information, raising concern over issues related to privacy and confidentiality. The federal system of protections was developed largely in response to biomedical and behavioral research that caused harm to human subjects. To protect the rights and welfare of human subjects in research, the Common Rule requires organizations conducting federally supported or regulated research to establish and operate IRBs, which are, in turn, responsible for implementing federal requirements for research conducted at or supported by their institutions. IRBs are intended to provide basic protections for people enrolled in federally supported or regulated research. Most of the estimated 3,000 to 5,000 IRBs in the United States are associated with a hospital, university, or other research institution, but IRBs also exist in managed care organizations (MCO), government agencies, and as independent entities employed by the organizations conducting the research. IRBs are made up of both scientists and nonscientists. The organizations that we contacted primarily conduct health research to advance biomedical science, understand health care use, evaluate and improve health care practices, and determine patterns of disease. These organizations use health-related information on hundreds of thousands, and in some cases millions, of individuals in conducting their research. The MCOs and integrated health systems in our study use medical records data, which are generated in the course of treating patients, to conduct epidemiological research and health services research, such as outcomes and quality improvement studies. For example, one MCO, in conducting a quality improvement study, determined from its claims database whether patients with vascular disease were receiving appropriate medications and reported the findings to patients’ physicians to assist in the treatment of their patients. The pharmaceutical and biotechnology companies that we contacted also conduct health services and epidemiological research; but unlike MCOs and integrated health systems, they rely on data from other organizations for this type of research. One pharmaceutical company’s epidemiology department, for example, conducts large-scale studies using data from MCOs and health information organizations to monitor the effectiveness of drugs on certain populations. For pharmacy benefit management (PBM) firms, which administer prescription drug benefits for health insurance plans, a primary source of data is prescription information derived from prescriptions dispensed by mail or claims received from retail pharmacies. PBMs design and evaluate programs that are intended to improve the quality of care for patients who have specific diseases or risk factors while controlling total health care costs. One PBM in our study, for example, develops disease management programs; these programs depend on the ability to identify individuals with conditions, such as diabetes, that require more intensive treatment management. The health information organizations that we contacted rely solely on data from other organizations. Typically, they collect medical claims data from their clients or obtain it from publicly available sources, such as Medicare and Medicaid. They may also acquire data through employer contracts that stipulate that all the employers’ plans provide complete data to a health information organization. Examples of research projects include studies of the effects of low birth weight on costs of medical care and the effectiveness of alternative drug therapies for schizophrenia. Officials at the organizations we contacted believe that many of these studies require personally identifiable information to ensure study validity or to simply answer the study question. For longitudinal studies, researchers may need to track patients’ care over time and link events that occur during the course of treatment with their outcomes. Researchers may also need to link multiple sources of information, such as electronic databases and patient records, to compile sufficient data to answer the research question. For example, officials at one health information organization stated that without patient names or assigned patient codes, it would not have been possible to complete a number of studies, such as the effects of length-of-hospital stay on maternal and child health following delivery and patient care costs of cancer clinical trials. Some of the research conducted by the organizations we contacted must conform to the Common Rule or FDA regulations because it is either supported or regulated by the federal government. Several MCOs obtain grants from various federal agencies, including the Centers for Disease Control and Prevention; one health information organization that we contacted conducts research for federal clients, such as the Agency for Health Care Policy and Research. Some organizations that conduct both federally supported or regulated research and other types of privately funded research choose to apply the requirements uniformly to all studies involving human subjects, regardless of the source of funding. However, some other organizations that carry out both publicly and privately funded research apply the federal rules where required, often relying on IRB review at collaborators’ institutions, but do not apply the rules to their privately funded research. Pharmaceutical and biotechnology companies, for example, rely on the academic medical centers where they sponsor research to have in place procedures for informed consent and IRB review, but they do not maintain their own IRBs. Some organizations conduct certain activities that involve identifiable medical information, but they do not define these activities as research. For example, officials at several MCOs