November 21, 2001
The Honorable Tommy G. Thompson
Secretary
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Washington, DC 20201
Dear Secretary Thompson:
As part of its responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the National Committee on Vital and Health Statistics (NCVHS) monitors the implementation of the Final Rules that adopt the health data standards required by the Administrative Simplification provisions of HIPAA.
On August 21-23, 2001, the NCVHS Subcommittee on Privacy and Confidentiality held public hearings on the implementation of the final rule “Standards for Privacy of Individually Identifiable Health Information” that was published on December 28, 2000. More than 30 people, including health care providers, payers, researchers, members of professional organizations, other users of health care information, and members of the public testified on four key issues identified by the Department of Health and Human Services’ Office for Civil Rights (OCR) and NCVHS: (1) the requirement for consent in order to use protected health information for treatment, payment, and health care operations; (2) the requirement that covered entities make reasonable efforts to limit the use and disclosure of protected health information to the minimum necessary; (3) the effect of the rule on research; and (4) the marketing provisions.
The focus of the hearings was to explore practical issues in implementing the final rule, including unintended consequences of the rule, possible inconsistencies, and areas needing further clarification. Panelists were asked to provide specific suggestions for possible modifications of the rule. Additional written comments from testifiers and others were also received.
In an October 1, 2001 letter to you, NCVHS addressed the consent requirements and the minimum necessary provisions, and provided recommendations for you to consider. This letter contains our recommendations on the research provisions. Because OCR staff attended the hearings and received copies of all the written comments, including comments that addressed issues that were beyond the scope of the hearings, OCR will have the opportunity to consider these additional issues not covered in this letter.
NCVHS will continue to seek public comments on the implementation of HIPAA administrative simplification provisions. In light of widely voiced concern about the lead time needed for implementation, NCVHS respectfully recommends that modifications to the privacy rule be made and disseminated as expeditiously as is possible.
Witnesses expressed concern that the additional costs and administrative burdens they believe will be generated when researchers comply with the privacy rule may have a detrimental impact on researchers’ access to essential medical information and, therefore, on researchers’ abilities to pursue their mission. There was also concern that fears of the civil and criminal penalties for the improper use and disclosure of information create a disincentive for covered entities to share information with researchers, even when the disclosure to researchers is permitted by the privacy rule. On the other hand, written testimony from others expressed the view that the privacy rule may build public trust in research and help ensure that researchers receive complete and accurate health information for their studies.
NCVHS is committed to maximizing access to protected health information that is essential for research, as long as the information is used with respect for the privacy of the subjects, under careful safeguards to ensure that identifiable information is truly needed and the information will be protected against misuse.
NCVHS detected a high level of anxiety regarding the potential effects of the privacy rule on research. The recommendations in this letter have been drafted to prevent possible overreactions to the privacy rule that could needlessly impair research.
The Committee makes the following recommendations:
Several witnesses expressed concern and confusion about the relationship between the privacy rule and the Common Rule. Witnesses questioned the privacy rule’s layering of additional privacy protections on top of the Common Rule’s requirements.
NCVHS recommends that HHS, through coordination between the OCR and the Office for Human Research Protections, provide interpretations, guidance, and technical assistance to help the research community in understanding the relationship between, and congruence of, the privacy rule and the Common Rule. The focus of these cooperative measures should be the standards that institutional review boards (IRBs) and privacy boards apply in approving use and disclosure of protected health information for research.
Some witnesses recommended that the privacy rule be modified to characterize use or disclosure of personal health information for research as an element of treatment, payment, and health care operations, and thus permitted under the patient’s consent to these activities. This would permit use or disclosure of protected health information for research without either obtaining the patient’s authorization or seeking approval from an IRB or privacy board. Although research is an essential medical activity, NCVHS does not consider research to be subsumed within treatment, payment, and health care operations.
NCVHS recommends that the privacy rule continue to require either individual authorization or a waiver from an IRB or privacy board to conduct research involving protected health information, and that research activities not be included within treatment, payment, and health care operations.
Witnesses expressed concern about the difficulty of conducting research on health data that have been de-identified according to the privacy rule requirements. It was asserted by the witnesses that the standards for de-identification are too restrictive (essentially stripping off all identifiers), such that the data have minimal value for research. Other alternatives, such as hiring a statistician, were perceived as unduly burdensome.
NCVHS recommends that HHS reconsider whether the provisions of the privacy rule dealing with the de-identification of information unduly interfere with research and, if so, search for options to reduce the undue interference.
Witnesses raised concerns about the recruiting of research subjects. As the rule currently reads, it is permissible for researchers to use protected health information (e.g., search the records of former patients based on diagnosis) to formulate a research design. However, without either individual authorization or IRB or privacy board waiver, information derived from the medical records may not be removed from the premises of the covered entity. Witnesses expressed concern that, unless the results of the analysis of the medical records can be retained, then researchers would be required to search the records a second time after IRB approval of the study protocol.
NCVHS recommends that HHS provide guidance on alternative ways to develop research protocols under the privacy rule to minimize the researcher’s burden in recruiting subjects.
Several members of the research community expressed concern about the provisions requiring an accounting of disclosures of protected health information for research. Specifically, researchers were concerned that covered entities would refuse to share protected health information for research because of the requirement of accounting for all disclosures.
NCVHS supports the accounting for disclosure requirements as serving a basic right of individuals to know who has obtained information about them. However, in view of possible confusion or misunderstanding, NCVHS recommends that HHS provide interpretations, guidance, and technical assistance to aid the provider and research communities in maintaining the accounting in ways that are convenient and practical.
NCVHS received testimony raising a variety of concerns regarding research. On closer examination, some of the testimony contained assertions at variance with what the rule actually says. NCVHS believes that this indicates considerable misunderstanding of the effect of the privacy rule on research.
To promote better understanding and to facilitate compliance, NCVHS recommends that HHS make the research provisions of the privacy rule a priority for its education and outreach efforts.
NCVHS recommends that HHS coordinate the activities of its agencies to ensure that the privacy rule requirements for research are consistent with other HHS regulations.
NCVHS is continuing to explore a range of other issues related to the privacy rule, including marketing, fundraising, and disclosures associated with the regulatory requirements of the Food and Drug Administration. We will provide you with recommendations on these issues as soon as possible.
We appreciate the opportunity to offer these comments and recommendations.
Sincerely,
/s/
John Lumpkin, M.D., M.P.H.
Chair
cc: HHS Data Council Co-Chairs