to populations of the knowledge gained. For many years, informed consent has been the cornerstone of clinical research ethics and the approach to this trade-off. Federal regulations governing consent for human research in the United States have 3 main components: The Federal Food, Drug, and Cosmetic Act of 1938 (Public Law 75-717), which covers certain research activities regulated by the Food and Drug Administration; the “Common Rule,” adopted in 1991 by 16 federal agencies (U.S. Code of Federal Regulations 45CFR Part 46, among others), which governs the activities of most other federally supported medical researchers and provides for Institutional Review Boards (IRBs); and the Health Insurance Portability and Accountability Act (HIPAA) of 1996 (Public Law 104-191, 45CFR Parts 160 and 164), which governs confidentiality of personal information in health care, including research. These 3 laws share a common foundation in the concept of informed consent. In general, they require that participants provide their active and fully informed consent. They also prohibit the transfer of identifiable health information such as names, diagnoses, and test results to researchers without the patient's consent. The elements of informed consent are described in the common rule. Section 46.117 requires that consent “be documented by the use of a written consent form approved by the IRB and signed by the subject or the subject's legally authorized representative.” Health Insurance Portability and Accountability Act broadened the protection of human subjects to all research conducted by a covered entity such as a physician, hospital, or health plan, regardless of funding. It uses the same language found in the common rule to describe informed consent. Both HIPAA and the common rule allow for a waiver or alteration of the consent process at the discretion of the IRB under certain circumstances. “An IRB may approve a consent procedure which does not include, or which alters, some or all of the elements of informed consent set forth in this section, or waive the requirements to obtain informed consent provided the IRB finds and documents that: the research involves no more than minimal risk to the subjects; the waiver or alteration will not adversely affect the rights and welfare of the subjects; the research could not practicably be carried out without the waiver or alteration; and whenever appropriate, the subjects will be provided with additional pertinent information after participation.” (45CFR 46.116(d)) If these circumstances are met, the IRB may authorize an alteration or omission of parts of the consent process, or even allow the study to proceed without any consent process. Before their implementation, many observers expressed concern that these rules, especially the HIPAA regulations, would have a chilling effect on health research.1 For instance, the Vice President of the American Association of Medical Colleges wrote that the regulations pose “serious and ill-advised obstacles to the conduct of clinical studies.”2 Some noted that IRBs seem reluctant to use the waiver provisions3 and that the use of waivers and other aspects of informed consent vary widely from board to board.4,5 Since the implementation of HIPAA, empirical data on the impact of HIPAA have begun to appear. Researchers in Wisconsin documented a reduction in the number of proposed medical record and database research projects.6 Before HIPAA, 89% of such proposals were approved and all went through an expedited process. By 2002, approval without revision dropped to 59%. Investigators in Michigan using a coronary syndrome registry documented a decline in permission for follow-up from 96% to 34% after HIPPA.7 A recent report from Canada further detailed the difficulties and costs (both financial and scientific) of requiring a full consent process in low-risk research.8 Despite aggressive recruitment, only about half of eligible patients could be enrolled. The barrier of the burdensome consent process rendered this critically needed data set largely useless. European experience with consent for registries has also been problematic.9 In this legal and research environment, we sought to develop a clinical registry as part of a quality improvement research project. To balance the rights of potential subjects against the need for a broad and representative population, we used little-known consent procedures authorized by HIPAA and other federal regulations.