told us that they did not define records-based quality improvement activities as research, so these projects are not submitted for IRB review. But there is disagreement as to how to classify quality improvement reviews, and some organizations do submit these studies for IRB review, where they define the studies as research. Finally, at some organizations, none of the research is covered by the Common Rule or FDA regulations and no research receives IRB review. For example, one PBM in our study, which conducts research for other companies—including developing disease management programs—does not receive federal support and, thus, is not subject to the Common Rule in any of its research. While it does not have an IRB, this PBM uses external advisory boards to review its research proposals. Another type of research that for some companies does not fall under the Common Rule or FDA regulations is research that uses disease or population-related registry data. Pharmaceutical and biotechnology companies maintain such registries to monitor how a particular population responds to drugs and to better understand certain diseases. While many organizations have in place IRB review procedures, recent studies that pointed to weaknesses in the IRB system, as well as the provisions of the Common Rule itself, suggest that IRB reviews do not ensure the confidentiality of medical information used in research. While not focusing specifically on confidentiality, previous studies by GAO and by the Department of Health and Human Services (HHS) Office of Inspector General have found multiple factors that weaken institutional and federal human subjects protection efforts. In 1996, we found that IRBs faced a number of pressures that made oversight of research difficult, including the heavy workloads of and competing professional demands on members who are not paid for their IRB services. Similarly, the Inspector General found IRBs unable to cope with major changes in the research environment, concluding that they review too many studies too quickly and with too little expertise, and recommended a number of actions to improve the flexibility, accountability, training, and resources of IRBs. Under the Common Rule, IRBs are directed to approve research only after they have determined that (1) there are provisions to protect the privacy of subjects and maintain the confidentiality of data, when appropriate, and (2) research subjects are adequately informed of the extent to which their data will be kept confidential. However, according to the Director of the Office for Protection From Research Risks (OPRR), confidentiality protection is not a major thrust of the Common Rule and IRBs tend to give it less attention than other research risks because they have the flexibility to decide when it is appropriate to review confidentiality protection issues. Consistent with federal regulations, the seven IRBs that we contacted told us that they generally waive the informed consent requirements in cases involving medical records-based research. Researchers at the organizations we visited contend that it is often difficult, if not impossible, to obtain the permission of every subject whose medical records are used. As an example, the director of research at one integrated health system described a study that tracked about 30,000 patients over several years to determine hospitalization rates for asthmatic patients treated with inhaled steroids. The IRBs that we contacted told us that they routinely examine all research plans using individually identifiable medical information to determine whether the research is exempt from further review, can receive an expedited review, or requires a full review. Further, in reviewing research using individually identifiable genetic data, two of the IRBs had policies to consider additional confidentiality provisions in approving such research. The actual number of instances in which patient privacy is breached is not fully known. While there are few documented cases of privacy breaches, other reports provide evidence that such problems occur. For example, in an NIH-sponsored study, IRB chairs reported that lack of privacy and lack of confidentiality were among the most common complaints made by research subjects. Over the past 8 years, OPRR’s compliance staff has investigated several allegations involving human subjects protection violations resulting from a breach of confidentiality. In the 10 cases provided to us, complaints related both to research subject to IRB review and to research outside federal protection. In certain cases involving a breach in confidentiality, OPRR has authority to restrict an institution’s authority to conduct research that involves human subjects or to require corrective action. For example, in one investigation, a university inadvertently released the names of participants who tested HIV positive to parties outside the research project, including a local television station. In this case, OPRR required the university to take corrective measures to ensure appropriate confidentiality protections for human subjects. In response, the university revised internal systems to prevent the release of private information in the future. However, in other cases, OPRR determined that it could not take action because the research was not subject to the Common Rule and, thus, it lacked jurisdiction. For example, in a case reported in the media, OPRR staff learned of an experiment that plastic surgeons had performed on 21 patients using two different facelift operations—one on each half of the face—to see which came out better. OPRR staff learned that the study was not approved by an IRB and that the patients’ consent forms did not explain the procedures and risks associated with the experiment.